Tag archive for "HIPAA"

Articles

The Rising Cost of HIPAA Violations: $100,000 Fine Levied on Physician Group | Mintz Levin – Privacy & Security – JDSupra

Comments Off 21 April 2012

Here’s a fantastic summary of the Phoenix Cardiac Surgery Group’s landmark HIPAA Violations penalty & settlement.

The days of small medical practices thinking they were too small for enforcement are (hopefully) over.

From JDSupra.com:

If your company needs another reminder that policies and procedures, risk assessments, documentation and training are critical elements for HIPAA compliance programs, we have another corrective action plan – and monetary fine – that should be utilized as a “teachable moment” for health care providers and business associates alike.

Phoenix Cardiac Surgery, P.C. has agreed to pay a $100,000 fine and implement a corrective action plan under a Resolution Agreement with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) after a lengthy investigation into potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.

OCR investigated the physician practice following a report that it had been posting clinical and surgical appointments on a publicly accessible Internet-based calendar. OCR’s investigation, dating back to 2003, found that Phoenix Cardiac Surgery had failed to implement sufficient policies and procedures to appropriately safeguard patient information. OCR also concluded that the physician practice did not adequately document employee training on the Privacy and Security Rules, identify a security official, conduct a risk analysis, or obtain satisfactory assurances in business associate agreements with Internet-based calendar and email providers. In a press release announcing the Phoenix Cardiac Surgery settlement, OCR Director Leon Rodriquez expressed the agency’s hope that health care providers “pay careful attention” to the Resolution Agreement and the expectation that all providers, “no matter the size,” fully comply with the Privacy and Security Rules.

via The Rising Cost of HIPAA Violations: $100,000 Fine Levied on Physician Group | Mintz Levin – Privacy & Security – JDSupra.

Articles

UTAH Medicaid hacked – over 181,000 records and 25,000 SSNs stolen

Comments Off 09 April 2012

The Utah Department of Technology Services DTS notified the Utah Department of Health UDOH on Monday the server that houses Medicaid claims was hacked. On Wednesday, the UDOH publicly announced the breach. On Friday, DTS revealed the damage:

181,604 Medicaid and Children’s Health Insurance Plan CHIP recipients had their personal information stolen.

Of those, 25,096 appear had their Social Security numbers SSNs compromised.The agency is cooperating with law enforcement in a criminal investigation. The hackers, who are believed to be located in Eastern Europe, breached the server in question on March 30, 2012.

via Medicaid hacked: over 181,000 records and 25,000 SSNs stolen | ZDNet.

Articles

iPad’s ‘Dictation’ sends info to Apple servers

Comments Off 31 March 2012

“Dictation” is one of the features of the new iPad, and it can be used to dictate notes, emails, text messages. But new iPad owners may want to use it sparingly if they’re worried about privacy: the feature sends what you say to Apple’s servers to process the information.

“What I’ve come to learn about Dictation is that it requires more from me to use than I’m comfortable with Apple requesting,” writes Stephen Chapman on ZDNet.

via iPad’s ‘Dictation’ sends info to Apple servers – Technolog on msnbc.com.

Articles, News

Learn from the Blue Cross Blue Shield of Tennessee HIPAA breach

Comments Off 28 March 2012

In March 2012, BCBS of Tennessee agreed to pay $ 1.5M for HIPAA data breaches.

BCBSoTenn failed to encrypt hard drives containing voicemail files.

 Is YOUR medical practice encrypting hard drives and flash drives embedded within

  • Laptops
  • Desktops
  • Servers
  • Copiers
  • Voice Mail systems
  • And other smart systems

The settlement is available at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/resolution_agreement_and_cap.pdf.?

Continue Reading

Articles, News

ANSI Free Report – The Financial Impact of Breached Protected Health Information

Comments Off 28 March 2012

ANSI (the American National Standards Institute ) has produced a phenomenal, and free, report on the financial impact of losing healthcare data.

 

Highly recommended that you download it from http://webstore.ansi.org/phi/

Articles, News

New Year’s Eve Burglary Triggers Medical Records Firm’s Bankruptcy

Comments Off 28 March 2012

Still think HIPAA compliance is strictly for the big guys?

