Industry sign banking indiana word fast
I'm everyone I appreciate the opportunity to talk would give the slaves of the day my name is Jim zur wonka I'm a compliance specialist with STG blew his conch in teaser long ago that you so just wanted to clarify that this session today is what healthcare can learn from meg and just to go over our agenda and hopefully keep us on track what I'd like to do is do an introduction of us DG believe is what we are what we do that sort of thing hopefully explains some of the industry expertise that we have building credibility for you and then move into health care versus a banking for results and two of our guys Mike and John are here today it is number crunching course we've got some hard numbers that support some of the theories that we had and premises then move into the office of civil rights moderate results and see what differentiates between what we put together and what they found in some of the similarities then move into some of the theories that we've created as a result of the work that we've done going to industry meetings greeting studying business and industry these industries and then last move into practical ways to address security and compliance and a lot of that is really common sensible five things but you know it will help in the healthcare arena so who are we sdg blue is an IT professional services firm from focus on three primary areas security and compliance managed services and network at the structure we were founded in 1991 and from de line we were involved in health care at d 4head Florida Lexington give offices in Louisville indianapolis in cincinnati within the last two and a half years we merged with blue and company into CPA firm and so we have a similar footprint that they do blue in company their book of businesses is around sixty to seventy percent health care clients so they've got about 400 CPAs and advisors primarily focuses in the healthcare arena we specialize in banking and health care we are heavily involved in bankers association's healthcare Association m's healthcare financial management all that sort of thing and so we really really have a large focus in this area and our clients range from New York California but we primarily focus on regional clients so we're servicing Indiana Kentucky Ohio and Tennessee in West Virginia and today we have John ask you who is one of our analysts and Michael who are here up in the front patrick is our director of consulting services he's in the back but Michael end up and John primarily did a lot of the number-crunching before the next slides will be seen all right so consulting services primarily focuses on the security consulting producer teaching planning reviewing technical and non-technical assessments how to do a lot of the compliance consulting so risk management is really huge right now hit focusing on HIPAA high-tech being for use govt a PCI you know if you've heard before colleges and it FFIEC an exam advisory services and the audit services as well dr planning and testing how clients put together disaster recovery plans a lot of testing with them and we do analytics and project and our program and project management and so several weeks ago we were picking around some ideas on what we were going to present for this a conference we did some brainstorming internally it was like you know we sure are seeing a lot of a lot of unusual activities a lot of hours Gary a lot of critical areas within health care versus will he see in banking I mean there's a lot going on in health care from a security standpoint that hadn't been resolved you know HIPAA has been in places in 1996 be the privacy rule went into effect in 2003 and the security rule went into effect in 2005 from a banking perspective glta went into effect in 1999 and the IP examination handbook came about in 2002 so they've had you know a lot going on in these industries but just get is some background on how I guess how long we've seen compliancy in and security in health care versus banking but anyhow so we did some brainstorming it was like but one of the major areas that we're finding these issues in and so John and Michael went back the last year to our IT security assessments and they pretty much crunch the numbers in four primary areas which was malicious activity so now we're on the system wireless assessments we also did social engineering and then endpoint vulnerabilities so we'll get into that so we took that information and then we compared it to what we're seeing from the office of civil rights results both from a technical and non-technical standpoint and then hopefully we can attempt to explain the differences in the theories section as we go through those slides but our desired end outcome was pretty much to provide factual information that our healthcare institutions can leverage to improve security compliance and we've got some slides in here to hopefully help our health care compliance so from a banking standpoint you know we first got into malicious activity you should probably do is we we have an appliance you take it to our health care appliance plug it in to their network and so within typically an hour plugging it in we're going to find some sort of malware on that network however being software that is capturing sensitive information such as electronically protected health information so those 18 and empires identify patients we're going to see maybe software on there that's using creative you know just from interruptions in the operations of the network so it may be software to allow someone to access and network so any now what we're finding is that thirty-six percent of our clients that we did work on had active malware under down ports where they had one infection aronim affected client which was almost you know and it healthcare we found double that number so eighty percent were found to have acted malware on the network and almost four times as many infections perfected client so what that tells us is you know we've got a lot of issues out there and ottoman institute pretty much indicated that about fifty four percent of the healthcare facilities or worried alien inhabit intention magnetism and place to detect his power on our networks so what this tells us is that they don't have robust considered response programs in place and if one of these malware you know exploits is pretty much capturing information doing some kind of you know click fraud or whatever you know there's nothing on that at work