Csa security risks_compliance_ramadoss_11102016_mo_d

www.cloudsecurityalliance.org
Healthcare Information
Security Risks and
Compliance
2016 Colorado CSA Fall Summit | November 10, 2016
Ram Ramadoss, Vice President, CRP Privacy, Information Security
and EHR Compliance Oversight, Catholic Health Initiatives
Copyright © 2016 Cloud Security Alliance

www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.orgCopyright © 2015 Cloud Security Alliance
Overview
• About Catholic Health Initiatives
• Healthcare Industry Overview
• Top Technology Trends
• HIPAA Compliance/Risk Assessment
• OCR’s Cloud Computing Guidance
• Q&A

About Catholic Health initiatives
• The nation’s third-largest nonprofit health system
• CHI operates in 19 states and comprises 103 hospitals;
Four academic health centers and major teaching
hospitals as well as 30 critical-access facilities;
Home Health, Senior Living Facilities
• Other facilities and services that span the inpatient
and outpatient continuum of care

Overview
• Current state
• Evolution
• Complexity
• Challenges and Opportunities

Evolution
• Major consolidation of Healthcare providers
• Small and Medium sized practices are struggling
• A major movement to Electronic Health Record
systems
• We are seeing an increasing shift towards outsourcing
• Competing priorities and budget limitations
• Consumerization

Complexity
• A significant number of legacy electronic systems
• 20 plus years retention timeframe for medical records
• Legacy medical devices / wireless capability

Security Challenges Unique to the
Healthcare Sector
• Protected Health Information (PHI) includes fundamental,
unchanging facts about a patient
• An average security breach cost - $363 per record in
healthcare versus $154 per record in other industries
• In 2015 alone,113 million patients were affected by breaches
• Fraud opportunities for criminals include:
 Identity theft
 Exploitation of insurance details
 Prescription drug benefits

Challenges and Opportunities
Challenges:
• Vulnerabilities and weak security controls
• Aggressive Threat Landscape
• HIPAA regulatory requirements
Opportunities:
• Desperately looking for technology solutions
• An open minded approach with outsourcing
• Exploring efficiency and automation opportunities

The Consumerization of
Healthcare
• Consumer connected to the New Healthcare Economy
• A greater expectation for personalized experience
• Business intelligence tools to derive patterns and
consumer trends

Big Data
• 360-degree view of customers/patients
• Unstructured data to help with predictive analytics
• Increasing focus on Health Clouds
• Medium size providers – huge opportunity
• Large Healthcare providers - partnerships

Mobile Devices/Applications
• Not just the Millennials
• Access to Health Information using smartphones
• Online scheduling / Insurance shopping /
Virtual care drive off
• Developing a digital eco-system
• Patient/Physician portals; information sharing
 Engagement and interactions with patients

Patient Data vs Patient Safety
Focus

HIPAA Compliance and Risk
Assessments

Business Associate Agreements
(BAA)
• A contractual agreement between a Covered Entity (CE)
and any third party company with access to patient
information (Business Associate)
• A mandatory requirement – HIPAA Administrative Safeguard
• Key provisions include but not limited to:
 Return or Destruction of Protected Health Information
(PHI) upon Termination
 Safeguard the ePHI and Breach Notification

Information Security Amendments
• Additional language regarding a minimum security program
• Security provisions regarding access from foreign locations
and storage of data outside the country
• Risk stratification of partners and Business Associates
• Monitoring of partners security and compliance

Suppliers/Business Associates
Facts:
• Increasing outsourcing activities (Business Process/IT)
• Cloud-based electronic health record systems
• Patient care program is reliant upon the
support received from partners / BAs
Mitigation:
• Cybersecurity insurance coverage
• BAAs and security amendments
• Access and storage outside the United States
• Supplier risk management program

The Office for Civil Rights’
(OCR) Cloud Computing
Guidance

Cloud Computing Guidance
• Covered Entities (CE) must execute BAAs with Cloud
Service Providers (OCR’s recent fines against a CE)
• Risk Analysis – both CE and CSP
• Service Level Agreements must include:
 System availability and reliability
 Back-up and data recovery
 Manner in which data will be returned to the customer
after service use termination
 Security responsibility
 Use, retention and disclosure limitations

• CSP is directly liable under the HIPAA Privacy Rule
 Use and disclosure of data not authorized by the
contract, law and HIPAA
• CSP is directly liable under the HIPAA Security Rule
 Failure to safeguard ePHI
 Failure to notify a Covered Entity regarding a breach
• CSP’s are still considered Business Associates:
 If the data is encrypted
 Even if the CSPs do not have access to data

• Can a CSP be considered to be a “conduit” like
the postal service?
 the conduit exception is limited to transmission-only
services for PHI including any temporary storage of PHI
• Lack of actual knowledge by CSPs that their services are
used to handle ePHI
 Affirmative defense - address compliance within 30 days
• Breach Notification – CSPs must implement:
 Policies and Procedures
 Document security incidents
 Report incidents to CEs and Business Associates

• CSPs must return or destroy all PHI at the termination of the
BAA where feasible
 If such return or destruction is not feasible, the BAA must
extend the privacy and security protections
• HIPAA rule does not restrict storage of data outside the US
 Risk Assessment is the key
• Customers may require additional assurances from CSPs
such as the documentation of safeguards or audits
• De-identified ePHI per HIPAA Privacy Rule
 CSP is not a Business Associate

Csa security risks_compliance_ramadoss_11102016_mo_d

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Andere mochten auch

Andere mochten auch (11)

Mehr von Trish McGinity, CCSK

Mehr von Trish McGinity, CCSK (16)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Csa security risks_compliance_ramadoss_11102016_mo_d

Hinweis der Redaktion