Still think your small medical practice or medical billing business is safe from hackers, criminals and litigators?

 

From the NY Times:

The New Year’s Eve burglary of a California office building has led to the collapse of a national medical records firm.

Impairment Resources LLC filed for bankruptcy Friday after the break-in at its San Diego headquarters led to the electronic escape of detailed medical information for roughly 14,000 people, according to papers filed in U.S. Bankruptcy Court in Wilmington, Del. That information included patient addresses, social security numbers and medical diagnoses.

Police never caught the criminals, and company executives were required by law to report the breach to state attorneys general and the Department of Labor’s Office of Inspector General. Some of those agencies, including the Department of Labor, are still investigating the matter, the company said in court papers.

via New Year’s Eve Burglary Triggers Medical Records Firm’s Bankruptcy – Bankruptcy Beat – WSJ.

Articles, News

Ambulances turned away as computer virus infects Gwinnett Medical Center computers

Comments Off 12 December 2011

Ambulances turned away as computer virus infects Gwinnett Medical Center computers

By Misty Williams and Joel Anderson

The Atlanta Journal-Constitution

Gwinnett Medical Center on Friday confirmed it has instructed ambulances to take patients to other area hospitals when possible after discovering a system-wide computer virus that slowed patient registration and other operations at its campuses in Lawrenceville and Duluth.

Staff members discovered the virus Wednesday afternoon and have been working since then with outside I.T. experts to fix the problem, spokeswoman Beth Okun said. In the meantime, the health system has been forced to switch back to paperwork.

The situation is expected to last through the weekend, Okun said.

via Ambulances turned away as computer virus infects Gwinnett Medical Center computers  | ajc.com.

CISSP, Events

ISC2 SecureBoston Oct 19, 2011

Comments Off 28 September 2011

Oct 19, 2011 – Full Day ISC2 Local Event

Oversharing: Managing Risk in the Social Age
Co-presented by Raj Goel and Brandon Dunlap

Social Media has quickly woven itself into the very fabric of everyday life and computing. This boom in sharing, even the most banal of details, has had a resounding impact on how our profession manages
enterprise security. In this day-long, interactive event, we’ll explore strategies for managing the risks associated with:

  •  Data Loss Prevention
  •  Brand Protection
  •  Privacy Erosion
  •  Malware Protection

We’ll also outline the cultural effects of Social Media on the enterprise as Generation Y, the Millenials, begin entering the workplace with expectations of open sharing.Many of the tools to protect our organizations and users are deployed and in use already. Join us as we share techniques from our peers in making the best use of our past investments to mitigate these risks.


 

Download the file here:

2011-10-19-RajGoel-ISC2-Secure_Boston_Cloud_Computing_Oversharing_OverCollecting.pdf

 

Events

AppAssure/SMBNation HIPAA Compliance Webinar

Comments Off 07 September 2011

Thursday, September 8, 2011 10:00 AM – 11:00 AM PDT

And with the recent penalties against UCLA Health System ($ 865,000), Rite-Aid ( $ 1M), CVS ($ 2.25M), Massachusetts General ($ 1M) and Cignet ($ 4.3M), the Office of Civil Rights is finally showing that it means business.

Several key requirements for HIPAA compliance are
- backups and records retention.
- Disaster Recovery
- Business Continuity

This webinar, by Raj Goel, a renowned expert on HIPAA/HITECH Compliance,  will give you an overview of how AppAssure helps health care providers meet HIPAA/HITECH compliance, while solving critical business challenges, effectively.

