HIPAA Training – Part IIIHealth Insurance Portability and Accountability Act

POLICIES & PROCEDURES

Goals

••Learn simple ways to protect information.Learn simple ways to protect information.

••Learn how to continually give training.Learn how to continually give training.

••Learn how to continually develop procedures.Learn how to continually develop procedures.

Policy

•It’s the law.

•The doctor has to sign all of them.

•The privacy official’s name must be on them.

•Must be reviewed each year and proof of this must be documented.

Procedure

•How you apply the law to this office.

•Writing procedures is an everlasting process of reviewing and updating.

Why Review and Update the Procedures?

•New breaches are discovered.

•New technology is used.

•Office changes occur such as remodeling.

•What you’re doing to protect PHI.

Procedures

•Be general.

•Don’t be specific.

Training

•Have documented meetings.

•Each employee, including the doctor, must sign their own name on the Training Register.

•If the doctor does not allow training, then the doctor is liable for all fines.

Training

•Some discussion topics:• Implementation of Policies

•Notice of Privacy Forms

•General Penalty for Failure to Comply with Requirements and Standards

Training

•More discussion topics:•Breaches

•Office Procedures Regarding PHI

•Complaints Regarding PHI

•Handling Patients’ Restrictions

•Medical Release Forms

•Front Office Procedures

•Back Office Procedures

•Computer Security

TrainingRegister

What Do You Have to Do to Protect Information and to Avoid the Fines?

•Understand two basic questions:•Continually have training.

•Keep records.

Keep Records

•Every time you have training you must record it.

•This is the government.

• If you don’t have records, then training was never done.

HIPAA Security

•Computers were required to be secured by April of 2005.

•Password

•Hackers

•Levels of service

OBJECTIVES

•Understand HIPAA Security Rule

•Understand basics of network security

HIPAA Security Standard

•What is the purpose?• Establish a standard for health care providers with regards to treatment of patient health information

• Give patients more control and access to their medical information

• Secure protected health information (PHI) transmitted, stored, or maintained in electronic format from real or potential threats of disclosure or loss

HIPAA Security Standard

•General

• Consistent with the Privacy rule in that the Security part of the Privacy rule requires that “appropriate” security be applied to all PHI in all events

• Focuses more on “what” needs to be done, rather than “how”.

• Cost of implementation is a factor, but not a preclusion.

• Cost, size, technical infrastructure and criticality of potential risks are factors, allowing for a flexible approach.

• Sets out processes for decision-making, but does not make decisions; remains ‘technology neutral’.

• Results and documentation both are important.

HIPAA Security Standard

•What the rule does?• Ensures the confidentiality, integrity, and availability of all

electronic PHI a covered entity (CE) creates, receives, maintains, or transmits.

• Protects against any reasonably anticipated threats or hazards to the security or integrity of such information

• Protects against any reasonably anticipated uses or disclosures of such information that are not permitted or required

• Ensures compliance by covered entities workforce

Privacy vs. Security

•Privacy• Individuals rights to control access and disclosure of their protected or individually identifiable healthcare information

• Establish authorization requirements

• Establish individual rights

• Establish regulations for use or disclosure of PHI

•Security• Establishes minimum level of security that covered entities mustmeet

• Adopts standards for the security of ePHI to be implemented by covered entities

• Improving the efficiency of the healthcare industry in general

Three Pillars of Data Security

Confidentiality Integrity Accessibility

Data or information

is not made

available to

unauthorized

persons or

processes

Data or information

has not been altered

or destroyed in an

unauthorized

manner

Data or information

is accessible and

usable upon demand

by an authorized

person

Security Rule OrganizationSafeguards

• Administrative

• Administrative actions, policies, and procedures, to manage, the selection, development, and implementation, including the maintenance of security measures to protect electronic health information and to manage the conduct of the covered entity’s workforce in relation to the protection of that information.

• Physical

• Security measures to protect a covered entity’s electronic information systems and related buildings and equipment from environmental hazards and unauthorized intrusions.

• Technical

• The technology and policy and procedures for how to protect electronic protected health information and control access to it.

Electronic Data Security

• Electronic Data Security:

• The generic name for the tools designed to protect data and to prevent intrusions.

• Principle of Easiest Penetration:

• An intruder must be expected to use any available means of penetration. This is not the most obvious means, nor is it one against which the most solid defense has been installed.

• Principle of Adequate Protection:

• Computer hardware and software must be protected to a degree consistent with their value. Electronic data never loses its value, unless the information becomes outdated and obsolete.

Security Threats

•Virus

•Spyware

•Adware

•Worms

•Trojan Horse

•Phishing (pharming)

•War Dialing

•Social Engineering

Social Engineering

•Preying on the Best Qualities of Human Nature:

•The desire to be helpful

•The tendency to trust people

•The fear of getting into trouble

A successful social engineer receives information A successful social engineer receives information

without raising any suspicion as to what they are without raising any suspicion as to what they are

doing.doing.

