1. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Scott C Pettigrew Practice Consultant Privacy & Security Process and Tools Overview

2. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services The Approach 2 PrepareIdentifyPrioritizeMitigate

3. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 3 PrepareIdentifyPrioritizeMitigate Prepare: Gather the knowledge, organizational information, and expertise to successfully perform a Privacy & Security audit.

4. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Gather Knowledge Research Am I a Covered Entity (CE)? How do the Privacy & Security rules affect your organization? What are the possible implications if a breach occurs? Perform Site Inventory What technology is used in your practice? Do these items transmit, process, or store EPHI? Do you have a set of relevant policies and procedures? Where are they located? When were they last updated? When did you last review them with your staff? 4 PrepareIdentifyPrioritizeMitigate

5. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Assemble Your Team Internal Resources Who are your designated Privacy/Security Officers? Who in your organization has the most knowledge about technology and how it’s used? External Resources IT Vendor Parent or Affiliate Organization IT Security Staff EHR Vendor Regional Extension Center Security Organizations 5 PrepareIdentifyPrioritizeMitigate

6. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Preparation REC-Provided Document: Privacy & Security Preparation: Necessary Resources 6 PrepareIdentifyPrioritizeMitigate

7. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Preparation ONC-Provided Document: HIT Security Risk Assessment Questionnaire: Inventory Assets (Preparation) 7 PrepareIdentifyPrioritizeMitigate http://www.healthit.gov/providers- professionals/core-measure-15

8. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Soapbox: Encryption Lost /stolen devices are a major cause of reported security breaches! How would you prove what patient records were on a missing device? (Hint: If you don’t do daily backups, this is nearly impossible!) 8 PrepareIdentifyPrioritizeMitigate

9. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Soapbox: Encryption Encryption is not necessarily expensive! Free Alternatives: PC: Microsoft EFS, BitLocker, TrueCrypt Apple OSX: FileVault, TrueCrypt 9 PrepareIdentifyPrioritizeMitigate

10. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Preparation REC-Provided Document: Computer & Mobile Technology Encryption Log 10 PrepareIdentifyPrioritizeMitigate

11. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 11 PrepareIdentifyPrioritizeMitigate Identify: Assess each functional area and technology resource where EPHI is processed, stored, or transmitted to find areas of vulnerability.

12. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Facility Walkthrough Tools: Identification 12 PrepareIdentifyPrioritizeMitigate

13. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Identification Risk Assessment Questionnaire: Screening Questions (Step 1) 13 PrepareIdentifyPrioritizeMitigate

14. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 14 PrepareIdentifyPrioritizeMitigate Prioritize: Examine each possible vulnerability, honestly rating the current systems’ effectiveness, likelihood of breaches, and the impact a breach would have.

15. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Prioritization Risk Assessment Questionnaire: People & Processes (Step 2a) 15 PrepareIdentifyPrioritizeMitigate

16. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Prioritization Risk Assessment Questionnaire: Technology (Step 2b) 16 PrepareIdentifyPrioritizeMitigate

17. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 17 PrepareIdentifyPrioritizeMitigate Mitigate: For each identified area of vulnerability, maximize the effectiveness of existing controls, and minimize both the possibility of breach and the extent of damage should an unavoidable breach take place.

18. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Mitigation Risk Assessment Questionnaire: Findings – Remediation (Step 3) 18 PrepareIdentifyPrioritizeMitigate

19. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Mitigation REC-Provided Document: Identified Vulnerability Action Plan 19 PrepareIdentifyPrioritizeMitigate

20. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 20 PrepareIdentifyPrioritizeMitigate Prepare: Continue to gather the knowledge, organizational information, and expertise to successfully review and update your Privacy & Security audit on a yearly basis.

21. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Prepare Now In Case of Audit! CMS recommends the following documentation be retained: 21 PrepareIdentifyPrioritizeMitigate Source: http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/EHR_SupportingDocumentation_Audits.pdfhttp://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/EHR_SupportingDocumentation_Audits.pdf Meaningful Use ObjectiveAudit ValidationSuggested Documentation Protect Electronic Health Information Security risk analysis of the certified EHR technology was performed prior to the end of the reporting period Report that documents the procedures performed during the analysis and the results. Report should be dated prior to the end of the reporting period and should include evidence to support that it was generated for that provider’s system (e.g., identified by National Provider Identifier (NPI), CMS Certification Number (CCN), provider name, practice name, etc.)

22. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Preparation REC-Provided Document: Policy Review Log 22 PrepareIdentifyPrioritizeMitigate

23. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Contact Us! Visit us online at www.tristaterec.orgwww.tristaterec.org Email us at rec@healthbridge.orgrec@healthbridge.org Call us at 513-469-7222, ext. 3 Follow us on Twitter: @HealthBridgeHIO Like us on Facebook: www.facebook.com/pages/Cincinnati- OH/HealthBridge/128672340540952 www.facebook.com/pages/Cincinnati- OH/HealthBridge/128672340540952 23