HIPAA Security Risk Overview

Lynne Shoemaker, RHIA, CHP, CHC

OCHIN Integrity Officer

Daniel M. Briley, CISSP, CIPP

Summit Security Group

1881 SW Naito Parkway • Portland OR 97201-5195 • Phone 503.943.2542 • Fax 503.943.2501 • Email: info@ochin.org • www.ochin.org

Agenda• History

– The HIPAA Security Rule– Changes Due To The HITECH Act

• Recent Enforcement Functions• Meaningful Use and OIG Audit Activity• Vulnerability Overview• Key Technical Findings & Mitigation Steps• In Summary• HIPAA Security Services• Questions / Discussion

HIPAA Regulation Requirements

• 45 CFR § 164.306(a) define general requirements for covered entities, which include hospitals, and clinics – Covered entities must do the following: (1) Ensure the

confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits. (2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. (3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part. (4) Ensure compliance with this subpart by its workforce.

History• 2005: HIPAA Security Rule

– Administrative, Physical, Technical Safeguards

– Minimal enforcement– Insignificant monetary fines

• 2009: ARRA – Included the Health Information

Technology for Economic and Clinical Health (HITECH) Act

History• HITECH Act

– Applies HIPAA to BAs– Mandatory data breach reporting

requirements– Civil and criminal penalties for noncompliance– Enforcement responsibilities– New privacy requirements– Meaningful Use

• Adopt Certified EHR Technology• Use it to achieve specific objectives

Recent Enforcement Functions

“Covered entities need to realize that HIPAA privacy protections are real and OCR vigorously enforces those protections”. -- OCR Director Georgina Verdugo

Meaningful Use Risk Assessment Requirement and OIG Audits

• Providers are required to conduct, or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of its risk management process.

• OIG currently conducting Meaningful Use attestation desk audits/questionnaires

OIG Audits

• Seven hospitals were audited• 151 vulnerabilities were uncovered• 124 were high impact, and impacted

confidentiality, integrity and availability of protected health information (PHI)

Vulnerability Definitions

• High—Exercise of the vulnerability (1) may result in the highly costly loss of major tangible assets or resources; (2) may significantly violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human death or serious injury.

• Medium—Exercise of the vulnerability (1) may result in the costly loss of tangible assets or resources; (2) may violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human injury.

• Low—Exercise of the vulnerability (1) may result in the loss of some tangible assets or resources or (2) may noticeably affect an organization’s mission, reputation, or interest.

High Impact Vulnerabilities• 124 high-impact vulnerabilities from the 7 hospital reports

according to their Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule definitions of technical,1

physical,2 and administrative3 safeguards as follows: – 106 technical safeguard vulnerabilities related to the wireless

electronic communications network and to other security measures management implemented in their computerized information systems;

– Physical safeguard vulnerabilities involving physical access to electronic information systems and the facilities in which they are housed; and

– 11 administrative safeguard vulnerabilities related to the hospitals’ policies and procedures for protecting the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Types of Vulnerabilities

• Wireless Access Vulnerabilities• Access Control Vulnerabilities• Audit Control Vulnerabilities• Integrity Control Vulnerabilities• Person or Entity Authentication Vulnerabilities• Transmission Security Vulnerabilities

Types of Vulnerabilities continued…

• Facility Access Control Vulnerabilities • Device and Media Control Vulnerabilities • Security Management Process • Workforce Security Vulnerabilities • Security Incident Procedures Vulnerabilities• Contingency (Disaster)Plan Vulnerabilities

Technical Findings• Wireless access vulnerabilities, including ineffective

encryption, rogue wireless access points, no firewall separating wireless from internal wired networks, broadcasted service set identifiers (SSID)

• Laptops were not encrypted• Audit logs were not monitored (Please see Epic BTG Reports)• Access control vulnerabilities

– Inadequate password settings, computers that did not log users off after periods of inactivity, unencrypted laptops containing ePHI• Inadequate password length and expiration

Data Integrity Findings

• Latest security patches were not installed• Outdated anti-virus• Unrestricted Internet activity by employees and

providers• Unchanged user ID and passwords• No email encryption

Physical Security and Risk Assessments

• Unsecured data center access• Lack of completed risk assessments• Lack of polices regarding conducting annual

risk assessments

Device and Media Controls

• No computer equipment inventory• No written plan for electronic media disposal,

including computer hard drives, thumb drives, CDs• Unencrypted backup tapes/media

Inadequate Workforce Security• 36 network user accounts with inappropriate access to the

hospital’s network. The user accounts belonged to employees on long-term disability. Three of these individuals had accessed ePHI while on long-term disability.

