According to a report to Congress from The Department of Health and Human Services (HHS), there have been almost 8 million records breached since 2009. That is a staggering number. What is worse it that the number of data breaches continues to increase.

Another way of looking at it is that we are only in the beginning of Stage 1 of Meaningful Use. That means a lot more medical practices and hospitals will be implementing EMRs in the next few years. At this rate the number of records that could be breached could be 20 million or more.

There is a point where patients and consumers of healthcare services lose confidence in the system. When that tipping point happens I am not sure anyone knows but it is a real possibility. Unchecked and without fundamental changes to protecting patient data we could be heading for that fate.

The question is what can be done to stop this epidemic of patient data breaches? HHS has announced that they will perform 150 HIPAA audits in the next year. Will this change healthcare providers’ mindset? Will this make them take HIPAA and patient data security more seriously? I don’t think anyone can answer this but it is a step in the right direction.

One thing is clear, that without some fundamental change the amount of patient data breaches will continue to increase and trust in electronic medical records will be hurt. This goes in the exact opposite direction that the government is pushing with Meaningful Use and incentives to implement EMRs.

I woke up this morning to see that while I was sleeping I somehow managed to send out about 100 Twitter direct messages with a message saying:

“You look different in this photo. http://t.co/NglQQu1″

Needless to say, I didn’t actually send the direct messages and was a victim of a phishing scam.  I received the same message yesterday from a friend on Twitter and read it while I was on the phone. I clicked on the link and realized I wasn’t logged into Twitter (I use HootSuite).  So when prompted for my email and password I entered both.  The page looked identical to the real Twitter login page.  I was then greeted with a weird page.  I realized something was wrong but continued on my phone conversation.

When I woke up and saw all the Twitter messages on my phone I realized that my account was hacked and when I logged into Twitter yesterday it must have been a phishing attack that captured my email and password. I immediately changed my Twitter password.

If you received a message from me I want to apologize.

Yes I wrote about how to avoid being a victim of a phishing attack and I then become a victim myself. Ironic? Yes! Embarrassing? Yes!

I am just glad the damage was minimal and the phishing attack didn’t lead to something more serious.

Be safe out there. Phishing is real and anyone can be a victim. An with implicit trust that comes with social networks it is even easier to be a victim.

Health Info Security has published the transcript from an interview with Susan McAndrew of the Department of Health and Human Services’ Office for Civil Rights. The article is very good and should be read in its entirety. Below are some of the key points.

When asked if business associates as well as covered entities will be part of the 150 audits, McAndrew responded:

Eventually. I’m not sure whether business associates will be part of the initial selection process because they are a little more difficult to obtain information about. We don’t have a list or a registry yet of who is a business associate. We’re still strategizing as to how to collect information about business associates to make a meaningful selection, but we certainly are looking to KPMG to have protocols developed to give us the capability of auditing business associates.

It’s unclear at this point whether or not we will be able to conduct and test the business associate protocols. We are hopeful of being able to do so. The primary focus is going to be on the protocols for the covered entities and proving the audit results with regard to covered

If should be interesting to see how they collect the list of business associates. Will they require each covered entity to identify their own business associates?

When asked if the audits will be looking for general compliance or more specific issues of compliance McAndrew replied:

However, at least initially, because we’re very interested in assuring that the protocols are complete and provide comprehensive feedback to us on the degree of compliance, we will be focusing primarily on more comprehensive aspects of compliance

That can be read into as they will be looking to see how closely an organization is compliant with the HIPAA regulations. High level may include policies and procedure, when the last risk assessment was conducted, employee training, incident response procedures, etc.

When asked about onsite audits and if results will be publicly published, she responded:

The model that we’re testing is your typical onsite audit. … There will definitely be advanced notice to the entity. There will usually be advanced request for documentation and survey material from the covered entity so that the auditor can best use their time onsite to focus in on what they need to do and the people they need to talk to onsite. And then, as is typical following the onsite visit, the auditors, if they need to, will collect more information. They will complete their draft report. Typically the draft report is shared with the covered entity before it’s final, and the covered entity’s responses to the findings of the auditor would be incorporated as part of the final audit report.

We haven’t decided that (publishing results publicly) yet. Part of this whole endeavor is to have an evaluation component where we can be assured that the information that we are getting through this audit process is accurate and meaningful.

That said, whether we do it in summary form or publish the individual report similar to the way that the inspector general does with their audit materials still needs to be worked out. I think that we will be looking at that very closely as part of our evaluation criteria.

