How do i industry sign banking nevada presentation secure
welcome everyone to today's webinar trends and healthcare security I'm McKenzie Garrity with Becker's hospital review we will begin today's webinar with a presentation and we'll have time at the end of the hour for a question and answer session you can submit any questions you have throughout the webinar by typing them into the Q&A box you see on your screen we are looking forward to hearing your questions today's session is being recorded and will be available after the event you can use the same link you use to log in to today's webinar to access the recording at this time it is now my pleasure to start today's webinar by introducing our presenter my SaLuSa chief technology officer at rectangle health mike is a career-long revenue cycle professional with advanced skills and expertise and the specification development and implementation of software technologies to accelerate the revenue cycle for health plans and health care providers ranging from small practices up to large regional enterprises prior to joining rectangle health in 2013 he also held senior leadership roles with multiple revenue cycle technology companies Michael is a bachelor's degree and health systems management from the University of Connecticut and has completed graduate level work in health care management with the same institution at this time I am pleased to turn the floor over to Mike to begin today's presentation perfect thank you very much again everybody this is Mike Peluso and I'm going to go through a presentation today around keeping patient information safe and secure and really to discuss it at a high level it's it's a data breach and we'll use the word data breach a lot in today's presentation but but a data breach in healthcare I find is much more than a regular data breach in a financial type of environment in healthcare there's a lot of information for each individual patient and it's actually more than is found in a lot of financial type scenarios we always hear about data breaches in places like Target or we always hear about data breaches for our United Airlines but in health care there's actually a lot more data per record and there's also a lot more reputational risk when a data breach occurs meaning you know that the provider is is trusted with patient data and the provider has all that personal information on a patient a patient's assumption is that that data is going to be protected over the past year and this really focuses on data from 2018 as opposed to 2019 there were 365 data breaches at least reported which is an increase from 2017 there were approximately 195 million patient records compromised and those patient records actually 195 million represents 60% of the United States population I think 195 million is actually multiple instances of the same record in a provider office you may be using an EMR system you may be using a patient accounting system you may be using a dental practice management system you may be using a claim provider you may have paper information so you could have the same patient breached 10 times in one office so that the numbers can grow exponentially it was reported that 90% of hospitals in the u.s. reported some type of breach and 83 percent of US physicians also reported some type of cybersecurity hack so whether they had a virus on their local computer or whether they had a hack at one of their vendors there certainly is a growing issue and a growing concern and there there are and as we all know there are established laws around security we've all heard of HIPAA we all knew that HIPAA was passed we all know that HIPAA although it was set out to standardize transaction sets it was also set out to create protected health information meaning the pH I of a patient needs to be secure needs to be identified and we all remember that as part of HIPAA everybody needed to start starting to get business so - in agreement so that there are laws around this those laws actually having to be at the state level and the federal level and with the new high trust law which we'll talk about in a little bit it's also all overseen by Department of Health and Human Services as well as the Office of Civil Rights but again it's not just a law I think it's a it's a good practice to just secure patient data and understand that it it's a constant process it's not something that's that's going to be able to to be certified and then go away it needs to be certified and then continually recertified and staff needs to be trained and continually retrained and systems need to be secured and continually recently secured one of the things that I did notice about the Office of Civil Rights is they actually now have the ability and they actually now have a law that says anytime of breaches reported they can report that on their website so you can actually go to their website and look up breaches for particular providers and that actual website is connected to Google so you can actually Google a provider name and identify whether or not they've ever had a breach it'll immediately Drive you to that OCR website saying this provider has a breach and again I think the other thing with the breach is that were looking at the fact that it's a law the fact that it's good practice it's also extremely costly anthem Inc reported a breach that cost 16 million dollars to resolve it was ph i information for 79 million people there was a physician group that settled a breach for five hundred thousand dollars with the OCR again these are costs that are getting added to the healthcare system that we all agree is RNE quite an expensive system to manage so if we can if we can get better at the compliance side we can get better at the securing patient information side we could probably sort of reduce these costs a little bit and help the system along as I mentioned earlier you know this is a quick slide of some breeches that I was able to quickly look up and some dollar amounts as far as Oh our settlements that I was able to quickly look up there is a website or there is a section of the OCR website completely