it's going to tell our healthcare client do they have an infection and then you know from what we've been doing just from a basic administrative safeguard standpoint you know out of the baptist n or so risk assessment what I've done far this year none of the organization's ever and incident response plan in place as I've been tested so from a wireless standpoint what we find is that banks typically don't integrate a wireless network into the production environment so it's you know the banks are totally different to have a back office people come in for maybe 25 to go to the desk this again from the desktop and they work for eight hours and then leave where it's different on the healthcare side is you've got nurses and healthcare professionals out here taking care of patients so they've got handheld devices they've got laptops on carts that they're keying information in walk through the halls of a of a hospital or health care of her care facility and got wireless access points throughout from grandpa hot hallways and then data is being picked up from a wireless standpoint and used in the production environment so very little segmentation there so what we're finding is that when we do these wireless scans in the last couple instances we found that when we did the scan that the guest network essentially allowed our guys access into the production environment that were segregated it anyway so in a controlled more in place so they were able to get into some of the production application systems that contain the electronically protected health information so big thing here is you know second inning that debt Network properly when we do these wireless scans what we're testing is the policies and procedures and making sure that you know everyone in the organization is aware we have a wireless policy and procedure in place but then also we're testing the security awareness training programs and again that's a required I on that book but how do the 10 or so hospitals health care organizations have done the risk assessments for ninety-five percent of them didn't have a security awareness training program in place typically they do when they onboard people and that's it where it's totally different in banks so the bank's pretty much have an ongoing security awareness training program from a social engineering standpoint of what we see here is human beings or the hardest hardest spirit and to control so when we did our testing both in banks and in health care organizations we found that we've had a hundred percent response from the organizations that engages to do social engineering activities meaning at least we had one person all for the trumped-up email with the company logo line that asked them to click on a link enter their credentials whatever it might be so we did have a hundred percent hit reindeer from a banking standpoint thirty percent of the targets responded to the phishing attack which was almost sixteen percent less or a third less of what we hit from the health care stanza endpoint vulnerabilities what we did is we looked at inactive or outdated antivirus software on the networks and so thirty-three percent of the bank's essentially had ineffective replicated antivirus software and twenty percent of the most critical issues about 38 percent of the posts and how risk issues as we head on the critical set we get one per multiple hosts and on the high risk side we had five pergola mo hos our risk issues so the high risk you know we run our scanning tools pretty much broken down into critical our gear is and so that's kind of how we segmented high risk being those exploits that you typically don't see that are maybe to do that offer them ease into the network on the healthcare side and solid almost double the amount of ineffective or outdated antivirus thirty two percent had critical issues for two percent of vulnerable hosts fifty percent of books that have wrist issues if you look at it it was almost three times greater and a healthier set and what we saw thank you so what's that p you know what's that lead us to believe well that they've got pretty much a better patching solution in place and the banks is more robust and what we're seeing in health care he just came here transit item healthcare decline to talk about it well arranging it says angrier from you know small water health care organizations long-term care facilities modern hospital hospitals rural hospitals yep good our main we don't hit me I security or destroyed variables Kristen oh yeah because you man our head I would you know not possible opportunities what's this indifference to do that I think part of it right and that is the way from lacquer regulations and the individual will get into in the theory side sorry how it's objectively all right so you know we did our kind of research came up with the technical aspects and what we then the non-technical from a non technical standpoint how organizations don't have written policies and procedures and typically don't have a rhythm the our plan has been tested you don't have a written incident response plan it a written security awareness plan a written risk assessment blah blah blah you know so up from from an odd office of civil rights standpoint we put those technical and non-technical findings and kind of align them with what's going on with the offices so the rights and so just to give you a little background in 2011 the office of civil rights engaged KPMG which is a CPA firm advisory firm on it firm and they created an audit process for the HIPAA guidelines ok and in 2012 they rolled it out I started doing audits of small medium and large sized hospitals physician practices health plans health insurance companies physician practices all that so they did 150 known during 2012 earlier him here Graham may of 2 2013 they release the results and that's pretty much what's on these slides here but what they found is that a vast majority of those audited fail to comply with mandatory requirements so if you look at the HIPAA requirements that are listed out in the national institute of standards and technology as a special publication 856 there are pretty much the required items which means any policies procedures dr plans pretty awareness i need technical safeguards in place they're the very early age resolutions so I've got a workstation I want to isolate it so that's equal walking five and you know how puddle view you will can't view that information those 18 identifiers on the screen okay so