What the CISA Wants You to Watch For

May 21, 2020

Cyber threats in general but especially those affecting healthcare organizations have been a hot topic of discussion over the past few months. Recently, the Cybersecurity and Infrastructure Security Agency (CISA), along with the Federal Bureau of Investigation (FBI), and the Office for Civil Rights provided guidance on the most common technical vulnerabilities that have been exploited during 2020 and in particular during COVID-19. We know you’ve had a lot of information thrown your way lately, so to keep your practice up to speed and help you stay ahead of new vulnerabilities, here’s a brief overview of the bulletin’s highlights:

One of the most common trends is to use Object Linking and Embedding (OLE), where malicious malware is embedded or linked within other seemingly harmless content. OLE has been a huge gateway for hackers in 2020 thus far. It’s important to be aware of this commonly used tactic and avoid clicking on any links or attachments from unauthorized sources and to train your staff to recognize hidden threats.
Cyber actors have been targeting unpatched (vulnerable) connections such as Virtual Private Network. Deploying patches help fix security vulnerabilities and other bugs to improve the functionality and security of the program – check with your IT provider to ensure your software is current and patched.
In the abrupt transition to remote work, many organizations began utilizing cloud collaboration services without fully implementing the needed safeguards to prevent hackers from gaining easy access to these systems. Ensure your practice is utilizing secure networks when accessing data from the cloud and that proper set up of these services was completed to reduce risks associated with cloud-based services.
Many Microsoft and Adobe Flash products have been the target of hackers due to their widespread use. Refer to the CISA security recommendations when utilizing these programs and make sure your software is up to date.
The lack of proper employee training during the transition to remote operations continues to give hackers an advantage of being able to gain access to sensitive systems through phishing scams. Employees may not be accessing PHI properly or be fully aware of what to look out for when it comes to cyber threats. Make sure you have the proper cybersecurity training in place to protect your practice.

As organizations begin to go back to work, it’s important to know that much like COVID-19 itself these cyber threats won’t just go away. Properly educating your employees on good cyber hygiene, doing routine checks and updates on security safeguards, and continuing to be on the lookout for any potential threats are vital in keeping your practice protected. Certain things your practice should be implementing right away are:

Implementing a backup solution to automatically and regularly back up critical data and system configurations.
Ensuring all access to systems requires a multi-factor authentication whether access is done remotely or while in the office.
Enabling automatic updates for operating systems, applications, and hardware to protect from system vulnerabilities as well as test and deploy patches right away.

For more information on the government’s guidance along with the mitigations provided to assist in ensuring the security of your practice view the full bulletin here.

$250K HIPAA Fine for Data Breach: The High Cost of Ignoring Cybersecurity Threats

October 3, 2024 Penelope Schweitzer No comments yet

October 3, 2024 Ransomware remains a significant threat to the healthcare industry, causing nearly two-thirds of data breaches. The Office for Civil Rights imposed a $250,000 HIPAA fine on Cascade Eye and Skin Centers, which provides ophthalmology and dermatology care in Washington state. This fine highlights the ongoing impact of ransomware attacks on the healthcare sector and emphasizes the importance of protecting medical practices. What Happened? In May 2017, hackers held almost 300,000 electronic Protected Health Information (ePHI) files at Cascade Eye and Skin Centers for ransom. The practice lacked essential safeguards, such as a thorough Security Risk Analysis and effective data access monitoring, leaving patient data vulnerable to malicious actors. The Aftermath The $250,000 fine is a stark reminder of the OCR’s commitment to enforcing HIPAA compliance against cybercrimes. Several ransomware fines have been levied in the past year, and unfortunately, this trend is expected to continue as ransomware attacks against healthcare organizations rise. In addition to the substantial fine, the practice is subject to a Corrective Action Plan (CAP), with the OCR overseeing Cascade Eye and Skin Centers as it implements necessary initiatives and measures to safeguard its operations from cybersecurity breaches. Protecting Your Practice While no healthcare practice can be completely immune to cyber threats, there are proactive steps you can take. By implementing preventive measures, you can stop cyberattacks before they impact your practice. Implementing a comprehensive Security Risk Analysis can help identify vulnerabilities and inform your risk management strategy, providing a comprehensive overview of what your practice currently has in place. Encrypting data provides another layer of protection by making it inaccessible to unauthorized individuals. Firewalls and antivirus software can also act as barriers to malicious attacks. Beyond technical safeguards, a well-developed Disaster Recovery Plan is essential for minimizing the impact of a breach. Having a plan in place can help ensure a swift and effective response to incidents and limit disruption to patient care. Remote access and support capabilities can also be critical in managing compromised systems and restoring operations quickly. As technology continues to transform the healthcare industry, your compliance program should also evolve. By utilizing automated software, you can streamline compliance efforts, receive expert guidance, and stay informed about the latest cybersecurity threats. Schedule a consultation with a compliance expert to learn more about how software solutions can help protect your practice.