dedicated to this so if I were to go into a Google search and again Google search any one of these organizations on here we won't pick on any one in particular I'll immediately get linked back to this OCR site so there's a reputational risk to not securing the data there's a reputational risk to not keeping patient data safe and we want to try and avoid that at all costs again it's good practice to keep patient information safe and secure it's the law to keep patient information safe and secure but it's also a reputational risk that providers dental providers hospitals health care organizations should really attempt to avoid again as I mentioned it's not just the data loss meaning you can be hacked and lose data but you're losing a you're losing a patient eighty percent of respondents are confident in the data security of physicians we want to keep that confidence if we lose that confidence the idea of losing the patient increases quite a bit a lot of times a patient will look at an organization and they'll feel comfortable they'll feel secure with that organization but if they lose confidence with that organization meaning that organization has as lost their patient data has lost their financial data has had a data breach the confidence goes way down and you risk that you risk the loss of the patient quite a bit and again as I mentioned it it's not just that reputational risk it's also illegal to lose that patient data so our breach is occurring again over 1,800 of the breach cases reported we're affecting health care providers vs. health care and clearinghouses so we can talk about this for the next hour if we really wanted to but as far as clearing houses as far as vendors in the health care space the security the encryption the data storage the training of their employees is all in place at clearinghouses and is all in place for the most part at health plans we'll take an s' them out of the mix there but there's a lot of focus on security there's a lot of focus on things like password updates things like storing data on servers things like cleaning data on servers employee access employee termination so when an employee is terminated from an organization these organizations have rules around them the healthcare providers themselves the hospitals the small dental offices the medium-size providers even the small providers again the day-to-day is seeing patients the day-to-day is creating care for patients the day-to-day is not necessarily security and the point we're trying to highlight is it should be almost a day-to-day subject that needs to get addressed passwords need to change updates need to happen when we terminate an employee for instance we need to terminate that employees access to various systems as well those are the types of things that create the issues but as you can see there there's when we hear the word breach we kind of think well something was hacked meaning somebody hacked into the database and stole the data or the data is out on the dark web or some hacker that's sitting in some dark corner room somewhere or somebody that's sitting into Starbucks is stealing data that's actually not the case of most of the breaches in healthcare most of the breaches in healthcare are attributable to human error as a technology guy I would love to dive into all the other stuff but it's actually true that most of the breaches in healthcare fall into a human error meaning somebody loses their laptop somebody opens an email on their computer and download the virus and now there's a keystroke logger on the computer somebody threw out a paper record in a garbage and didn't shred it and then the paper record ended up in the dumpster behind the provider office so there's a lot of there's a lot of sort of hype around well it must be IT it must be technology but it's actually quite a bit of human error and quite a bit of data breach that can be prevented by just training employees on a better way to handle a lot of those items and then of course we've all heard of the laptop theft one there are now sort of technologies in place where you don't need to store data on your laptop and if you're traveling you know with two million patient records on your laptop you should be putting them in some sort of cloud type application or you should be encrypting them there are technologies now that will encrypt laptops as well so that the data is is much more secure than probably in years past again as I mentioned the numbers keep rising and this was this was addressed years ago with the passing of HIPAA it was also addressed again with the passing of high tech and really what it would have to do a lot with the security and the compliance it has to do with sort of the overall proliferation of technology and healthcare everybody now has a practice management system everybody now has an EHR system everybody now is using a laptop for instance a lot of providers have laptops or a lot of providers have mobile devices so as this sort of technology and increases the risk of data breaches increase the risk of human error increases and also as I mentioned the risk or the the laws that are protecting that patient information high tech HIPPA also increase and I know everybody says and I even touched upon it a little bit but there is cloud computing and everybody I think assumes that the cloud computing is secure and it is secure it's I don't know anybody that has successfully hacked Amazon Microsoft or Google to date that data is very secure but it's how the medical practice how the hospital interprets that data and how they act with that data if I'm sitting down in front of a screen and I'm utilizing a practice management application or I'm creating a HIPAA consent form for instance and I'm storing that data on the cloud server it is it is compliant it is stored on the cloud server in a in a manner compliant with HIPAA but if I leave my computer I walk away from my desk and I leave my screen wide open where someone else can see that information or where someone walking into the medical office can see that information or where a janitor could walk by my desk and see