Speakers: Harry Brelsford and Raj Goel

Register here!: https://www1.gotomeeting.com/register/516144041

Articles, News

Written Information Security Policy is INSUFFICIENT to comply with Massachusetts Data Privacy Law

Comments Off 29 August 2011

Massachusetts AG Says Having a WISP is Not Enough to Comply With Massachusetts Data Security Regulations

The Massachusetts Attorney General’s Office and Belmont Savings Bank have agreed to resolve allegations that Belmont Savings Bank has violated the Commonwealth’s stringent data security regulations (see our post about 201 CMR 17.00 here) through an Assurance of Discontinuance, which has been filed in Massachusetts state court (see document here). Belmont Savings Bank has agreed to pay a civil penalty of $7,500 and has also agreed to institute new security and training procedures following a breach in May 2011, when an employee left a computer backup tape on a desk overnight, rather than in a storage vault. A surveillance camera showed that the backup tape was inadvertently discarded by the evening cleaning crew and, according to the Attorney General’s Office, was likely incinerated by the bank’s waste disposal company.

While there is no evidence indicating that any customer’s personal information has been acquired or used by an unauthorized person or used for an unauthorized purpose, the Assurance of Discontinuance states that if actual harm to customers results, the Attorney General’s Office will reopen discussions in order to determine appropriate restitution. This is the first settlement related to a violation of the Commonwealth’s relatively new data security regulations. While the Attorney General’s Office entered into a consent agreement with a restaurant chain in April 2011 for data security failures, that alleged breach occurred before the new data security regulations went into effect on March 1, 2010. (See our post about this consent agreement here.)

via Massachusetts AG Says Having a WISP is Not Enough to Comply With Massachusetts Data Security Regulations : Privacy Law Blog.

News

Little Brother is a snitch – Blackberry Messenger archives open to UK authorities

Comments Off 22 August 2011

The 1st rule of social media and digital communications really should be

“Little Brother is watching…and he’s a snitch”

 

While George Orwell trained us to distrust government (aka Big Brother), his crystal ball didn’t foresee all the little brothers that would take your money AND betray you for their own profitability.

 

After the UK riots, Blackberry maker RIM made the BBMs stored on RIM’s servers available to the UK police.

 

Add this to all the cases where Google, Microsoft, Facebook, etc have buckled under National Security Letters and other arm-twisting and all of a sudden, 1984 reads like an UTOPIAN fantasy.

 

Read more here…http://www.theregister.co.uk/2011/08/09/bbm_riots/

MS says EU data open to Patriot Act seizures…http://www.theregister.co.uk/2011/07/04/eu_customer_cloud_data_may_be_handed_over_by_microsoft/

If you’re concerned about Google retaining your personal data, then you must be doing something you shouldn’t be doing. At least that’s the word from Google CEO Eric Schmidt….http://www.theregister.co.uk/2009/12/07/schmidt_on_privacy/

Aug 23, 2011 – facebook & Twitter are also meeting with the UK government – http://thenextweb.com/uk/2011/08/22/confirmed-twitter-will-meet-with-the-uk-government-for-riot-talks/

So, my compliance-oriented readers, what is YOUR social media, BBM, SMS, EMAIL communications policy?

 

 

Articles, News

CIGNET’s HIPAA Penalty – $946 per record

Comments Off 22 August 2011

Raj Goel, CISSPCTO

Brainlink International, Inc.

raj@brainlink.com

917-685-7731

Raj’s LinkedIn profile


 

Since 2005, the Ponemon institute has released an annual study comparing the costs of data breach.

According to the latest study, lost record costs range from $ 133 to $249, depending on your industry.

 

In light of that, the Office Of Civil Right’s penalty for CIGNET set’s new standards at $ 946/record ($ 4.3 million / 4541 records).

 

This should help healthcare CSOs and CPOs get more attention from their CEOs and CFOs.

The OCR isn’t kidding about HIPAA penalties anymore.

 

About time.

 


Raj Goel, CISSP, is chief technology officer of Brainlink International, an IT services firm. He is located in New York and can be reached at raj@brainlink.com.

Articles

Backing Up Documents in the Cloud

Comments Off 22 August 2011

Raj Goel, CISSPCTOBrainlink International, Inc.raj@brainlink.com

917-685-7731

Raj’s LinkedIn profile

This article appeared on LAW.com

 

John Edwards (no, not THAT John Edwards) did a great job of summarizing various backup tools available for CLOUD backups, and some risks inherent in it.

My opinion is that law firms should NOT be using public or hybrid clouds, as dangers to client-confidentiality and potential litigation liabilities out-weigh any short-term savings.

