Workforce Training – RISC Management and Consulting

There have been multiple breaches in the news recently, headlined by the hack of the Office of Personnel Management (OPM) that exposed the information of potentially 18 million people at last tally. It was also recently announced that Blue Shield of California had also experienced a minor breach that affected 843 individuals through a coding error on one of their secure web sites. Within the past month, other notorious events included breach alerts from password manager LastPass and the Houston Astros, a professional MLB club.

While the cause may be different (or still unknown) for each of these events, they can all serve one purpose for any organization: take security seriously. Potential risks exist internally and externally for any organization that maintains or processes important and valuable data such as electronic Protected Health Information (ePHI). With the black market value of health records on the rise, it is imperative for all organizations to make efforts to ensure the confidentiality, integrity, and appropriate availability of sensitive data.

Straightforward steps towards building or maintaining a successful security program always start with a Risk Analysis. Without quantifying the potential risks to your organization, it is difficult to make informed decisions, especially when trying to purchase the right tools or delegate your workforce efforts. The next step is generally to analyze your policies and procedures. These documents state your organizations intent to comply with applicable regulations or frameworks. Maintaining up-to-date procedures is important for ensuring continuity in all of your regular processes and saves valuable time. Once each of the above has been addressed, it is then time to train your workforce. This accomplishes a number of goals including increasing the effectiveness of security controls, improving workforce efficiency, and protecting the organization in the event of a breach or other security incident.

These are just the first steps towards building a security program; there are a number of other technical, administrative, and physical controls that must be implemented to avoid breaches and comply with the standards and regulations of your industry. However, without these building blocks for long-term success, it might not be farfetched to find your organization on the OCR’s Wall of Shame.

To find help with a third-party Risk Analysis, policies and procedures, training, or any other security controls, contact RISC Management & Consulting today!

Just last month, a Pennsylvania-based hospital suffered a breach of patient data caused by unauthorized access and transmission of PHI by an employee. The 551-bed Penn State Milton S. Hershey hospital discovered through an internal investigation that a lab technician accessed and transmitted protected health data outside of the hospital’s secure network. The key in this breach was that the employee was authorized to work with PHI but in this case did not access and transmit the PHI securely. He used his own USB device and sent patient data through his own personal email address to two physicians.

The important thing to note in this situation is what your organization can do to avoid a situation like this: train your workforce. Not only is workforce training required by HIPAA, it is a prudent means of improving efficiency and confidence in your workforce. Many organizations believe that their biggest threat lies outside their walls. While it is a smart business decision to implement security controls to prevent intrusions from external threats, your organization should also prioritize properly training your workforce. Below is a list of the most investigated issues as noted in the OCR Enforcement highlights.

From OCR Enforcement highlights:

From the compliance date to the present, the compliance issues investigated most are, compiled cumulatively, in order of frequency:

Impermissible uses and disclosures of protected health information;
Lack of safeguards of protected health information;
Lack of patient access to their protected health information;
Uses or disclosures of more than the minimum necessary protected health information; and
Lack of administrative safeguards of electronic protected health information.

Security Rule Enforcement Results as of the Date of This Summary

With regard to the subset of complaints specifically pertaining to the Security Rule, since the OCR began reporting its Security Rule enforcement results in October 2009, HHS has received approximately 880 complaints alleging a violation of the Security Rule. During this period, HHS closed 644 complaints after investigation and appropriate corrective action. As of May 31, 2014, OCR had 301 open complaints and compliance reviews.