Presentation on theme: "INADEQUATE SECURITY POLICIES Each covered entity and business associate must have written polices that cover all the Required and Addressable HIPAA standards."— Presentation transcript:
INADEQUATE SECURITY POLICIES Each covered entity and business associate must have written polices that cover all the Required and Addressable HIPAA standards How to Mitigate: Write it down! Even if you feel your security practices are weak, if they are documented that is a huge step for compliance. You can start with template policies but these will not represent what you do. Modify them to your practices. Hire someone to help you perform a basic risk assessment and document it.
CLOUD COMPUTING More and more organizations are putting their networks in the cloud. If the network fails, the entire system is unavailable for the entire organization. Cloud systems are not maintained in the office and access controls need to implemented. How to Mitigate: Have a business continuity plan in place. Consider the need for redundant systems. Make sure your organization understands and has a service level agreement in place. Understand who may have access to your equipment and networks.
UN-PATCHED SOFTWARE Un-patched software leaves programs and systems open to vulnerabilities. How to Mitigate: Stay up to date on patches. Secure firewalls in place on an organizations network. Run virus protection software and enable automatic updates.
USERS WITH ADMINISTATOR RIGHTS ON THEIR COMPUTERS Administrator rights gives the user the ability to install software and make changes to the operating system. How to Mitigate: Give users the minimum privileges they need to do their job. Have a limited number of people be responsible for software installation and maintenance.
GENERATION-Y FACTOR A new generation of workers enters the field who have grown up with technology and are known as the click-through generation. This generation has always had access to technology and the Internet and tends to accept or ignore risks. How to Mitigate: Strong controls over Internet browsing and frequent employee education. See Risk Number 7
SECURITY BACKLASH Organizations stop implementing or weaken security policies because employees and customers feel its too hard and time consuming to comply with current policies. How to Mitigate: Employee education about the risks of security and not just on what they have to do. Complete training for employees and customers on the security tools in place to ease the strain of use.
MEDICAL IDENTITY THEFT Patients may divulge too much information to the public or to their friends and family members. Social networking sites pose a risk of phishing for sensitive information, posing a risk of data breeches (HIPAA). Patients also share their insurance or the records are stolen. How to Mitigate: Create policies and procedures for patient identification. Educate patients on proper steps for reviewing medical information and claims from Explanations of Benefits.
MOBILE DEVICE SECURITY Employee or Employer owned cell phones, smart phones, and tablets connect to networks and have company information on them. How to Mitigate: Require a password to access the device. Install GPS on the device to locate it if the device is lost or stolen. Encrypt and other company data.
LAPTOPS AND REMOVABLE MEDIA The portable nature of laptops and removable media make them a huge threat if PHI is contained on them. Some of the biggest breaches for HCOs have come from lost laptops, flash drives and backup tapes. How to Mitigate: In real estate its location, location, location. In this case the most important thing is encryption, encryption, encryption; But also education.
And the number 1 security risk is…
THE THREAT FROM INSIDE The risk of a compromised system, data breeches, or simply a curious employee. Some of the most dangerous attacks come from the inside. These attacks can be the most devastating, due to the amount of damage a privileged user can do and the data they can access. Plus they are very hard to detect. How to Mitigate: Strong access controls. Base network access on job requirements. Consider background checks. Provide reasonable access to facilities. Employee security training. Let employees know that all actions are logged and can be audited.