that information I've now breached patient data again it's all secure it's all in the cloud so that is that is definitely the way to go but the the visual of seeing that information again would be considered a breach it's important for our identities to choose that right cloud provider as I mentioned it's also important for them to put the policies and procedures behind that information so that when employees access it they're asking they're accessing it with secure passwords the more places in which the pH I can live also needs to be inventoried as well as I mentioned early in the beginning you can have a practice management application that stores data on Amazon you could have a clearinghouse that stores data on Amazon now each one of your records is actually on Amazon twice once for the practice management application once for the Clearinghouse so it can get exponentially bigger again that the cloud infrastructure is secure the cloud infrastructure is Phin HIPAA compliant it's just a matter of being able to inventory it being able to get those business associate agreements that we talked about it in the beginning and being able to know where all the data is so if there is a breach you can track it back to where it came from um the impact on patients is high I think one of the things that people don't understand is when a when a health care facility is breached or when a healthcare facilities records are accessed there is a tremendous amount of information per patient a hacker out there does not want to capture patient information because they care if Suzy Smith had a root canal last week the hacker is capturing that information because inside of your practice management system or inside of your offices servers there's a lot of information on the patient there's first name last name date of birth social security hopefully there's no social security number but a lot of offices that we've talked to still have it there's Insurance ID information so what a hacker can actually do is steal someone's identity and then take that identity and either sell it for profit and there's definitely means in which they could sell that information or utilize it to gain access to other financial systems meaning they now have a good amount of information so they have Suzy Smith's first name last name social security number they may have Suzy Smith's daughter's first name and Suzy Smith's daughter's first name actually happens to be Suzy Smith's password to get into Netflix so now a hacker has that information they compile the information and now they're hacking against Netflix on it I don't think that they're taking the information again in identifying that Suzy Smith had a root canal last week they're using it for for other types of financial gain not necessarily stealing that patient information to understand what the patient had and again of the perception on the patient's side is different though the perception on the patient's side to Smith in my example is someone stealing her information to understand that she had a root canal last week or someone stealing her information to understand that she had cancer treatment last week that's the patient perception and that's really I think that the biggest impact of a data breach I can give you scores of information on technology and scores of information on on how things are encrypted at rest and scores of information on how AWS secures their data but there is actually the the reputational risk the legal risk that I think is the bigger negative outcome of a data breach and that patient is going to know that someone knew that they had a root canal and I used the root canal as sort of a lighter example the patient may know that they have cancer or they're having cancer treatment the patient then struggles with well do I really want to go to this provider do I really want to receive services from this provider they have already lost my information or I'm about to go to this provider I've done a web search on this provider and now I've seen that they have an issue with a data breach again those are probably the
he biggest risk factors of data breach again we understand they're illegal we understand that but the patient sense that their data is not secure at your office or the data is not secure at your hospital or their data is not secure at your dental office it's more of the the risk I think that we're trying to address we do talk a little bit about payment information payment information is the one that we that does get hacked the most and that if that's not just in healthcare that that's more everywhere when someone hacks into let's call it the target database they're not necessarily stealing the customer information they don't care that Suzy Smith went to Target they care that Suzy Smith as a target and she use the MasterCard ending in four five six eight they want to steal that four five six eight number and that's what they want to steal again from premier offices as well or that's what they want to get to from your offices they want to take that patient information they want to take those patient records and get to some sort of financial gain whether it be selling the data so that people can go out and apply for bank accounts with that data or whether it be hacking actual credit card data the other piece of the credit card data is actually a lot easier to steal than patient information patient information is from a digital perspective is a very big record of you have again easily two to five hundred elements credit card information you have three elements you have a credit card number you have an expiration date and you have a person's name so you can quickly if you're going to do a hack on a medical office you can quickly steal that information now what the credit card industry has done though is they've put in security measures in place so that's not easy anymore and even if a hacker did steal that information that information is encrypted at the source of the unit and we'll talk about that as well the other nice part about the credit card information and we'll we'll talk about this and in depth is the