So audits will be onsite and the organization will have advanced notice. Draft reports will be prepared prior to publication. It is not clear if the results will be published for each audit or just a summary will be published. Will this turn into another wall of shame?

And finally, McAndrew gives insight to organizations of how to prepare for the coming audits:

But this is certainly an opportunity for the covered entities to review their policies and procedures to make sure that they are complete and up-to-date. Also, the way that they are managing the information, whether it’s in computerized files or good old-fashioned paper records, make sure that they are fully documenting what’s being done with the information and how it’s being managed and safeguarded. The [HIPAA] security rule has its own requirements for risk analysis and risk management programs. …

Through the experience that we’ve been having with covered entities on breaches and incident response plans, [those plans] need to be up-to-date and flexible, as well as emergency backup systems. I think this is just another opportunity for covered entities to take a moment from their busy, busy days and do a self-assessment. We think that this will help them down the road in terms of building their own capacity for a robust compliance program, training of individuals and making sure that there is awareness throughout the entity of their security and privacy rules and responsibilities.

So she recommends:

• Creating or reviewing the appropriate policies and procedures
• Preforming a risk assessment and well as a risk management program (implementing the results of the risk assessment)
• Creating incident response plans
• Training employees and implementing an employee awareness program

Good advice for every organization!

Microsoft’s latest cloud based service called Office 365 was recently released. More than 200,000 organizations participated in the beta testing period. Office 365 provides the following:

Microsoft Office, Microsoft SharePoint Online, Microsoft Exchange Online and Microsoft Lync Online in an always-up-to-date cloud service, at a predictable monthly subscription.

In addition, Microsoft is trying to target the healthcare industry by offering Business Associate Agreements (BAA). Microsoft is one of the first large organizations to offer a HIPAA BAA for their cloud based service.

Due to the requirements of HIPAA, the Health & Life Sciences industry requires privacy, security, and confidentiality of patient data (“protected health information”). With this in mind, Microsoft will be among the first in industry to offer a Business Associate Agreements (BAA) as an operationalized part of its solution to address requirements associated with hosting protected health information. Customers can obtain more information on BAA availability from their designated Microsoft account manager.

By offering a BAA it will make it easier for healthcare organizations to utilize the Office 365 cloud service. On the other hand, companies such as Google have not offered a BAA for their cloud based services. Microsoft has made a wise choice of offering the BAA and will make it easier for organizations to implement Office 365 and stay compliant with HIPAA regulations.

Let’s hope more cloud based services step up and offer Business Associate Agreements to customers.

There are two very disturbing trends regarding information security that should keep physicians and practice administrators up at night.

The first trend is that is seems like no company is safe from security breaches. Just yesterday Citigroup announced that they experienced a breach that involved more than 200,000 accounts.  Sony has been hacked repeatedly. Epsilon has experience a huge data breach.  These are multi-national companies that have the resources to protect data and yet they have been hacked and data has been breached.

The second trend is that hackers are starting to focus on smaller targets. In the Verizon 2011 Data Breach Investigations Report (PDF) they found that hackers are moving away from larger targets to smaller companies (tell that to the companies mentioned above).  The reason is that smaller companies have less security and are easier to hack.

Medical data has a very high value on the black market and it is only a matter of time until hackers turn their attention to medical practices. Medical practices typically don’t invest a lot of money in security and many are not compliant with HIPAA Security regulations. The chances that hackers are successful when they focus on medical practices is probably pretty high. In addition, the costs of security breaches are increasing and HIPAA enforcement and fines are also increasing.

Physicians and practice administrators need to be aware of these disturbing trends. Security and HIPAA compliance is essential and needs to be focused on now before it is too late.

Image: digitalart / FreeDigitalPhotos.net

Joplin, MO was hit by a massive tornado on Sunday evening that did extensive damage to the St. John’s Regional Medical Center hospital. There are reports that x-rays from the hospital have been found in driveways 70 miles east of the hospital.

On Twitter Steven Waldren sheds some very interesting and insightful perspectives:

Steven’s quotes gets to the bottom of Disaster Recovery.  When an actual disaster hits and your servers are destroyed how do you get to your data? Having tape backups or offsite backups are fine but if your servers are gone where do you restore the data?

Disaster Recovery (DR) planning is more than ensuring you have a backup of your data. It is about ensuring that your organization can still function and get to critical systems even when your primary systems have been destroyed. With cloud-based Disaster Recovery solutions the cost of implementing DR has been significantly lowered. All healthcare organizations should be looking into some sort of DR that will not only ensure that data is properly backed up but will allow for access to critical data in the event of a real disaster.