but what they found is that one of the major causes of this lack of awareness of these requirements and I can't tell you how many times over the course of this year that I've talked with owners upon current term care facilities I've talked to cio those directors of IT and many of them totally they've heard of give up they have no understanding of what the security google says about different requirements so complete lack of awareness of the requirements other causes lack of resources both financial as well as human capital and complete implementation work with a hospital of Ohio they had one network administrator who pretty much took care of 25 bed hospital and the physician practice across the road he had started implementing endpoint security a year ago he also started security kind of implementing encryption and it had gone for a year and still wasn't so the guy was pretty much working 24 by 7 didn't have enough time to finish projects and then there's a complete disregard for the requirements on the office of civil rights website the wall of shame there is a case study five cardiac decisions in Arizona that they were using google calendar to schedule their patients they had put the documents their patient documents up in google docs they didn't have policies or procedures and they didn't train their employees on those policies and procedures and so the office of civil rights came in and essentially they said you know the doctors said hey bro kind of all will care so they have a civil rights when it repeatedly a family came inside of six figures and have a host your child for you know how not to do it from a health standpoint so it's out there it's pretty interesting to read so by far the office of civil rights that security was an overwhelming area of concern and then lastly most of these organizations did perform a thorough and accurate riz assessment and I've seen the rest assessments feet four pages long kind of a swag on G we got some risk in his area to very elaborate and what however that as well so what's the breakdown as far as safeguards or controls out of those 115 hospitals that were audited forty-two percent didn't have administrative safeguards in place they didn't have a written policies procedures documents all that good stuff forty-one percent of them didn't have technical safeguards so they didn't have user activity monitoring employees they didn't have authentication yes they didn't give up medication breath and then seventeen percent were physical safeguards not being in place so they didn't have locks on the server room doors the wire closet doors weren't locked there was an organization in the north northwest that didn't have lock wiring closet of doors and refined over a million dollars because the wiring closet for my mom so what are the biggest security issues that the office of civil rights of an authentication user activity monitoring contingency planning media reuse and destruction and the risk assessment and this is a break the investiture t audit issues back area you'll notice user activity is pretty much number one and number two's contingency plan or disaster recovery consol that age is because they they don't understand exactly when somebody says to a risk assessment some people are saying wasn't just my system ciszek just this area this area this area and
tarted I was seen amelie human grasses to look at the meaningful use requirements grad hesitation we're talking about a key risk analysis so you know it's it's an IG risk assessment or risk analysis so what are some of the theories these are not factual these are STG series but audit frequency and impact you know banking audits have been the norm for a long time you know with the handbook being in place it's 2002 you've got the examiners that have pretty much a process in place for coming in and do an exam you got internal and external audit they're all involved in these audits you know I've been in business so you know one of those audits regular testing equals improve security so you know you've got all these examiner's and auditors coming in over and over and kind observation make a recommendation implement it improve security bad on its equal bad results you're going to have higher FDIC rates just going to affect your competitive advantage could be higher risk ratings so you know for other banks may be less likely to purchase your look at you help you out if you are in a fine from a health care standpoint like AG regular ID security and compliance on it you know up until 2012 nobody was going in and doing any internet at all that such as healthcare organizations so really since 2005 minute security and that you had seen anybody really didn't much audit work at least on the federal side you know you may have some of your public accounting firms or consulting firms going in and doing some more product support work when you look at a general computer that draws an application security work you know maybe application controls but nothing like what you've seen at the federal level from the exam standpoint and then lack of teeth to the audits you know they're innovating fan of penalties not until them last year and the thing is is the office of civil rights is self-funded so last year's our budget was 28 million they find about four million dollars this year the budget is 32 million so guess what they're going to go on to you know out of try to find 32 million dollars working by the patrons I don't need you know it will not be difficult along from a cultural standpoint banking you know risk of poor information security as well understood you know I'm protecting your assets I got past security and how is your money you know it's going to be front page news you're less likely to you know make your deposit lifting keep your money there they're focused on protecting and customers assets where is it health care the number one priority is saving lives and painting period of patience and a lot of times accessibility got a doctor to have patient information say during a surgery or an operation you know something like that they want to get that patient information as quickly as they can they don't want to remember a password so that engrosses the security in many cases data is often legitimately shared with more third parties you know I mean you're seeing out family you know data is being sent to collection agencies third-party clearinghouses for processing the government I mean I sit down with but I knew the risk assessment he