What is reasonable and appropriate? Ep 118

What is reasonable and appropriate? Ep 118

Update: 2017-08-25

Share

Description

What is reasonable and appropriate?

The HIPAA legal reference and guidance mentions reasonable and appropriate all over the place. Many times that concept creates confusion. How do you determine what is reasonable or appropriate for any environment?

More at HelpMeWithHIPAA.com/118

Comments

In Channel

We are #CyberAware - Ep 176

We are #CyberAware is the tag for the National Cybersecurity Awareness Month campaign. Each year this campaign is run by the National Cybersecurity Alliance. In 2018, Kardon, Security First IT, and HMWH are all signed up to be champions and publish information for the campaign. Today, we will review what these campaigns are about and how you can use these and more like them to augment your education program. More at HelpMeWithHIPAA.com/176

We are #CyberAware - Ep 176

2018-10-1900:50:46

6 takeaways from the filming settlements - 175

What should we learn from the recent OCR settlement? This time it was three settlements in one that related to a fourth. There is more here than the headline-grabbing dollar amounts. These settlements are the best specific guidance you can get from OCR. As always, we do the analysis for you! For more info go to HelpMeWithHIPAA.com/175

6 takeaways from the filming settlements - 175

2018-10-1200:43:01

3 stories techs should hear - Ep 174

Often tech folks will say that they understand HIPAA. What that really means is that they understand the technical requirements of HIPAA. The overconfidence sometimes works against them. Today we cover 3 stories tech should hear. It is important that they learn there is more than just their tech knowledge.

3 stories techs should hear - Ep 174

2018-10-0500:47:03

CIS 20 and HIPAA - Ep 173

CIS 20 or SANS 20 is the name to reference a list of security controls that are intended to be used in the absence of any framework like NIST or HIPAA requirements. If you are trying to get the most bang for your buck and you know you are way behind on your security program CIS 20 may be the thing for you. For more info go to HelpMeWithHIPAA.com/173

CIS 20 and HIPAA - Ep 173

2018-09-2800:40:05

How much does trust matter in healthcare? - EP 172

Have you seen the report about consumer online digital trust and what it means to all businesses? The report is The Global State of Online Digital Trust A Frost & Sullivan White Paper which was commissioned by ca technologies and published in July 2018. This survey study was done to compare perceptions about consumer trusts that executives and security professionals have vs the actual consumer trust findings when surveying consumers. Would you believe there is a disconnect across the three perceptions? For more go to HelpMeWithHIPAA.com/172

How much does trust matter in healthcare? - EP 172

2018-09-2100:44:29

Snooping is a serious problem - Ep 171

I can tell you from experience snooping is a serious problem that haunts all entities with health information to protect. Even if you don’t know it is haunting you, it is. You will learn to fear it eventually. The extent of improper record access goes well beyond what most people imagine. The image of a healthcare professional keeping patient information confidential is something we all assume is happening. In the real world, most workers know someone who has improperly accessed records if they haven’t done it themselves. More info at HelpMeWithHIPAA.com/171

Snooping is a serious problem - Ep 171

2018-09-1400:38:40

Securing home networks - Ep 170

Securing home networks matters more now than ever before. We are a very connected society. That creates great opportunities and new challenges every day. Especially, for those tasked with securing all that connectivity. One opportunity that gets a lot of people talking is teleworking, telecommuting, working remotely, or working from home (WFH) - all seem to mean the same thing to most people. Our whole company is built on the ability of our systems to be secured and also be able to connect and work from anywhere in the world. Many groups forget to worry about those home networks that are connecting to your office network and even using your office applications, and data on a regular basis. More at HelpMeWithHIPAA.com/170

Securing home networks - Ep 170

2018-09-0700:35:59

Crisis Communications Plans - Ep 169

We live in a world of instant communications. During a crisis, our normal standards of communications can be very limited. How many different issues have you addressed for communications in a crisis in your plans? We mention the business continuity and disaster recovery plans that everyone should have often in episodes. This is just one element of the plan that can make or break the business in a crisis. If you can’t communicate effectively with each other the chance of you being able to keep things running drops significantly. For more go to HelpMeWithHIPAA.com/169