Contingency planning and DR planning are required under the HIPAA Security Rule:

STANDARD § 164.308(a)(7)Contingency Plan

The purpose of contingency planning is to establish strategies for recovering access to EPHI should the organization experience an emergency or other occurrence, such as a power outage and/or disruption of critical business operations. The goal is to ensure that organizations have their EPHI available when it is needed. The Contingency Plan standard requires that covered entities:

“Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.”

DISASTER RECOVERY PLAN (R) – § 164.308(a)(7)(ii)(B)

The Disaster Recovery Plan implementation specification requires covered entities to:

“Establish (and implement as needed) procedures to restore any loss of data.” Some covered entities may already have a general disaster plan that meets this requirement; however, each entity must review the current plan to ensure that it allows them to recover EPHI

A final takeaway is that the time to think about Disaster Recovery is before a disaster hits. Implementing DR is not only required under HIPAA but is critical to any business to ensure that the organization can continue to operate even when primary systems are destroyed.

There is a great post over at Infosec Island regarding a letter that was received from the Office of Civil Rights (OCR) after a data breach that occurred at a small medical practice. The breach was the result of a burglary. No details were given on what was stolen or what kind of patient information was obtained.

The post lists the following 11 items that were requested in the letter from OCR and states that the practice only had 21 days to respond.

1. Documentation of the covered entity’s admission, denial, or a statement indicating that the covered entity has obtained insufficient evidence to make a determination regarding the allegations.

2. Documentation of an internal investigation conducted by the covered entity in response to the allegations including a copy of the incident report prepared as a result of the laptop and server theft.

3. Documentation of the covered entity’s corrective action taken or plan for actions the covered entity will take to prevent this type of incident from happening in the future, including documentation specifically addressing, if applicable:

a. sanctioning of the workforce member(s) who violated the Privacy and Security Rules, in accordance with the covered entity’s current policies and procedures, and as required by the Privacy Rule.

b. re-training of appropriate workforce members.

c. mitigation of the harm alleged, as required by the Privacy Rule.

4.  A copy of your HIPAA policies and procedures related to the disclosure of and safeguarding of PHI and specifically EPHI.

5.  A copy of the policies and procedures implemented to safeguard the CE’s facility and equipment.

6.  Evidence of physical safeguards implemented for computing devices to restrict access to PHI.

7.  A copy of the most recent risk assessment performed by or for the CE, per Security Rule requirements.

8.  Evidence of security awareness training for involved workforce members including training on workstation security.

9.  Evidence of the implementation of a mechanism to encrypt EPHI stored on the workstations.

10. A copy of the written notification of the breach provided to the affected individuals.

11.  A copy of the written notification given to the media.  This should include a list of all media sources to whom this notification was given and any media reports (news stories or articles) stemming from this notification.

The first take away from this is that OCR is asking for a lot of information in a very short period of time.  21 days to provide this information is not enough time if the practice didn’t have all of this documentation in place already. And maybe that is the point, the short period of time to respond does not give an organization time to scrabble and put this together and say it was in place prior to the breach.

The second take away is that OCR clearly wants to see written documentation that you have a security program in place to protect patient information and are in compliance with the HIPAA regulations.

Items #4 and #5 clearly states that they want to see written policies and procedures on how an organization is protecting patient information. Unless you have gone through the exercise of preparing the policies and procedures, I doubt that telling them you discussed these with your staff but haven’t documented them will carry much weight.

Item #7 clearly states that they want evidence that you have performed a Risk Assessment on how you are protecting patient information. A Risk Assessment is required under the HIPAA Security rule and will identify areas where an organization needs to focus on to better protect patient information. Not having a Risk Assessment will make it very difficult to defend yourself and prove that you have taken HIPAA Security regulations and protecting patient information seriously.

Item #8 addresses providing evidence that each of an organization’s workforce have received HIPAA Security training. Again this seems to be looking for documented proof that each workforce member has been trained. If you do not have a formalized training program, saying you discussed training in staff meetings might not be sufficient especially when they are looking for formal documentation.

Item #9 is very interesting because it is asking for documentation addressing the encryption of information on workstations. Encryption is an addressable implementation specification in the HIPAA Security Rule. OCR wants to see how the organization has implemented this specification. Remember, an addressable implementation specification is not optional and documentation must exist on how an organization has or has not implemented the specification. For example, an organization might require laptops to be encrypted but data at rest on servers or desktops does not need to be encrypted. The take away is that you need to document how you have or have not implemented encryption along with reasons to support your decisions.