credit card industry has a as a certifying body or has a compliance body that requires all of its what they call merchants we would call them providers requires them to obtain a certain level of PCI certification HIPAA is a rule that a provider office is required to follow meaning there are HIPAA rules and regulations out there every provider office every hospital needs to follow those rules and regulations something like PCI or PA DSS is something that an office or technology vendor actually has to certify to and we'll talk about that one of the other things that I touched on was a point-to-point encryption this is something again that the the credit card industry pioneered in a way that when someone uses a credit card device at a medical office or at a hospital or at a dental office the information is immediately encrypted at the start so even if there was a hacker present even if a office member decided that they wanted to steal someone's credit card information it's essentially unviewable and unusable and the credit card industry calls that point-to-point encryption meaning they will actually change a credit card number per transaction so that if I walk into a medical office and someone steals my credit card information from the network or from the system it's actually not usable at another point in time there's there's technology in place that the credit card industry uses their certification in place that the credit card industry uses that actually can if a medical office or hospital complies with those the HIPAA the high trust compliance will actually be secondary to that type of compliance so they'll be in compliance once they pass their PCI certification they'll be in compliance once they pass their dadss type certification we'll talk a little bit about some steps to improve security and minimize the risk of a breach we mentioned this before but frequently conduct inventory of patient data again the patient day is sort of everywhere it's in physical meaning it's in paper standing right in front of you it's on photo copiers meaning you know you can leave it in a photocopier physically or photo copier will store it it's in all those various systems you as an organization utilize so if you have an EHR system it's in there if you have a patient accounting system it's in there if you have a system for checking eligibility it's in there if you have another system for checking on statements it's in there if you have another system for engaging patients mobili it's going to be in there if your office staff takes home laptops it's going to be on there if your provider takes home his laptop or her laptop or their mobile device it's going to be on there so it's it as I mentioned in the beginning it's a constant process to kind of track where of all this data is who has access to this data and when a breach does occur how can it occur and where can we find it and where could we remediated as fast as possible um develop policy for proper pH I disposal again when you're when you're throwing out paper records obviously want to destroy those paper records when you're getting rid of a PC you obviously want to have that PC destroyed or you want to have that hard hard drive destroyed if you're dealing with a vendor I mean that vendor is storing data on your behalf the BIA should stay in place with that vendor until they can confirm that they're destroying that data and they're getting rid of that data there's actually as a technology guy I do follow a lot of the cloud-based providers so Amazon Web Services Microsoft Google when data is deleted from any of those organizations they don't destroy hard drives remember it's a cloud so there's actually some some scrutiny on if I truly want my data deleted from a cloud provider can they do it they don't send a guy to a PC have the guy take the hard drive out of that PC and physically destroy that PC they actually just delete the data so there's actually some arguments now with the cloud providers of how can they certify how can they verify that data is truly getting deleted I mean we can certainly talk about that for hours they are they are HIPAA PCI compliant so we're assuming they're doing improperly but there is that that question of that that sort of if you're in business is more for hospitals probably in your IT professional in a hospital you want to make sure that if you're using any cloud-based providers you're getting that type of certification on the data is truly getting deleted secure messaging platforms these are growing quite a bit in healthcare from a patient engagement perspective to engage a patient about something but again we don't want to necessarily send Pho data to the patient we want to send a message to the patient saying they could access their Pho data in a secure way whether it be through a web portal or whether it be through some vendor that offers that type of services we're not messaging thi data a provider shouldn't be messaging pho data either it should all be secure and we should be using the proper messaging platforms to send around that data and a lot of the EMR patient accounting systems of today to do this regular trainings with staff I touched on this quite a lot before the the majority of data breaches the majority of issues in this space around data security do always go back to some sort of human factor or don't usually go back to some sort of human factor so if there's constant training if there's constant protocols around patients util our providers staff utilizing different passwords changing their passwords not sharing passwords a lot of times I'll do work with a medical office of a staff of 15 people and they happen to all be using the same username and password if there's a way to eliminate that and again the big plans the big providers the you know the the Endo's the united of the world they have scores and scores of training for all their employees around them every practice should have equivalent training every hospital should have equivalent training every Medical Group should also have equivalent trained routinely test systems for security holes again this can