Crisis Communications Plans - Ep 169

2018-08-3100:43:14

Are hacktivists on your SRA? - Ep 168

It may not occur to many of you that a hacktivist should be on your security risk analysis (SRA). They must be on there in this digital age. You never know what could trigger a hacktivist to focus on your business and put you under attack. Why you may ask - well we will discuss that now. For more text go to KardonHQ.com/168

Are hacktivists on your SRA? - Ep 168

2018-08-2400:30:53

BEC-EAC the latest threat to your business - Ep 167

The FBI released an alert on July 12 titled Business E-mail Compromise E-mail Account Compromise The 12 Billion Dollar Scam that should be on your radar. BEC-EAC stands for Business Email Compromise - Email Account Compromise. If you haven’t learned about this particular threat it is important that you review it and assess the risk it brings to your company. That’s why we review these increasing threats and what you need to do about them in this episode. For more go to HelpMeWithHIPAA.com/167

BEC-EAC the latest threat to your business - Ep 167

2018-08-1700:45:40

3 reports from IT that you need - Ep 166

We often get questions from both the tech staff and security officers about what should be documented regularly and why it should be done. There are 3 reports you need to get from your tech team on a regular basis IMHO. Today, we will discuss those three reports, why you need them and what to do with them. More at HelpMeWithHIPAA.com/166

3 reports from IT that you need - Ep 166

2018-08-1000:42:39

Does size really matter? - Ep 165

One of the discussions you must always be prepared to have is that size does not matter when it comes to privacy and security issues. Does size matter? Not as much as most people think and not in the ways that most people think either. More at https://HelpMeWithHIPAA.com/165

Does size really matter? - Ep 165

2018-08-0300:45:46

How to save money in a data breach - Ep 164

Want to know how to save money in a data breach? You have to have a plan before you have the data breach to keep you from making costly mistakes. Everyone knows a data breach can be expensive but there are studies that show us what makes them more expensive and what helps you save money. The annual Ponemon cost of a data breach study has been published. IBM sponsors the study each year and it is one of the best tools for us to prepare for the cost of a data breach. If you have any valuable data at all you should review the report to get an estimate of what the cost of a data breach would be for your organization. Let’s dig into some numbers and add a bit of perspective, shall we? Go to HelpMeWithHIPAA.com/164 for more details.

How to save money in a data breach - Ep 164

2018-07-2700:37:42

Do you know where your logs are? - Ep 163

Our most downloaded episode Is from way back in May of 2016. HIPAA Access Logs Audits was our 54th episode. It is hard to believe it was that long ago! Today we are doing a deeper dive into how many layers exist when it comes to access logs to see if you have thought of all of them. Which of the logs really matter and what do you do with them? For more go to HelpMeWithHIPAA.com/163

Do you know where your logs are? - Ep 163

2018-07-2000:41:34

Messaging Failures Times 3 - Ep 162

We all live in a world that revolves around communication tools today. Messaging failures are often the reason privacy breaches occur. In fact, we have 3 to share with you today. Messaging failures can occur in ways you never dreamed of until it happens to someone you know - not you, of course. Today’s episode covers 4 different stories about messaging failures. For more go to HelpMeWithHIPAA.com/162

Messaging Failures Times 3 - Ep 162

2018-07-1300:42:33

MD Anderson Loses OCR Challenge - Ep 161

OCR continues setting examples with the recent announcement of the $4,348,000 civil money penalty (CMP) that they imposed on MD Anderson. A review of the details shows us once again that the enforcement of HIPAA obligations is not something they decide to do in a willy-nilly way. It is specific and designed to set examples of what is expected. Most headlines are about that $4.3 million in penalties but to us, that is not what is the most interesting and important thing to note in this case. More at HelpMeWithHIPAA.com/161

MD Anderson Loses OCR Challenge - Ep 161

2018-07-0600:49:48

Managing Medical Devices - 4 steps plus a bonus - Ep 160

Medical device inventory is a challenge for most organizations. Just as with computers and mobile devices, though, you can’t understand your risks and security requirements if you don’t know what you have out there. A medical device treasure hunt is what it turns out to be when you make a dedicated effort to find them all in your organization. How do you find them all and how do you worry about protecting them all? More information at HelpMeWithHIPAA.com/160