Items #10 and #11 address how an organization has prepared itself for a security breach and how it has responded to the current security breach. The Breach Notification Rule as defined in the HITECH Act states that an organization has to issue a notification to affected individuals within 60 days of discovery of a breach. Below is more information from the HHS website:

These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include, to the extent possible, a description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity.  Additionally, for substitute notice provided via web posting or major print or broadcast media, the notification must include a toll-free number for individuals to contact the covered entity to determine if their protected health information was involved in the breach.

All in all this insight into what to expect from OCR if your organization experiences a data breach should make you very apprehensive. If you do not have these items in place prior to a breach it will cast a very negative light on your security program. If you cannot provide the written documentation for the 11 items that they are requesting, there is a chance that OCR will determine that you are in violation of “Willful Neglect” of the HIPAA Regulations.  Fines associated with “Willful Neglect” are substantially more expensive and carry a penalty of $50,000 per violation, with an annual maximum of $1.5 million.

The time to worry about complying with HIPAA security is before a data breach and not after. OCR has made it clear of what they will demand from an organization. If you do not have these items in place, NOW is the time to act!

It seems that at least twice a month we are hearing about a health care organization that has had a data breach because of a lost of stolen laptop. Every time I read about a new breach I shake my head and ask myself why aren’t these organizations using encryption to protect the contents on the laptops? I have come up with 2 conclusions:

1. The organizations are not familiar with encryption technology and think it is too complex to implement
2. The organizations think that implementing encryption technology is too expensive and cost prohibitive

So I thought I would take a few minutes to hopefully help enlighten some people on just how easy it is to implement encryption and how affordable encryption is.

There are many encryption products on the market.  Some are free such at TrueCrypt, while others vary in cost and complexity.  PGP is one of the leaders in encryption and has recently been purchased by Symantec Corporation.  PGP ranges from encryption of a few laptops to 1,000s of laptops in an enterprise.  PGP usually requires some infrastructure setup that allows administrators to control policies, safeguard encryption keys and monitor which laptops have been encrypted. There is some complexity that is associated with setup and deploying PGP encryption.

A product that we have been using for ourselves and our clients is called AlertBoot.  AlertBoot is an easy to install encryption product that encrypts the entire laptop’s hard drive.  The install is web based from the AlertBoot’s site and is very easy and painless.  Depending on the size of the hard drive and the speed of the drive it can take anywhere from 30 minutes to 4 hours to encrypt the drive.  You can even use the laptop while it is doing the one-time encryption.  There is no risk of losing the encryption password and then being locked out of the laptop.  AlertBoot has 7×24 hour support that can help a user recover a lost encryption password.

AlertBoot Support, Password Recovery, and Helpdesk

Forget your password? Have a question about AlertBoot? Don’t worry: help is always just a phone call away. AlertDesk is your personal helpdesk for password recovery and assistance— open 24 hours a day, 7 days a week, 365 days a year.

AlertDesk is completely secure and confidential. You’ll be challenged with security questions as a safety precaution to verify your identity. AlertDesk Support will never have access to your devices or your personal data.

AlertBoot encryption costs $12.95 per month per laptop.  There is a 10% savings if you prepay for the year.  So for around $150/year per laptop you can fully encrypt the contents of the hard drive.

Now to be clear, AlertBoot is just one of the many products on the market and I am only using them as an example because I am familiar with the technology and their monthly cost per laptop makes it easy to calculate the true cost of encrypting each laptop.

So say you have 10 laptops in your organization, you are looking at $130 month to encrypt all 10 laptops.  That to me is a very reasonable price to pay to ensure that you are protecting the data on each laptop, complying with HIPAA regulations and ensuring that any patient data on the laptop is secure and protected.

To put the costs into perspective let’s take a look at some estimates of cost if a laptop is lost or stolen.  According to the Ponemon study (PDF) titled “The Cost of a Lost Laptop” published in April 22, 2009, a lost laptop will cost:

According to the report, the use of encryption can reduce the cost of a lost laptop by $20,000. That makes the $12.95/mo seem incredibly cheap.  And now that you know encryption is easy to install and the risk of being locked out of the laptop is not an issue, you should seriously consider encrypting each of your laptops. There really is no good excuse not to implement Laptop encryption.

Medical practices are not only tasked with protecting their patient’s health but now are responsible for protecting their patient’s electronic information as well. Protecting data is probably something that most practice employees have not been trained to do nor are they familiar with best security practices. Data security is usually left to IT consultants who maintain and support their network.  Here are 5 things that you and your IT consultants can do to ensure you are properly protecting patient data.