be done as part of that PCI certification that I talked about earlier HIPAA certainly has the rules that say you need to have a password change every certain amount of days HIPAA certainly has the rules that say your network needs to have penetration tests and needs to be secure PCI which is payment card industry actually requires it to get certification so when you do your PCI testing they will actually do a scan of your network and if you pass the scan you'll get your PCI certification Tampa doesn't necessarily have that level of certification or that level of compliance they basically just say you have to say you follow the rules of HIPAA PCI actually says you have to pass the certification in order to get the PCI certification so there is sort of a way to to have a quarterly networks can there is a way to have that verified functionality by becoming PCI compliant which will give you that secondary compliance of your HIPAA SS station [Applause] additional measures as I said in my example before you know if you have a staff of 15 people in your medical office they shouldn't all be using the same username and password we see this quite a bit most of your environment should be networked if you have report remote employees those remote employees should be accessing something that is secure if you are storing any data on servers in your office that data needs to be secured that needs data needs to be stored and encrypted so if I do walk in there and I steal a laptop or I do walk in there and I steal a PC when I bring it home and attempt to plug it in can access any of the data from it and that's that's your encryption standard as well so there's a lot of different factors that an office or medical practice can utilize um even with all the the items that have gone through and with all the precautions that I've gone through data breaches are definitely on the rise you know even with PCI security standards even with HIPAA security standards the problem is not necessarily going to go away we can mitigate the problem as much as possible but we should sort of continuously attempt to to train notify our staff continuously attempt to the Train and work with patients their data is secure their data is being handled and with the utmost security that's available but the problem is going to continue and it's going to continue to rise and we should look into all the methods that I discussed to combat those issues with that said I'm going to go ahead and open the floor up to some questions feel free to ask thank you Mike for that fantastic presentation will now begin today's question and answer session please submit any questions you have by typing them into the Q&A box you see on your dashboard we will try to get through as many questions as we have time for so to kick things off the first question is how do I ensure my environment is safe and secure oh and I think that goes through the the PCI quarterly scan that I talked about or the PCI intrusion scanning that I talked about that's something that a smaller medical provider could easily sign up for smaller dental provider could easily sign up tour through their payment services provider there's also smaller organizations out there where they can engage them to do that type of scanning larger organizations like like hospitals are going to have IT security staff that are working on that constantly so as a revenue cycle type person you just want to make sure that you're you're in coordination with the IT security staff to understand that all of this these precautions are being taken around patient security next question great thanks Mike so next question what set your messaging platforms are you familiar with so there are there are a few out there a lot of them are are built into practice management EMR applications there are vendors specific to just secure messaging we can go through a number of commercial names for those but they're there they're specific just to messaging and they do outbound type messaging I know West corporation livebox does it they're there quite a few out there and actually that one that I just mentioned is even doing the secure messaging built into Cerner so they're Cerner's partner for secure messaging that's the first one that comes to mind next question yeah so our next question I was an audience member was wondering if you could share any tips on how to ensure HIPAA compliance I think I like my I can almost call it a cheater tip I like the fact that PCI compliance it is a certification meaning when you go through your PCI compliance with your payment vendor they're going to do quarters they're going to do quarterly scan they're going to do intrusion testing as part of your PCI certification so if you go through that PCI certification you can easily self a test to the HIPAA certification there are organizations out there that will do quote-unquote HIPAA certification and you can engage those as consultants they're there more though they're not sort of authorized by the body that does HIPAA certification that's the government and the government doesn't say that there is an official certification body for HIPAA the government just says here are the rules and regulations of HIPAA you as a medical provider need to follow them so you can you can almost cheat a little bit by using the the PCI certification rules and going through the PCI certification to become a HIPAA compliant thanks for clarifying that my our next question is what is the best way to train staff on security and how to protect patient data the the best way is as often as possible and it's to really give it to the to the staff as what if this was your data how would you feel and in build a training program around sort of that that patient satisfaction again patients are putting their care in your hands they're also putting their their trust that their data is secure they're putting their trust in the front desk person isn't going to go go home and tell someone hey I had this patient today and XYZ happened to the patient so you want to train them on a level that that they'll understand not on a a better way to say this