Social Engineering

••ImpersonationImpersonation

••Important user Important user

••ThirdThird--party authorization party authorization

••Technical support Technical support

““There are system problems and There are system problems and

you will have to log me on to you will have to log me on to

check the connectioncheck the connection””

Recognize the Signs

•In Person

•May appear as an employee or

•Dressed in a uniform.

•Part of the cleaning crew.

•Roams without raising suspicion.

•Dumpster Diving

•Shoulder Surfing

•Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information.

Social Engineering

•Refuse to give contact information

•Rushing

•Name-dropping

•Intimidation

•Small mistakes

•Request confidential information

•Request you to do something improper

What can you do?Ask Questions!

•Correct spelling of the person’s name?

•Number where you can return the call?

•Contact information?

•Why the information is needed.

•Who authorized the request. •Verify the authorization

And Do It !!!And Do It !!!

Where Do Intruders Come From?Who are these threat agents?

•Teenage pranksters

•Hacker junkies

•Disgruntled employees

•Disgruntled patients

•Competitors

•Terrorists (disruption of services)

•Criminals (selling information)

Physical Vulnerabilities and Access

•Being aware of your surroundings!•Where’s my computer located?

• Is anyone watching me?

• Is the hallway door open?

• Is the monitor visible from the window?

• Is the computer visible from the patient waiting area?

•Are the servers in locked rooms or cabinets?

•Does the cleaning crew have access to the computers?

•Does the screen saver activate when idle?

•Do I log out before leaving the room?

•Do I use my PC for a night light?

Password VulnerabilitiesIf you think it’s weak, then it is weak

•Passwords• First line of defense against unauthorized access to your:

• Computer, Files, Network Connections, Key to your electronic identity

• Do Not Use:

• Any dictionary words, any proper names, common phrases, obvious

passwords, keyboard words, let a website save it, use the same one.

• What to use:

• At least eight characters, at least one capital letter, At least one

number, at least one special character, one you can remember,

change them regularly

Your Account Is Only As Secure As Its Password

•Recommendation

•120 day rotation

•Don't let others watch you log in.

•Change your password often.

•Don’t write your password on a post-it note

•Don’t attach it to your video monitor or under the keyboard.

xT21b31

Password Construction

•It can’t be obvious or exist in a dictionary.

•Every word in a dictionary can be tried within

minutes.

•Don’t use a password that has

any obvious significance to you.

Password Standard

•Eight character minimum and should contain at least

one of each of the following characters:

•Uppercase letters ( A-Z )

•Lowercase letters ( a-z )

•Numbers ( 0-9 )

•Punctuation marks (!@#$%^&*()_+=- )

Password Management

•Its OK to share offices, equipment and

ideas, but...

Do not share your password Do not share your password

with anyone, anytime!with anyone, anytime!

Safeguard Your Strong Password

•Be careful about typing your password into a strange computer.

•Anti-virus protection enabled?

•Owner trustworthy?

• Keyboard logger running to record your keystrokes?

•Who was the last person to use that computer?

•Do not use the automatic logon feature in Microsoft.

E-mail Vulnerabilities

•Emails• Are you opening Pandora's box?

•Basic method of communication to transfer:• Messages, Files, Programs

•What to look out for:• Extensions (.xls, .doc, .php, .ppt, .exe, .vbs, .bin, .com,

pif); Suspicious Subjects Lines; I love you/My daughter’s pictures; You have won/Free Gift; Funny, Humorous, etc.; Look alike sites; Chain Letters; Web Links; Attachment not expected

• If it's suspicious, don't open it

EMAIL Policy

•Permissible uses:•Entity’s permissible uses?

•Prohibited uses:•Entity’s prohibited uses?

ALL MESSAGES SHOULD BE ALL MESSAGES SHOULD BE

CONSIDERED PUBLIC!CONSIDERED PUBLIC!

Web Browsing Security

•Web Surfing

•Active content and viruses or other malicious software

•Security risks in the PC and MAC versions of Internet

Explorer and Netscape browsers

•Company determines your security.

Visiting Internet Sites

•Be careful about providing personal, sensitive

information to an internet site.

•Be aware that you can get viruses from Instant

Messenger-type services.

Privileges and Responsibilities

•Use of your company computer account

is a privilege.

•Along with the privilege to use company network resources come some responsibilities.

•Remember that Internet traffic is logged, monitored, and saved

Backups

•Back your computer up every night

•Take the back up offsite

So How Do We Start?

•Be aware!

•Learn, practice and adopt good security habits.

•Report anything unusual.

Security is 90% You and 10% TechnicalSecurity is 90% You and 10% Technical

Absolute vs. Acceptable Levels of Risk

•“Absolute protection” from risk is an impossibility

•“Acceptable level” of risk is a more realistic approach

to managing risk

Keep an Inventory

•Know exactly what equipment you have by listing an

inventory.

•What kind of hardware do you have?

•What kind of software do you have?

•What kind of protection do you have? i.e., virus or spyware

Keep an Inventory

•Record:

•When you began using it

•When you stopped using it

•When you upgraded

•The First Line of Defense Is You

•The Last Line of Defense is You