Managing Medical Devices - 4 steps plus a bonus - Ep 160

2018-06-2900:40:44

OCR Investigations - What do they ask - Ep 159

It happens out of the blue. You get a letter that tells you that there has been a complaint filed and an investigation has been opened by OCR. That may not be the best day of your life. Just the thought of opening one of those letters can make some people feel queasy. If you have ever experienced that moment you don’t have it high on your lists of things to do again. Let’s review the kinds of things you may be asked to answer when under and investigation. For more go to HelpMeWithHIPAA.com/159

OCR Investigations - What do they ask - Ep 159

2018-06-2200:47:38

Network Security Alerts For Everyone - Ep 158

In the past few weeks, the nerd news has been full of network security alerts and discussions about issues potentially lurking on every network, especially smaller ones. These are not the things we normally worry about either. You usually think Windows, Office, Adobe, etc patches are the main alerts to worry about on your network. These are new alerts that could be in every network you use including home, public wifi, and work. Per usual, we are here to explain them as best we can - in English. Tech folks you should listen up to what we expect you to be doing for our listeners who rely on you, too. For more information go to HelpMeWithHIPAA.com/158

Network Security Alerts For Everyone - Ep 158

2018-06-1500:44:23

Cyber Experts Agree We Are Not Alone - Ep 157

Secureworld Atlanta just finished up. Turns out cyber experts do agree about many of the same issues we discuss here. Two days of discussions amongst CISOs, ISOs, security techies, etc. about what to worry about and what to do for cyber protections. Yes, there was a lot of really nerdy discussions but the good news is the central themes do not require geek speak to share with you. Learn more at HelpMeWithHIPAA.com/157

Cyber Experts Agree We Are Not Alone - Ep 157

2018-06-0800:49:52

What data do you protect? - Ep 156

Have you considered that there are other valuable information assets to protect than just PHI? Most healthcare privacy and security programs only focus on PHI and HIPAA requirements. If you are already doing the work why not include all of your valuable information assets. It is time to ask yourself what data should we protect? For more go to HelpMeWithHIPAA.com/156

What data do you protect? - Ep 156

2018-06-0100:37:01

Digital Spring Cleaning - Ep 155

This time of year many of us think about cleaning out closets and switching seasons. By clearing out your digital clutter you can double check the security of your devices and reduce your attack surface at the same time. Plus, it is way easier than cleaning out the old hall closet that may have monsters lurking in the back of it. Make the time to clean your digital clutter at least once or twice a year and you will feel better for it. Why not do digital spring cleaning, too? For more go to HelpMeWithHIPAA.com/155

Digital Spring Cleaning - Ep 155

2018-05-2500:51:49

Risk OR Gap Analysis THAT Is The Question - Ep 154

There is a frequent issue with people understanding what a Security Risk Analysis includes. In fact, there is so much confusion we often see documents presented as a risk analysis that is actually a gap analysis. It happens so often that OCR is trying to address it in their April newsletter. We are going to take a stab at explaining what gap analysis reports look like vs what a security risk analysis report really includes when done properly. For more information: HelpMeWithHIPAA.com/154

Risk OR Gap Analysis THAT Is The Question - Ep 154

2018-05-1800:46:54

5 HIPAA Cybersecurity Laws - Ep 153

Back in January, I read an article in Forbes titled: The Five Laws Of Cybersecurity. When reading it I realized that it was a great message to our listeners but it needed a HIPAA flavor added it to it. This episode we add our thoughts to his article and turn it into 5 Laws of HIPAA Cybersecurity. For more details HelpMeWithHIPAA.com/153

5 HIPAA Cybersecurity Laws - Ep 153

2018-05-1100:48:40

Don't accept candy from strangers - Ep 152

More news on the insider front makes it necessary to point out, again, how susceptible healthcare is to insider failures. HelpMeWithHIPAA.com/152