 

PRIVACY

Rajesh Goel, chief technology officer at Brainlink International, a New York-based compliance security consulting firm, warns that storing data in the cloud could, under some circumstances, pose a privacy risk to client data. “If a firm is large enough and they have the financial and technical resources to build their own private cloud, then the advantages of cloud computing are compelling,” he says. “For firms lured by the low cost/save money siren song of public and hybrid clouds, there’s danger ahead.”

Goel observes that while the Electronic Communications Privacy Act assures that e-mail has a 180-day right to privacy, information held in databases has zero days of privacy protection. “All online applications … can be classified as databases, under the strict definition of ECPA,” Goel asserts.

Goel says that attorneys also need to be aware of another potential privacy threat. “The Patriot Act allows law enforcement to use National Security Letters to obtain information about individuals and companies from service providers,” he says. “Most NSLs forbid the service provider from notifying their clients that they have released information to law enforcement, based on NSLs.”

Goel adds that lawyers with clients in highly regulated areas, such as health care and financial services, also need to fully investigate their situation and privacy risk potential before sending files into the cloud.

Full Article is available at http://www.law.com/jsp/article.jsp?id=1202509461694&Backing_Up_Documents_in_the_Cloud&slreturn=1&hbxlogin=1

 


Raj Goel, CISSP, is chief technology officer of Brainlink International, an IT services firm. He is located in  New York and can be reached at raj@brainlink.com.

About, Presentations

Presentation Topics

Comments Off 13 July 2011

Each of my talks runs from 45-120 minutes.

I present the specific topic in 45 minutes, or really dive into it for 2 hours.

Multiple topics can also be combined into 2,3,4 or 6-hour sessions for 1/2-day and full-day events.

The agendas/descriptions for each of the topics is:


1) Perils of Social Media – How Facebook, Google, Twitter, Social Media & Cloud Computing are creating Threats to Privacy, Security and Liberty

Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.

Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.

We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.

We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.


2) Trends in Financial Crimes

This interactive and lively discussion presents an overview of US laws (HIPAA, Sarbanes Oxley (SOX), Gramm Leach Bliley Act (GLBA), PCI CISP Credit Card Compliance, the growing number of US state data breach notification laws). We trace the history of information security regulations and ID Theft. We examine credit theft and the threat it poses to the American banking industry, as well as the global economy and what governments around the world are doing to combat these crimes.

Special attention is paid to trends and growth in financial crimes, including:

* ID Theft
* Mortgage/Title Fraud
* SPAM /Botnet for Hire
* Credit Fraud
* Case Studies from around the world

Length: 50 minutes


3) Are you Googling your Clients’ privacy away?

This presentation addresses how various services offered by Google can become a threat to your companies’ privacy and confidentiality policies.

It deals with Google’s capabilities to capture and aggregate information with or without user knowledge. Special attention is given to Google’s key offerings such as:

* Google Searches
* GMail
* Orkut
* Google Toolbar
* Google Desktop
* Android
* Chrome Browser
* Case Studies from around the world

Length: 50 Minutes


4) Expanding your practice using LinkedIn

* This seminar will discuss Common myths about LinkedIn
* Proper uses and misuses of LinkedIn
* The power of LinkedIn Groups
* Case Studies examine different LinkedIn profiles, and how to create effective profiles

Length: 50 Minutes


5) Living in a MultiCompliance World – Part I HIPAA, Sarbanes-Oxley, Gramm-Leach-Bliley and PCI-DSS compliance

This presentation provides an overview of the major federal and private information security laws and regulations in the United States.

Case studies examine the real-world impact of non-compliance, analysis of documented cases and guidance on implementing multi-compliance effectively.

Length: 90 minutes


6) Living in a MultiCompliance World – Part II

This presentation provides an ovewview of the impact the 37+ state privacy breach laws have on the federal regulations and PCI-DSS compliance. We examine the New York State Privacy Breach law in depth.

Length: 90 minutes


7) Lessons Learned From the FTC

The FTC has emerged as the leading investigator of privacy and security breaches, and has sanctioned companies and institutions across industries for breaches.  This presentation reviews the FTC’s track record, examines lessons learned from each sanction, and provides guidance based on current and proposed regulations.