• Delayed termination of employee network access after the employee no longer worked at the facility

In Summary• An increase in OCR complaints, investigations, corrective

actions, enforcement functions all indicate:– Managing compliance with the HIPAA Security Rule is

challenging:• Threats are emerging and dynamic• Documentation is required• Vulnerabilities and risks are going undiscovered and/or

unresolved• Staff is tapped

– Ignoring the requirements is not a strategy for success

HIPAA Security Services• HIPAA Security Risk Assessment Checklist (free)• Template policies and procedures (free)• Performing Administrative HIPAA Security risk assessments

(scalable fees based on complexity of the organization)• Discounted Technical Risk Assessments for OCHIN Customers

through Summit Security Group• Interim Information Security Officer for OCHIN Customers

through Summit Security Group

Questions?

• Lynne Shoemaker, RHIA, CHP,CHC– shoemakerl@ochin.org– 503-943-2500

• Daniel M. Briley, CISSP, CIPP– dan.briley@summitinfosec.com– 503-577-1076

HIPAA Security Risk Overview

Documents

Transcript of HIPAA Security Risk Overview

HIPAA Summit IV Workshop II: Security HIPAA Litigation Risk Management Richard D. Marks Davis Wright Tremaine LLP Washington, D.C. Seattle, Portland, San.

HIPAA 2013 - HIPAA Security Awareness Tools · HIPAA Security Awareness Tools . 2013 NIST/OCR HIPAA Security Rule Conference . May 21, 2013 Washington, DC . Rachel Seeger U.S. Department

How to Complete a HIPAA Security Risk Analysis · How to Complete a HIPAA Security Risk Analysis Bob Chaput, MA,CISSP, CHP, CHSS Clearwater Compliance LLC

HIPAA Security Rule

HIPAA Security 101

HIPAA Security Awareness

Security Risk Assessment and HIPAA Audits · Security Risk Assessment and HIPAA Audits Andy Petrovich, ... doc. Management) A review of Meaningful Use attestation documentation using

HIPAA Security Risk Analysis Toolkit - MGMA › MGMA › media › files › ga resources › MGM… · 2018-06-07 · HIPAA Security Risk Analysis Toolkit In January of 2013, the

Understanding the Basics of HIPAA Security Risk Analysis and Risk Management

HIPAA 2013 - Social Media: Leveraging Value While ... MEDIA: LEVERAGING VALUE WHILE MITIGATING RISK Safeguarding Health Information: Building Assurance through HIPAA Security NIST

Architecting for HIPAA Security and Compliance on Amazon ......Amazon Web Services – Architecting for HIPAA Security and Compliance Page 2 AWS maintains a standards-based risk management

1 HIPAA Privacy & Security Overview Know HIPAA Presents.

HIPAA 203: Security An Introduction to the Draft HIPAA Security Regulations.

HIPAA Security Risk Analysis - Clearwater · 09-07-2014 · This report and comprehensive documentation captured in the Clearwater HIPAA Security Risk Analysis™ SaaS tool such

HIPAA Security Education - Ballad Health · HIPAA requires organizations to designate someone to oversee responsibility of HIPAA security compliance. At MSHA, the HIPAA Compliance

NMHC HIPAA Security Training...NMHC HIPAA Security Training 2017 Version HIPAA Data Security HIPAA Data Security is intended to provide the technical controls to ensure electronic

HIPAA in an Omnibus World - PAHCOMTop Myths of Security Risk Analysis Security Risk Analysis is optional for small providers. ... HIPAA gives the patient a right to submit a brief

HIPAA security risk assessments

Corporate Compliance HIPAA Privacy HIPAA Security.

HIPAA Compliance – Supplemental Assessment Documents/hippa...Information Security Risk Assessment HIPAA Compliance – Supplemental Assessment _____ Assessment Name for Department