said the N and we do a data flow diagram and I mean this you know what my school I went to was small rural hospital we started whiteboard again it was like well I think I got 11 God who greets x-rays on the leading well by the time of his over with we had seven in seven different organizations at varying times of the days and on weekends read that the expert for that hospital and so you know just it's it's out there it's going on and it's coming in complex services supported by multiple vendors systems in technology i did a dr plan for a lot of modern says hospital and founded they had 1500 applications on your system so very complex you know they got the handheld units you've got an MRI unit you got this you got that so you know quite a few vendors the thing is is in many of those healthcare organizations they pretty much leave the door open for those third-party vendors to come in at any time and fix that application will paste breaks because the run 24 by 7 and then security is not driven from the top again that doctor will pretty much diff dating I don't want I want passwords on system because I don't remember so coming changes to healthcare audits to become more common there's going to be teeth to these odds funds that are coming down from office of civil rights which is going to be taxing Medicare and Medicaid reimbursements fans with violations go to the federal and the states because the state's attorney general's also levy fines against health care organizations for violations of different penalties for breaches you know just in September 23rd to hitech act plan in place so their guidelines for breaches the number of records add to the number of dollars pretty much being paid as a penalty you're seeing consolidation of systems and reduction of vendors a couple weeks ago into this session they talked about the EMR EHR vendors there's about 400 the development will have those 400 to develop those application systems only 15 of them meet the meaningful use stage 2 requirements that went into effect October version so the others are pretty much you know they have to spend the money get the resources and put in those requirements maybe saving it Tyson manager in Medicaid reimbursements as a cadet effect a hospital I'm not mistaken you to a hospital information really quality replacement dr. so spending country aspirin consistently America point not many cases no but you know just a couple weeks ago we had an incident like that where you know for years the doctors pretty much said you know / to put any passwords on it on that system and now they're actually going to you know named Terry Burke as me yeah you're happy yeah you know I mean it's hassle it slid by four years you know now that you're coming out you know the office of civil rights is coming out fines and penalties you're going to see promise of this type of so from a practical steps standpoint you know just creating documents you know policies or procedures now there was a number one finding out of 115 hospitals forty-two percent of them didn't have written policies and procedures and written documentation so update existing documents create any missing ones there's about sixty two policies and procedures it should be written in order to comply with the HIPAA requirements up and then address breach notification because just went into effect so what kind of you know incident response plan do you have interest reaches business associate agreements again in the open to changes that went into the facts of temperance 22 verbs have you know updated your business associate agreements you know powered entities used to be the only ones that needed to comply with these federal requirements allows business associates so sdg blood if we're going in and we're doing it as a security assessment of risk assessment and we have access to any of those 18 identifiers they're on your network viagra patient information and we're involved in that process of creating maintaining storing transmitting data then we fall into that category as a business associate and we pretty much needed reply with the different requirements and so you know you need the sign of this is associated with music line so if I'm going to an accountant you know maybe even something rude a shredding group you know somebody that shreds documents that's where they have access to that EPA job I'm going to use that a business associate agreement authentication you know a couple months ago we went out and we did Michael and John did did some work at a hospital and in founded they had over a thousand users and then Active Directory password enforcement was nominated and in order to get into their clinical and financial systems it just required someone to enter a pet but essentially their last name first initial hit enter and they were into the system I mean this is 2013 you know so and when we asked you know it's like well how come you don't enforce it it was like because the docs token so if I lament for you realizing they needed to do something so they're implementing an egg carrier don't share the so creating policies and procedures for logon passwords you know not sharing ideas and passwords again around here a physician practice they may be sharing passwords and ideas because the doc doesn't want it want to remember a password implementing two-factor authentication so many mountain any of the social media web sites like LinkedIn Facebook are using two-factor authentication please a product called phone factor so when I connect into my VPN I am my password hit enter I get a phone call on my cell phone and it says if you like about Medicaid get Pam and when I get powned it says it's successfully authenticated cofactors now part of the azure product was fun haha microsoft um so another layer of security there and then define sanctions sanction policy with lentils required of items so what happens when I go out to you know one of the floors and everyone all of healthcare professionals are pretty much sharing passwords and ID's you know first time it's going to be a purple morning make both a then second time it's going to be over a written reprimand the third time i'm going to permitting somebody because I've asked you three tests user activity monitoring you know taking information from the logs and analyzing it correlating it that sort of thing is a real mundane task and it's very costly too many healthcare organizations small medium or large doesn't matter sdg blue have to look real quick but