Don't accept candy from strangers - Ep 152

2018-05-0400:42:37

Physicians and Security Officers - Ep 151

The American Medical Association (AMA) did a survey of physicians and their thoughts about privacy and security practices. It was interesting to hear their responses. Also, when a group of Security Officers gets together for a chat some people glaze over. For nerds like us, it is an exciting discussion. Today we are going to discuss the Security Officer panel topics and the AMA report presentation from the National HIPAA Summit. HelpMeWithHIPAA.com/151

Physicians and Security Officers - Ep 151

2018-04-2700:47:58

Ready for extreme vendor vetting? - Ep 150

Are you ready for extreme vendor vetting? Many vendors have been pushing back against any covered entity or business associate that asked them to answer questions about their privacy and security programs. They believe signing a business associate agreement (BAA) meets the legal requirements and that is all they must do. Well, the times they are a changing - again. There are many different factors making it necessary to ask these type questions and not just accept a BAA as reasonable assurances. What are those factors and how things are changing are the topics we discuss in this episode. For more go to HelpMeWithHIPAA.com/150

Ready for extreme vendor vetting? - Ep 150

2018-04-2000:45:25

National HIPAA Summit News - Ep 149

The National HIPAA Summit always features some interesting news from OCR concerning guidance, enforcement, and audits. This year was no different. In this episode, we discuss the highlights as we interpreted them anyway. More at HelpMeWithHIPAA.com/149

National HIPAA Summit News - Ep 149

2018-04-1300:39:51

Cyberscary Trends - Ep 148

Cybersecurity trends sound scary when you hear us talk about some of this stuff. Cyberscary is actually what we decided to call it. The good news is we do talk about other things sometimes. There are two reports that came out in recent weeks have gotten my attention and just have to be discussed with you guys. More info at HelpMeWithHIPAA.com/148

Cyberscary Trends - Ep 148

2018-04-0600:47:07

Cybersecurity And The Law - Ep 147

Cybersecurity legal requirements keep changing at the state, federal, and international level. Most of the changes are just trying to keep up with the constantly changing landscape of threats in cyberspace. Today we call in an expert, Mitzi Hill, to talk to us about those cybersecurity legal requirements. How those changes may impact your business and your privacy and security program is certainly something we don’t want to lose track of in the mix. More information at HelpMeWithHIPAA.com/147

Cybersecurity And The Law - Ep 147

2018-03-3000:55:53

6 Listener Questions - Ep 146

We get questions from listeners on a pretty regular basis. When they come in from an email we do our best to reply with an answer. Sometimes they get backed up for us to get them on the show, however. Today we are covering some of those, in fact, we are covering 6 listener questions. HelpMeWithHIPAA.com/146

6 Listener Questions - Ep 146

2018-03-2300:48:11

Uber Health HIPAA - Ep 145

News abounds about Uber and other ride-sharing services taking people to their doctor appointments. They say they have it covered and Uber Health HIPAA compliance is solid. Today we look at what they are saying about HIPAA here and what that means to us. More info at HelpMeWithHIPAA.com/145

Uber Health HIPAA - Ep 145

2018-03-1600:33:23

Does healthcare suck at cybersecurity? - Ep 144

If cybercrime truly is the number one problem with mankind and healthcare is the number one cyber attacked industry is it because healthcare sucks at cybersecurity? For more info HelpMeWithHIPAA.com/144

Does healthcare suck at cybersecurity? - Ep 144

2018-03-0900:34:13

Cyber issues around every corner - Ep 143

If it seems like cyber issues are around every corner these days, you aren’t imagining things. In episode 128 way back in November 2017, we discussed the fact that we thought there were signs of a coming cyber storm. Today we look at what is going on and see if we may actually be in the midst of that storm or is it still building. For more: HelpMeWithHIPAA.com/143

Cyber issues around every corner - Ep 143

2018-03-0200:43:03

Do I Need A Lawyer? - Ep 142

Information privacy and security requirements in various laws are coming up in legal cases more often these days. Part of that is because we have more of those type laws. Although HIPAA has been in effect for over a decade, I don’t recall seeing it used in lawsuits and legal cases as frequently as I do now. Maybe I am just paying more attention but there are certainly plenty of cases in the courts today. Most are civil cases but some are even criminal cases. After hearing these you will probably know the answer to the question “Do I need a lawyer”. Probably, maybe, that is a fact-specific determination. Honestly, though, the answer is you probably will if you are not taking information privacy and security seriously today. More at HelpMeWithHIPAA.com/142

