Helpful Reminders About HIPAA Security Risk Analysis
If protecting the integrity of patient health care information were not already sufficient incentive to improve IT security, being HIPAA compliant has perks.
Healthcare IT Security
Largest HIPAA Compliance Settlement – A Prescription for IT Security Health
The key to Redspin’s rapid rise as the leader in HIPAA compliance for healthcare providers has been our unyielding focus on IT security. Last week’s news that OCR had reached a $4.8 million settlement agreement with New York-Presbyterian hospital and…
Mobile Device Management: Protection But Not Panacea
A Mobile Device Management (MDM) solution is a single security tool that must work in concert with many other IT operations to achieve information security. Choosing the right MDM requires significant forethought. Implementing all the controls correctly for all end-users…
The Biggest Oversight in HIPAA Security Risk Assessments – Security!
There are many HIPAA consultants, law firms, software companies, cloud service providers, and others who will happily provide you with a quote for a HIPAA security risk analysis. Neither the HIPAA Security Rule nor the respective references in Meaningful Use…
Healthcare IT Security Makes Strange Bedfellows
UPDATE January 12, 2013: House of Representatives Passes Bill Requiring Additional Security Requirments on the administration of HealthCare.gov Last week, it was reported that House Majority Leader Eric Cantor (Rep -?VA) intends to draft legislation early in 2014 that would…
HIPAA Security: Stage 2 Meaningful Use, Encryption, and Patient Portals
A recent interview with Dan Berger, President and CEO, Redspin Inc. Q. You mention that there is "more focus on the EHR in stage 2"?. What kinds of things do you think CMS is really looking for? A. What I…
Healthcare IT Security – The “Not So Big Easy”
HIMSS, the healthcare industry’s standard bearer for the promotion of information technology (IT), held its 13th annual conference in New Orleans last month. Nearly 35,000 people attended the event including former president Bill Clinton, fellow politicos James Carville and Karl Rove, and bow-tied Dr. Farzad Mostashari, HHS’s National Coordinator for Health Information Technology.
Interoperability and exchange were the hot topics of the week, further jazzed by the recently announced CommonWell Health Alliance – a 6-party partnership between Cerner, McKesson, Allscripts, athenahealth, Greenway Medical Technologies and RelayHealth. Notably absent from the Gang of 6 is Epic, the undisputed EHR market heavyweight. Depending on who you ask, Epic was either not invited to join CommonWell or chose not to participate. Epic’s CEO, Judy Faulkner, said that the alliance is less about interoperability and more about competition. “It appears on the surface to be used as a competitive weapon and that’s just wrong. It’s wrong for the country.”? When asked to referee, ONC’s Dr. Mostashari said he didn’t want to get into a “he-said, she-said.” The dust-up made the Karl Rove – James Carville debate look tame by comparison.
The Executive Order on Cybersecurity – What Does It Mean for Healthcare?
The much anticipated executive order titled “Improving Critical Infrastructure Cybersecurity” was recently unveiled by the White House. As much praise as the President’s order garnered, there are still many unknowns about how the order impacts not just healthcare but all major industries in the United States. In the era of HIPAA, HITECH, SOX and another dozen regulatory security compliance acronyms how should the order be regarded? Potential, nothing more.
To understand what the executive order means and doesn’t mean we have to break it down into its two primary components: information sharing and security framework. Of these two the information-sharing piece is the one that could yield real benefit in the present. This section requires the federal government to report cyber security threats to private industry in a timely manner, if these threats are labeled as unclassified. The value of this kind of knowledge to a company in the crosshairs is enormous. However, the classification is a big IF so don’t expect your friendly neighborhood federal agent to routinely call you every time there is a threat on the horizon.
Did You Miss the HIPAA Omnibus?
On January 17, 2013, the long-awaited HHS HIPAA Omnibus Rule was posted on the Federal Register and has been the subject of much fanfare in the press. According to HHS Secretary Kathleen Sebelius; "the new rule will help protect patient…
The ROI of Business Associate Security Risk Management
Redspin now offers a Business Associate Risk Analysis service that helps hospitals and other covered entities understand where their highest BA risk lies so that they can take preventive measures and/or implement contingency plans to mitigate that risk.