Abyde News, Best Practices, HIPAA

HIPAA and Cybersecurity: A Dental Practice’s Guide to Compliance

September 19, 2024 Penelope Schweitzer No comments yet

September 19, 2024 Did you know that medical information is one of the most valuable pieces of information for hackers to obtain? A health record sells for ten times the amount compared to a credit card on the dark web. In today’s digital world, technology has brought significant advancements to how dental practices operate, from communicating with patients to reviewing dental records. However, it has also introduced new challenges related to practice safety. Implementing strong cybersecurity measures is crucial for protecting your patients. Let’s dive into how to safeguard your practice and keep your patients safe in today’s cyber world. Complete a Security Risk Analysis (SRA) A requirement under HIPAA, the Security Risk Assessment (SRA) sets a benchmark for your dental practice’s compliance. The SRA highlights risks your practice might face, including technical safeguards and recommended cybersecurity measures. By monitoring the existing measures, you can identify non-compliant gaps and learn best practices to better protect your organization. Establishing a strong foundation for your practice brings you one step closer to HIPAA compliance by showing you how to keep your patient data secure. Establish Access Controls One of the most common HIPAA violations is improper access to electronic Protected Health Information (ePHI). Robust access controls are essential to prevent this. Each staff member should have a unique login with permissions strictly aligned to their job duties. These logins should also require staff to change their passwords periodically, including at least eight characters with symbols, numbers, and lowercase and uppercase letters. This safeguards sensitive patient data and facilitates effective monitoring for potential security breaches. Additionally, monitoring employee activity helps ensure access privileges are used appropriately. Encrypt all ePHI Encryption, or encoding data so that it is unreadable by unauthorized users, is a staple of having strong cybersecurity measures in place for your practice. It should be used on all devices storing sensitive data and facilitating patient communication, ensuring that only authorized individuals can access it. Encrypted data and devices can protect sensitive information if a work laptop falls into the wrong hands. Another cybersecurity best practice is to enable remote deletion on the computer so that it can be wiped from another functioning device. Overall, encryption serves as an additional barrier to protecting patient data and keeping sensitive information secure in dental practices. Ensure Adequate Cybersecurity Training for All Staff It is crucial to ensure that staff understand expectations and cybersecurity best practices to keep patient data safe. Training is important to help staff understand how to handle sensitive information and how to share ePHI (electronic protected health information) securely. Thorough training will empower staff to maintain the security of patient data and uphold the best cybersecurity practices, helping create a culture of compliance in your practice. Outsource IT Automating your HIPAA compliance program with secure software helps protect your practice and streamline compliance. Additionally, outsourcing your IT measures is another responsibility your organization can delegate to an expert team. Expert teams can monitor your cybersecurity health and provide penetration testing, emulating whether your practice can handle a hacking attack. With specialized healthcare IT support, your practice can rest assured that the proper firewalls, encryption, and other protections are in place to safeguard it. The Future of Cybersecurity in Dentistry Robust cybersecurity measures are essential in today’s dental industry. The OCR continues to lead cybersecurity efforts and is starting to impose fines on practices affected by cybercrimes. By ensuring that your dental practice is HIPAA compliant and follows cybersecurity best practices, you can protect your practice’s success and the safety of your patients’ information. To learn more about the best cybersecurity practices for your dental practice, schedule a HIPAA consultation with a compliance expert today.

Cybersecurity, HIPAA

Peace of Mind for the HCO: Simplifying HIPAA with Technology

July 25, 2024 Gaurav Modi Comments Off

July 25, 2024 Running a small medical practice is a juggling act. Staff wear many hats, and HIPAA compliance often gets squeezed in amongst other tasks. Did you know that physicians spend an average of 10 to 19 hours per week on administrative duties such as HIPAA tasks? HIPAA legislation outlines how Covered Entities and Business Associates must handle and secure patient PHI (Protected Health Information). Specifically, a HIPAA Compliance Officer (HCO) must be designated to ensure compliance maintenance. This is a significant yet essential role, and one that staff in a busy, small office have little time to attend to. Here’s the good news: There are better ways to manage HIPAA compliance efficiently if you’re the HCO. Let’s explore the key duties of an HCO and how you can handle the numerous obligations that come with the role. What is an HCO? The HCO must ensure the practice follows HIPAA requirements and sufficiently follows all physical, administrative, and technical safeguards to protect sensitive patient data. Being an HCO is a significant role and crucial for patient data security. Many HCOs wear multiple hats within an organization, such as serving as the office manager or a doctor. This can sometimes feel overwhelming, but it’s important to remember that HIPAA compliance is a shared commitment. Just like a conductor leads an orchestra, the HCO sets the tone. However, like every musician, from the violinist to the triangle player, needs to play their part flawlessly, everyone in the organization must follow HIPAA rules to create a harmony of patient privacy. What is an HCO Responsible for? The HCO role oversees everything related to a HIPAA program. This includes managing documentation, training, reviewing updated legislation, conducting the Security Risk Analysis, and much more. As the HCO, you must ensure proper compliance with HIPAA regulations within your practice and serve as the primary resource for your staff regarding HIPAA concerns. You also need to uphold patient access rights and ensure patients receive their medical records promptly. In case of a HIPAA violation or breach, the HCO will investigate and report the situation to the Office for Civil Rights (OCR) accordingly. The HCO acts as the main point of contact for the OCR and serves as the liaison if further investigation is required. Sounds like a lot of work, right? The Cure for HCO Stress By now, you know the role of an HCO is complex and can be time-consuming, especially when the individual manages numerous roles in a practice. The time spent on HIPAA tasks reduces the time available for patient care and other tasks. Inaccurate documentation due to human error can also lead to non-compliance with federal standards, adding stress and complexity to an HCO’s role. Many HCOs have their trusty HIPAA binder bursting with disorganized documentation. While this physical documentation might be an easy band-aid for an organization, as HIPAA continues to evolve, your binder should too. We can all agree there are much more enjoyable activities than handling HIPAA documentation. That’s where smart software solutions can streamline compliance for a practice. Instead of taking hours each week, this process can be reduced to minutes with intelligent software that can identify vulnerabilities and provide insights for improvement. That sounds a lot better, right? To learn more about how to streamline your compliance program, saving time and cost and providing peace of mind for the HCO, schedule an educational consultation today with an Abyde expert.