Do I Need A Lawyer? - Ep 142

2018-02-2300:37:56

5 Breaches Equals 1 Big Settlement - Ep 141

As expected, OCR has continued to announce enforcement actions in 2018. This one is a bit different than any previous resolution in that there are 5 different cases across multiple locations in a single organization. It is also important to note that all 5 of these issues data back to 2012. Almost 6 years since the first one occurred, we have the resolution agreement. HelpMeWithHIPAA.com/141

5 Breaches Equals 1 Big Settlement - Ep 141

2018-02-1600:48:09

HIPAA Made Easy? - Ep 140

HIPAA made easy is a topic we have discussed many times before but today we are going to cover it specifically. So often we get requests for the “easiest way” to do HIPAA. This isn’t something to check off a list and have it done. It is something that you do every day as part of your business. The idea that you can make HIPAA easy is similar to saying that doing all of your accounting and taxes for your business is easy. Maybe if there is one person to pay and that is you but handling your finances correctly isn’t something many people find easy. Yes, the data can be gathered and entered into systems. But, do you know all the forms to complete, documents to save, follow up to do, classifications to determine, etc. It isn’t easy but it is doable. So is HIPAA. For more HelpMeWithHIPAA.com/140

HIPAA Made Easy? - Ep 140

2018-02-0900:51:14

6 Cybersecurity Lessons In The News - Ep 139

Cybersecurity is in the news a lot lately. Particularly a lot of news just since the beginning of the year. As usual, we review all the news looking for important things to share with our clients and listeners. There are just so many different stories to choose from this week, we decided to cover several of them in one episode. So, here are 6 cybersecurity lessons in the news. Some of them may be things you saw before but all of them were worth discussing what we should be aware of and learn from all the information coming in for 2018. For more go to HelpMeWithHIPAA.com/139

6 Cybersecurity Lessons In The News - Ep 139

2018-02-0200:43:48

Cybersecurity Outside The Office - Ep 138

In December, the OCR newsletter was titled Cybersecurity While on Holiday. First, how very British of them! Second, is it just when on holiday? The same rules apply anytime you are on the road with technology and access to the internet. We see this as something you should review no matter when you plan to access information outside the office. While some think the corner coffee shop is a great work space others work in hotels and conference rooms all over town without being on holiday at all. In this episode, we review the suggestions in the newsletter but drill down a bit more into how much of this applies when you are working mobile from home or just down the street as well. More at HelpMeWithHIPAA.com/138

Cybersecurity Outside The Office - Ep 138

2018-01-2600:48:36

OCR Ends 2017 With A Bang - Ep 137

At the beginning of 2017 OCR announced several settlements. Then, the settlement announcements stopped in May as their were leadership changes that continue to happen. In fact, the only reason this announcement seemed to come out was because it was included in a bankruptcy court filing earlier this month. For more go to HelpMeWithHIPAA.com/137

OCR Ends 2017 With A Bang - Ep 137

2018-01-1900:44:22

Meltdown - Patch Baby Patch - Ep 136

Unless you never listen to nerd-speak you have to have heard the discussion about Meltdown and Spectre over the last few weeks. It is a perfect time to talk about what patch management really means in your cybersecurity protections. We try our best to discuss it with less geek speak and more English. For more info HelpMeWithHIPAA.com/136

Meltdown - Patch Baby Patch - Ep 136

2018-01-1200:35:18

7 Educated Guesses About 2018 - Ep 135

Here we go for another year! It is amazing that this is the third new year we have covered on HMWH. There are so many things that have happened over that time and as we head into 2018, so many things to look into our crystal ball and make 7 educated guesses about 2018. We may not be predicting the future but we both have some opinions about what we see happening out there in the world of HIPAA, privacy, and cybersecurity in the coming months. Get more at HelpMeWithHIPAA.com/135

