HIPAA Training – Part III Health Insurance Portability and Accountability Act

POLICIES & PROCEDURES

Goals Learn simple ways to protect information. Learn simple ways to protect information. Learn how to continually give training. Learn how to continually give training. Learn how to continually develop procedures. Learn how to continually develop procedures.

Policy Its the law. The doctor has to sign all of them. The privacy officials name must be on them. Must be reviewed each year and proof of this must be documented.

Procedure How you apply the law to this office. Writing procedures is an everlasting process of reviewing and updating.

Why Review and Update the Procedures? New breaches are discovered. New technology is used. Office changes occur such as remodeling. What youre doing to protect PHI.

Procedures Be general. Dont be specific.

Training Have documented meetings. Each employee, including the doctor, must sign their own name on the Training Register. If the doctor does not allow training, then the doctor is liable for all fines.

Training Some discussion topics: Implementation of Policies Notice of Privacy Forms General Penalty for Failure to Comply with Requirements and Standards

Training More discussion topics: Breaches Office Procedures Regarding PHI Complaints Regarding PHI Handling Patients Restrictions Medical Release Forms Front Office Procedures Back Office Procedures Computer Security

Training Register

What Do You Have to Do to Protect Information and to Avoid the Fines? Understand two basic questions: Continually have training. Keep records.

Keep Records Every time you have training you must record it. This is the government. If you dont have records, then training was never done.

HIPAA Security Computers were required to be secured by April of Password Hackers Levels of service

OBJECTIVES Understand HIPAA Security Rule Understand basics of network security

HIPAA Security Standard What is the purpose? Establish a standard for health care providers with regards to treatment of patient health information Give patients more control and access to their medical information Secure protected health information (PHI) transmitted, stored, or maintained in electronic format from real or potential threats of disclosure or loss

HIPAA Security Standard General Consistent with the Privacy rule in that the Security part of the Privacy rule requires that appropriate security be applied to all PHI in all events Focuses more on what needs to be done, rather than how. Cost of implementation is a factor, but not a preclusion. Cost, size, technical infrastructure and criticality of potential risks are factors, allowing for a flexible approach. Sets out processes for decision-making, but does not make decisions; remains technology neutral. Results and documentation both are important.

HIPAA Security Standard What the rule does? Ensures the confidentiality, integrity, and availability of all electronic PHI a covered entity (CE) creates, receives, maintains, or transmits. Protects against any reasonably anticipated threats or hazards to the security or integrity of such information Protects against any reasonably anticipated uses or disclosures of such information that are not permitted or required Ensures compliance by covered entities workforce

Privacy vs. Security Privacy Individuals rights to control access and disclosure of their protected or individually identifiable healthcare information Establish authorization requirements Establish individual rights Establish regulations for use or disclosure of PHI Security Establishes minimum level of security that covered entities must meet Adopts standards for the security of ePHI to be implemented by covered entities Improving the efficiency of the healthcare industry in general

Three Pillars of Data Security ConfidentialityIntegrityAccessibility Data or information is not made available to unauthorized persons or processes Data or information has not been altered or destroyed in an unauthorized manner Data or information is accessible and usable upon demand by an authorized person

Security Rule Organization Safeguards Administrative Administrative actions, policies, and procedures, to manage, the selection, development, and implementation, including the maintenance of security measures to protect electronic health information and to manage the conduct of the covered entitys workforce in relation to the protection of that information. Physical Security measures to protect a covered entitys electronic information systems and related buildings and equipment from environmental hazards and unauthorized intrusions. Technical The technology and policy and procedures for how to protect electronic protected health information and control access to it.

Electronic Data Security Electronic Data Security: The generic name for the tools designed to protect data and to prevent intrusions. Principle of Easiest Penetration: An intruder must be expected to use any available means of penetration. This is not the most obvious means, nor is it one against which the most solid defense has been installed. Principle of Adequate Protection: Computer hardware and software must be protected to a degree consistent with their value. Electronic data never loses its value, unless the information becomes outdated and obsolete.

Security Threats Virus Spyware Adware Worms Trojan Horse Phishing (pharming) War Dialing Social Engineering

Preying on the Best Qualities of Human Nature: The desire to be helpful The tendency to trust people The fear of getting into trouble A successful social engineer receives information without raising any suspicion as to what they are doing.