Over the last decade, in the absence of a national Consumer Privacy Watchdog/Czar, the Federal Trade Commission (FTC) has set the standard for what it considers acceptable, and unacceptable behavior for companies and organizations conducting business within the United States.

The FTC doesn’t involve itself in the minutae of security standards ‘ala HIPAA, PCI, etc, nor does it dictate what protocols or technologies companies need to use.  Rather, the FTC uses it’s Constitutional and Congressional mandate for regulating Interstate Commerce to hold companies accountable for their breaches.

This presentation will examine the FTC’s track record, put the sanctions in a larger context of privacy and security breaches, and most importantly, we will look at where the FTC is trending with the FTC Health Breach and RED FLAG regulations.

Length: 90 minutes


8 ) PCI Compliance is an expensive, moving target.

Many firms have chosen to become PCI compliant, others are content to sit by the sidelines and hope they won’t get caught.

Countless other firms have engaged in PCI compliance efforts, only to fall short and have significant breaches while being PCI compliant.

Pay NOW for effective, common-sense based compliance, or pay LATER in FTC fines, PCI fines and lawsuits.
Either way, you’re going to pay.

This presentation looks at a Dollars and Cents approach to PCI compliance.PCI Compliance is an expensive, moving target.

Length: 45 minutes


9) Privacy and Security Challenges With Cloud Computing for Attorneys, Accountants and Business Owners

Dropbox, Gmail, Facebook, Amazon Web Services — they’ve become part of the IT DNA.  More than that, they have become household verbs.

Individual consumers and complete corporations moving to Social Media and the cloud has had a resounding impact on how our profession manages enterprise security. In this interactive event, we’ll explore strategies for managing the risks associated with:

- Data Loss Prevention
- Brand Protection
- Privacy Erosion
- Malware Protection
- FTC’s regulatory sanctions
- Guidance from the Courts, FTC, HHS and other regulatory bodies on Cloud Computing and Social Media

 

This has been presented twice at NYCLA(New York County Lawyers Association)  and makes for a great ETHICS CLE for your law practice or Bar association.

Length:  45-90 minutes


10) Case Studies in Privacy and Security failures from around the globe

We examine large breaches from around the world (US, Canada, Japan, South Korea, Israel, UK, etc), focusing on the historical, cultural and social factors that contributed to the breach.

We also draw out the common threads that tie these breaches together, into a comprehensive narrative.
Length: 45-90 minutes

 

CISSP, Webinars

Streamlining and Ensuring Continuous Compliance

Comments Off 13 July 2011

http://www.brighttalk.com/webcast/5385/22557

Webinars

Trends in Financial Crimes

Comments Off 12 July 2011

http://www.brighttalk.com/webcast/188/3182

CISSP, Webinars

New HIPAA Rules and EHRs: ARRA & Breach Notification

Comments Off 12 July 2011

http://www.brighttalk.com/webcast/586/4565

CISSP, Webinars

Watching the Watchers

Comments Off 12 July 2011

http://www.brighttalk.com/webcast/5385/22564

CISSP, Webinars

Regulatory Compliance While Reducing Enterprise Risk

Comments Off 12 July 2011

http://www.brighttalk.com/webcast/5385/22554

CISSP, Webinars

Old Threats, New Vectors: The Evolution of Malware

Comments Off 12 July 2011

http://www.brighttalk.com/community/it-security/webcast/5385/25947

What to teach your kids about Social Media

Comments

I enjoyed your presentation in San Antonio on January 19, 2012. You and Mrs. Spradlin were awesome! I am interested in reviewing the slides that were presented during the event. Would you mind sharing them? If so, how would I access them? Thank you in advance. Sincerely, Phillip Laird, MBA VP/CIO CISSP, PMP, ITIL (Phillip Laird)

Quote Rotator

Loading Quotes...

© 2012 Raj Goel, CISSP. Powered by WordPress.

Daily Edition Theme by WooThemes - Premium WordPress Themes