we've come up with pretty much a managed service in solution for our clients and also didn't ask you know we have to a large hospital chain and Holly with them as it's the user log management is like well everyone into a drive more network engineers and we all get together for four hours and they sit through the loss from the previous leads you can find any anomalies I was like okay that's great so you know I said to make sure to go through and pretty much what am I looking for what anomalies Halloween work I've got one client in you know they're looking for failed login attempts and then we're looking for after-hours access into the network so who's accessing the network between one and four a.m. in the morning so coming up with what I want to report on what I looking for frequency of doing some of this quarter implement on its stand point on it and big lots and again having policies and procedures and definitions programming book reports generating and what I'm looking at it needs to be defined but the thing is is it is defined as he caught it you're not doing it you're probably more shaped if you have a document up so we're looking at again where that electronically protected health information is on the network so where's it being created stored maintain and transmit it we're going to look for those slots and anomalies around those specific carries contingency planning again out of about the tendon plus or plus risk assessments I've done this year I've got nine and a half of them to not have a rhythm dr plan ok the half percent head point that a better developed form and that they were actually testing at an off-site so what we're looking for here is pretty much the technical plan versus the business continuity plan which focuses on how to keep my business unit up and running if I've got a Down system media reuse the destruction think for a minute beyond PCs and laptops now you're looking at copiers and then brought up this morning but one of the television stations did it for a couple years ago where they went to warehouse and applied for copiers and took them back to some expert to God essentially took those hard drives out and found him all kinds of electronically protected health information on this hard drive so not only copiers but also when you're doing the risk assessment think about a voicemail because it's got a WAV file on it or you know any type of reporting that may be stored that contains electronically protected health information you know some patient calls it and says it is you know Betty Jones and here's my diagnostic probable bill I addressed everything else how are you storing and how are you protecting it you can what are you doing from a destruction standpoint we did get a hold of all the system this 14 years over you rip the hard drives out or just don't hear again looking at USB Drive CDs and hard drives so you know get out and 11 client and as I talked to the network admin I said so when you do their backup see goes well because you know put it about a backpack and then I get on a motorcycle and I've coped with 10 miles across town I put those hard pressed I didn't shell in a nursing station that sounds real secure so implementing policies and procedures regarding feed you reuse and destructions at a requirement storing them securely I work with another client janae they'll use this credit company in New Jersey that shredder company took an empty steel case with a lot on it shift it down from New Jersey and they have one on site full hard drive because they didn't reuse any hard drives at all they the guy took that steel case put it on the truck the truck was empty it was semi trailer truck it only had that steel case on it they took it up in New Jersey and they shredded them and they they shredded it using VOD in this standards there's actually in this standard called the 888 and they tell you how to shred it and they also talked about shredding paper and what my new needs to go to and all that sort of thing so they shredded it according to NIST and then they gave them a ladder of destruction the last area which touches on the risk assessment is a non step process and we use the the NIST 830 document / God for that and so when I'm going in and doing a prism assessment I have a template that i use and i go through an unjust system characterization so i'm looking at where that e5 is pretty much created stored maintained and transmitted taking really an inventory of all the devices it contains electronically protected health information whether it's a handheld device it could be a hard drive in a drum dispensing machine could be a copier could be a voicemail system servers whatever so I'm Catholic capturing all that information i'm capturing the business processes i'm capturing the data flow inbound and outbound both the internal and external i'm doing a data flow diagram and then I'm getting the ssae 16 s or the sock two words for any further parties so say I'm backing up data to third party I want some something that's going to talk about those controls those weaknesses give me information on their systems as well so I use that in a risk assessment do a threat determination so I'm going to go through and look at the threats the human intentional rent which is pretty much a hacker to human unintentional thread which is the network admin is taken here at 125 at hospital the physicians you know totally untrained he's installing my backup solution my endpoint in a security solution as well also environmental press you know went to hospital I looked in the server room I looked up I think what it is he pans do up here on the server right I said well the pipes trim so we've got these three pence going on common service with my cabinet in town and and then also from from pretty much a natural disaster standpoint I was a small hospital and was kind of walking through and I said having to get hit back what Haley just kind of children with the director guide team and he looked at any of those five years ago he took a direct hit I was like bubble he said the out of the school across the road the tornado picked up with gravel up through and it acted like buckshot just blew out every window and that side of the building he said fortunately I had my data center based on the other side of the building so we look at all those different threats and capture that information then we go into the vulnerability identification so that's where we we use our the NIST guidelines we typically do an IT security assessment first before you do the drizzle cesspit so Micah giant use the tools that we have it in the scans you pick it up the vuln