7 Educated Guesses About 2018 - Ep 135

2018-01-0500:40:19

Pay Now Or Pay Even More Later - Ep 134

Is HIPAA compliance expensive? Or, is it short-sighted to only worry about what HIPAA compliance costs? A new report from Ponemon Institute, The True Cost of Compliance with Data Protection Regulations, looks at compliance costs across several industries and multinational organizations. The study has a lot of details as we always expect from Ponemon Institute. Read more at HelpMeWithHIPAA.com/134

Pay Now Or Pay Even More Later - Ep 134

2017-12-2900:46:20

2017 Blooper Episode - Happy Holidays

Each year Bojan Sabioncello, our audio engineer in Split, Croatia, puts together his blooper roll to mock us. Granted, he spends the whole year having to listen to us without a chance to respond until now. This his only chance to respond to a year’s worth of our comments and screw-ups. We will be back next week with a new episode. Happy Holidays from the whole Help Me With HIPAA team!

2017 Blooper Episode - Happy Holidays

2017-12-2200:13:29

Cybersecurity Naughty List 2017 - Ep 133

As 2017 comes to a close, we are making our lists and checking them twice. Time to find out who we thought was more naughty than nice this year. The Naughty List 2017 discussion includes everything from big news data breaches such as Equifax and Uber down to stolen hard drives and password issues. Feel free to add your naughty list nominations in the comments. More info at HelpMeWithHIPAA.com/133

Cybersecurity Naughty List 2017 - Ep 133

2017-12-1500:36:49

Five Phishing Findings From Google - Ep 132

A new report on phishing was recently released titled: Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials. The report of findings from a study that was done by Google, University of California, Berkeley, and the International Computer Science Institute. It was a year-long study of account hijacking, stolen credentials, phishing and malware attacks. The findings are clear that phishing is a problem in ways we may not have thought before now. In the study, the researchers followed other hacker methods used against email addresses they found on the darknet sites for sale. The search netted 12.4 million addresses that were determined to be potential victims of phishing kits out of the total 1.9 billion usernames and passwords exposed by data breaches. So, it is obvious that this isn’t a tiny study over a short amount of time. For more info go to HelpMeWithHIPAA.com/132

Five Phishing Findings From Google - Ep 132

2017-12-0800:51:39

SOC2 certification is not HIPAA compliance - Ep 131

Recently, we have dealt with our clients struggling with vendors in the vetting process. Particularly, tech vendors of any sort. Many vendors have written off the HIPAA compliance requirements by simply saying “We are SOC2 compliant so you don’t have to worry about anything”. Often that is said by sales and management folks with a great deal of confidence. After spending some time at a recent HITRUST meeting I heard just how many people shouldn’t be so confident when making that statement. As with anything else the devil is in the details. What does SOC2 mean and how can you tell if that really means anything to you? Trust but verify is the key to answering that question for yourself. More info: HelpMeWithHIPAA.com/131

SOC2 certification is not HIPAA compliance - Ep 131

2017-12-0100:47:40

Black Friday Replay 8 Common HIPAA Myths

We are enjoying the holiday with our families. But, we didn't want to miss a chance to share time with our listeners. Today we are replaying one of our favorite episodes 8 Common HIPAA Myths.

Black Friday Replay 8 Common HIPAA Myths

2017-11-2400:46:14

5 Things To Do Before Year’s End - Ep 130

Hard to believe another year is coming to an end. It is time to review 2017 and plan for 2018. That means it is time to make your list of 5 Things To Do Before Year’s End. Just in case you need some help with that list, we made one for you! HelpMeWithHIPAA.com/130

5 Things To Do Before Year’s End - Ep 130

2017-11-1700:44:57

Text messaging is not secure by default - Ep 129

Text messaging is often the preferred method of communication for many people today. It does have great advantages with its simplicity, instant delivery, and convenience. However, I did not mention security on that list. Text messaging is not secure by default. Yes, you can secure it but that requires apps, platforms, and planning. The bottom line is the communication method most people call text messaging is not secured enough to send and receive PHI without patient authorization to use it. For more info HelpMeWithHIPAA.com/129

Text messaging is not secure by default - Ep 129

2017-11-1000:40:16

Google Play

Download from Google Play

Castbox

Download from App Store

United States

00:00

00:00

1.0x

What is reasonable and appropriate? Ep 118

What is reasonable and appropriate? Ep 118