Social Engineering Impersonation Impersonation Important user Important user Third-party authorization Third-party authorization Technical support Technical support There are system problems and you will have to log me on to check the connection

Recognize the Signs In Person May appear as an employee or Dressed in a uniform. Part of the cleaning crew. Roams without raising suspicion. Dumpster Diving Shoulder Surfing Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information.

Social Engineering Refuse to give contact information Rushing Name-dropping Intimidation Small mistakes Request confidential information Request you to do something improper

What can you do? Ask Questions! Correct spelling of the persons name? Number where you can return the call? Contact information? Why the information is needed. Who authorized the request. Verify the authorization And Do It !!!

Where Do Intruders Come From? Who are these threat agents? Teenage pranksters Hacker junkies Disgruntled employees Disgruntled patients Competitors Terrorists (disruption of services) Criminals (selling information)

Physical Vulnerabilities and Access Being aware of your surroundings! Wheres my computer located? Is anyone watching me? Is the hallway door open? Is the monitor visible from the window? Is the computer visible from the patient waiting area? Are the servers in locked rooms or cabinets? Does the cleaning crew have access to the computers? Does the screen saver activate when idle? Do I log out before leaving the room? Do I use my PC for a night light?

Password Vulnerabilities If you think its weak, then it is weak Passwords First line of defense against unauthorized access to your: Computer, Files, Network Connections, Key to your electronic identity Do Not Use: Any dictionary words, any proper names, common phrases, obvious passwords, keyboard words, let a website save it, use the same one. What to use: At least eight characters, at least one capital letter, At least one number, at least one special character, one you can remember, change them regularly

Your Account Is Only As Secure As Its Password Recommendation 120 day rotation Don't let others watch you log in. Change your password often. Dont write your password on a post-it note Dont attach it to your video monitor or under the keyboard. xT21b31

Password Construction It cant be obvious or exist in a dictionary. Every word in a dictionary can be tried within minutes. Dont use a password that has any obvious significance to you.

Password Standard Eight character minimum and should contain at least one of each of the following characters: Uppercase letters ( A-Z ) Lowercase letters ( a-z ) Numbers ( 0-9 ) Punctuation marks )

Password Management Its OK to share offices, equipment and ideas, but... Do not share your password with anyone, anytime!

Safeguard Your Strong Password Be careful about typing your password into a strange computer. Anti-virus protection enabled? Owner trustworthy? Keyboard logger running to record your keystrokes? Who was the last person to use that computer? Do not use the automatic logon feature in Microsoft.

Vulnerabilities s Are you opening Pandora's box? Basic method of communication to transfer: Messages, Files, Programs What to look out for: Extensions (.xls,.doc,.php,.ppt,.exe,.vbs,.bin,.com, pif); Suspicious Subjects Lines; I love you/My daughters pictures; You have won/Free Gift; Funny, Humorous, etc.; Look alike sites; Chain Letters; Web Links; Attachment not expected If it's suspicious, don't open it

Policy Permissible uses: Entitys permissible uses? Prohibited uses: Entitys prohibited uses? ALL MESSAGES SHOULD BE CONSIDERED PUBLIC!

Web Browsing Security Web Surfing Active content and viruses or other malicious software Security risks in the PC and MAC versions of Internet Explorer and Netscape browsers Company determines your security.

Visiting Internet Sites Be careful about providing personal, sensitive information to an internet site. Be aware that you can get viruses from Instant Messenger-type services.

Privileges and Responsibilities Use of your company computer account is a privilege. Along with the privilege to use company network resources come some responsibilities. Remember that Internet traffic is logged, monitored, and saved

Backups Back your computer up every night Take the back up offsite

So How Do We Start? Be aware! Learn, practice and adopt good security habits. Report anything unusual. Security is 90% You and 10% Technical

Absolute vs. Acceptable Levels of Risk Absolute protection from risk is an impossibility Acceptable level of risk is a more realistic approach to managing risk

Keep an Inventory Know exactly what equipment you have by listing an inventory. What kind of hardware do you have? What kind of software do you have? What kind of protection do you have? i.e., virus or spyware

Keep an Inventory Record: When you began using it When you stopped using it When you upgraded

The First Line of Defense Is You The Last Line of Defense is You