rabilities that they can identify and we're using that information when we do our risk assessment next I'll do a control analysis so I'm looking at current state controls and future state control just as it is an example of say I had an unencrypted laptop of 29,000 patient records on from a newly implemented EMR system see a good Hospital I go home over thanksgiving weekend last year i take that home the next door neighbor's kid breaks into my house he steals my laptop that's unencrypted okay he also steal some food I guess what Thanksgiving out but anyhow that's gone okay so i've got an unencrypted laptop how many policies of the procedures in place gram how to store by probably content information I don't have a cable that I used to chain that left top down when I'm traveling or when I'm going to conference ring you know so don't have the administrative control in place I don't have a physical control its place I don't have a technical control inputs alright so what happens if it is stolen and I never thought of that Hillary you know a breach policy in place or a process in place but how an incident was caught place either so what I've just described was an actual my parts that happened it gives in regional hospital in Princeton Indiana last last year over ten Skinner and so please determining what the control structure is the current state and future state is used in our risk assessment process so what's the likelihood determination well you know what's the likely to go to that thread vulnerability Peyton Place well on an institute in society research firm says that about 12,000 laptops are lost or stolen for each league in other words that's each bleeding so let's say well there's probably a high likelihood or it might be very likely that my laptop consent riveted with 29 pass and facial beverage is going to be lost or stolen okay so I do a rating you know lightly unheimlich very lightly then what impact does it have to the organization so we didn't have impact has it had monetarily from a reputation standpoint and from a legal and regulatory standpoint i can tell you Evan a laptop excess lost or stolen in a small community where you've got a lot of heavy hitters board of directors has a big impact to the reputation and you know today is probably cost about a hundred thousand dollars you know if you look at that versus how much it costs encrypt that laptop it would have been probably less than to their knowledge so what impact does it have on it or love it and then so what I do then is calculate out what the risk determination is taking the likelihood of times the impact that come up with high moderate or low impact to the organization excusing stoplight I you know red yellow green colors and then we make a control recommendation so in our instance where we get an unencrypted laptop didn't have policies and procedures when we didn't have an able to lock that laptop hang on I now make my recommendation to go from a high risk situation to Lotus this way and then lastly all the results all this documentation I've put together I need this storage is in place versus X years according to him the HIPAA requirements so I need is to store all the policies and procedures when I make a change to those policies and procedures I need to retain it for six years and need to sort of risk assessment so you know something like shared like they work for you to help store because it's got the versioning and it's got the audit trails built in and so that's also the basis that I use now when I am a significant change to the architecture operating systems application systems and in the hospital and even from a personnel stand so with that hopefully I've given you all some information from what we're seeing local standard orbit leaders normal regional standpoint you know what you're seeing in the national level from the office of civil rights and what they're finding and pretty much what they're fighting years look we're finding get our client base and then some you know just real high level areas so from a security standpoint from what we've seen you know people are still apprehensive about spending any money because they're pressured right now any of these hospitals health care organizations you know one long term care facility at two locations like hey what if you can i feed you know security assessment he goes wrong okay but I want to spend any money if you drain your tools against my networking take it down because it's so crappy so you know it even when we go in and make these recommendations for policies and procedures I mean so many simple things that you know you can do on your own people are are really doing a lot of the mentality is I'm going to wait until o'clock no the office of civil rights comes in catches the weather do there now is that you tested for meaningful use stage in life or what they're doing is they're asking healthcare organizations to send in at risk assessment and other documents and if they don't meet the cluster you're pretty much done they're going to do an adjustment to the attestation i think is what they're calling it now so there's start taking the money back so any other questions yep you headed in our hospital we leave there to exist on star reviews you can pull just emerged into the worst grade one challenges that we had that xrl password of people i betta to slow the login process and said you mentioned other positions are not going so one point we were rid of pain have nasm Indiana's we attend some deep freeze as a summer you can use it as a non medical errors decrease of the wage it was basically a BBQ machine that returns neck we left code names gordo man myself and I don't have looked into it over writing for a point see if that is bison as a substitute Oracle distant I'm not either so hungry booze depression in coppell desire to be shy down on the penis is off in wire we call the people's property she has a brief you've been using for years and not advocating a month that guy's explained that I was myself but it basically does not like to score game like improper history you know that everything's but your plan i hope you shut it down that a fence was there you can interrupt the boot process for questions investing a bum I think that's the key I'm confident okay Alicia machine here is there still name oh it was very very oh yeah that's it Oh