on a boring technology level and that's kind of the way we develop today's presentation and that you know we could certainly talk about 256-bit encryption and we can certainly talk about data rest and XML web service transactions and how they're secure or not secure but it's more about that that patient trust and making sure that patient knows that their data is safe and secure and then relaying that to the office staff so the office staff knows hey these patients are trusting us with their data I should change my password every 60 days I shouldn't share my password not because I'm in a good employee but because I trust it or I have the patients trust that I'm not going to share their information great we have a lot of interesting questions coming in our next one goes back to our cloud conversation and about utilizing AWS or Asher and they want to know when you perform penetration testing which layer are you routine routinely testing so the penetration testing will be at the at the office level so when you do a penetration test with a we'll just say with a PCI provider they're going to do it at the office level but if your entire environment is hosted at shore or Amazon you're going to give them an IP address to scan to look at the vulnerability or you're going to give them a web URL if that's hosted and/or part of the AWS or a sort it's your network they're going to do the scan there obviously I think you're going to pass immediately but they'll do the scan where you direct them to do the skin great insight there the next audience question is asking if you can share some tips on how to restore patients base in an organization and sometimes employees after a data breach um so I think it's it's it's transparency explain to you know a patient and whether it be visually whether it be a notification whether it be a you know a sign in the office that a breach has occurred the breach was was not at the office level the breach could be at a vendor level it could also be at the offi
e level and all the steps necessary to to alleviate that breach or to make it so that breach doesn't occur any more have been taken you know all the way as far as if the breach was at an employee level um the employee was terminated all the way as far as if the breach was at a vendor level that vendor is no longer being utilized or that vendor has as attested that they've done what they need to do necessary fantastic points and I was wondering if you would be able to elaborate a little bit on your thoughts about off don't worry I'm offshoring from a development perspective is sort of a risk because you when you offshore certain code development you know you really need to guarantee that the code development that you receive back is secure and it is not sort of there's not hidden lines of code in that from a hosting perspective I think there there's plenty of hosting options on shore and I would I would push towards onshore hosting options I would post offshore just because of the the International IPs and those have have a lot more issues when it comes to hacking and data breach than national or United states-based IP our next question is um how do you go about educating line staff beyond just a program of in-person education by privacy offers and offering HIPAA tips for email yeah so there are there are training programs you can develop there are also online training programs that the office can sign up for so that the employee can go through an online training program obviously in larger organizations you can have internal training sessions but in small offices if you know you can go online and Google HIPAA training or you can go online and Google PCI training where a staff member will actually be run through an online course great thanks so much Mike for we have time for one more question here and it's do you perform any machine learning analytics in your organization and so any security obstacles you could warn us up so we do our own machine learning analytics but they're they're internal to the organization so our our machine learning is capable of understanding how a office staff post the payment or how an office staff checks in a patient and we attempt to to automate that at the at the provider level or at the small office level that type of technology I don't think has been pushed down to those types of organizations but if it were to again it all has to maintain a certain level of compliance and in your vendor that's providing it with that machine learning has to be willing to sign that business associate agreement we do it within our organization because we're a technology organization but at the level of a small provider office they're not going to I don't I don't think they're going to program machine learning within that office they may utilize it from a vendor but the compliance security and sort of securing a patient data should be the vendor responsibility thanks for explaining that I was wondering Mike if you had any other final thoughts to make the audience with um again it goes back to week we could sit down and go very technical and didn't talk about security and compliance from a from a technology perspective about storing data securely on servers about the technology that stores data the technology that encrypts data I think it goes back to more though the breaches happen to be centered around human errors or the breaches happen to be centered around training issues so all the the security all the the things that Amazon could put in all the things that Microsoft can put in to make things secure are all dependent on that that human factor of you know are the people utilizing all this technology are the people that are that are doing the work in a provider office using all the best practices and maintaining that that patient trust that's the most important part not necessarily the technology keeping everything safe and secure that's all the time we have for today I want to thank my first excellent presentation and rectangle health for sponsoring today's webinar enjoy the rest of your day and we look forward to having you join us for future webinars