Security Patches

The reality of software is that most software has security vulnerabilities that allow hackers, viruses and spyware to exploit these vulnerabilities and compromise the security of a network. Software vulnerabilities are in Windows operating systems including desktops (Windows XP, Vista and 7) and servers (all versions). Software vulnerabilities are also in applications such as Adobe Acrobat, Microsoft Office, and Internet Browsers. In order to minimize the risk of software vulnerabilities, vendor security patches should be diligently applied.  Microsoft issues patches at least once a month.  These patches should be applied by your IT vendor.  Desktops can be set to automatically update with no need for IT or user intervention.  Employees should be trained to diligently update programs such as Adobe Acrobat and Flash, Java and Internet Browsers. An even better strategy is to invest in software that allows IT administrators to control the deployments of vendor security patches and software updates. Microsoft has free tools to control Microsoft specific security patches to be centrally deployed. Unfortunately the Microsoft tools do not take care of 3^rd party applications.  Additional tools will need to be purchased to address these 3^rd party apps.

Ban USB drives

A majority of patient data security breaches are due to lost or stolen portable devices such as USB drives, smart phones and laptops. In order to reduce the risk of a data breach, I recommend that you set a policy to ban USB drives. If an employee absolutely needs to use a USB drive to perform their job function then invest in encrypted USB drives. I am a fan of the Kanguru encrypted drives.  You can also get other encrypted drives here. Many people I talk to about data encryption admit to me that they really don’t understand the technology and are reluctant to use it because of this.  Simply stated an encrypted USB drive secures the data on the drive and requires a password to read or write information to the drive. The technology is super easy to use.  These drives cost more than unencrypted drives but the cost is not significant.  For example an unencrypted 4GB drive might cost $10 and an encrypted drive might cost $35.  The cost difference is nothing compared to the cost of a data breach.

Encrypt Laptops

As mentioned above, stolen or lost laptops are a leading cause of data breaches. All laptops should be encrypted. There are many types of encryption on the market. Some of these require IT support and installation. An encryption service that we started to work with called AlertBoot sells a very easy to use product that will encrypt a laptop’s disk drive. The service can be used with no IT support required. After AlertBoot encrypts the laptop’s disk drive, an employee simply enters the encryption password once each time they start the laptop. AlertBoot can help reset the encryption password if an employee forgets it so there are no worries about losing a password and being locked out of the laptop. At $12.95/mo. it is not the cheapest on the market but its ease of installation, minimal impact to a laptop’s performance and 7 x 24 hour support make it a great choice to protect each of your laptops.

Password Controls

One of the cheapest and most effective security steps that you can do is to implement passwords controls.  Password controls include:

• Disabling a user account after a number of failed password attempts (think 5 failed passwords and your account is locked and can only be unlocked by your IT administrator)
• Require complex passwords. Simply stated, complex passwords require a user to set a password that is 6 -8 characters and must have letters, numbers, and special characters (! @ # $ % ^ & * + ).  These prevent using easy to guess passwords.
• Force users to change passwords every 60-90 days. Unfortunately I can guarantee you that your employees will complain about this. It always amazes me how people hate to change their passwords. I guess with so many different passwords, changing one makes it even harder to remember them. As a note, security is a fine balance between protecting your network and making it easy for employees to perform their job function.

Each of these password controls can easily be set by your IT administrator using the tools that Microsoft provides to manage a Windows networks.  At most this setup will take 1 or 2 hours of time.

Encrypt Backup Tapes

Backing up your data is very important and is a best practice to ensuring that you protect your patient’s information. If you backup your EMR on a nightly basis you will have all of your patient’s records on the backup tape.  That can be 100, 1,000 or 100,000 patients depending on how much data is in your EMR.  Now think about what would happen if that backup tape is lost or stolen.  Having the tape lost or stolen is not that hard to imagine and could happen if someone breaks into your office or if an employee is responsible for taking the tape out of the office and has it stolen from their car.  The good news is that most backup software has data encryption built into the software.  All that has to be done is to configure the software to encrypt the data and set an encryption password.  Unfortunately what I have seen is that the encryption setting is usually not set and the data is backed up to tape without encryption. Make sure your IT vendor has encryption enabled and that your tapes are encrypted.

If you follow these 5 steps to securing your patient’s data your will significantly increase your level of security.  As I mentioned, none of these are very expensive and the expense is insignificant compared to the expense of a data breach.  And as an added benefit, these will help you with your HIPAA security compliance as well.

Let me know if you already have implemented some of these security measures or if you have other examples of easy and cheap security protections.

Image: jscreationzs / FreeDigitalPhotos.net