Help Me With HIPAA

New Years Resolutions can be simple commitments to yourself and your compliance program effectiveness.  When you have so many job responsibilities compliance often gets set to the side or "on the front left corner of my desk".  These tiny changes can help you keep things moving forward without forcing you to spend a day or two a week.   Detailed notes on the show can be found on our website  at he...

Since this episodes is being released on a holiday for all of us at Help Me With HIPAA, we are sharing a special blooper episode our audio editor Bojan Sabioncello created specially for us.  When you hear our recordings from his perspective, you will see what a great job he does making us sound so professional.

Compliance officers need all kinds of help to get their jobs done.  We came up with a list of ideas for gifts to help them out this holiday season. More details at helpmewithhipaa.com/32

Enforcement of HIPAA is changing There are many indicators that make us believe that we will see a distinct uptick in OCR enforcement activity.  The last two OIG reports say OCR isn't doing enough, the news points out issues with enforcement, and even Congress is getting in the mix. In this episode, we discuss why this makes us think you don't want to wait around to see IF OCR starts doing anythin...

The HIPAA legislation itself does not include the option for individual patients to sue any CE or BA that may violate their privacy protections included in the law. HITECH added the ability for the States Attorney General offices to file a cased on behalf of their constituents, however.   The biggest change, however, is the ruling by several State Supreme Courts that allows a complaint to use HIPA...

Everyone is ready for the great deals retailers offer on Black Friday and Cyber Monday. We have a list of low-cost and no-cost deals on HIPAA Security & Privacy tools for you!   Episode 29: HIPAA Black Friday Sale More details at helpmewithhipaa.com/29

The Internet of Things (IoT) is already here, it isn't something that is coming. It is here and it is the future, it will just become more prominent in our daily lives.

If you expect your IT company to do certain things as a HIPAA compliant vendor you are more likely to have the level of support you need.  If you don't ask then they may not be fully aware of what you need or what it requires to be HIPAA compliant themselves.

We review the latest OCR settlement CAP details.

This week we get in the Halloween spirit and share some scary stories that make you have those compliance nightmares.

Description Business Associates and required BAAs are discussed often but not resolved quickly. Let's talk about some ideas and issues that go with BAAs. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Who is a BA? A business partner who provides a service to a CE or BA that requires them to CReMaT PHI. Anyone with persistent access to ePHI whether they do anything with it or not i...

Description We explained the concepts of encryption in Episode 2: Let’s Talk Encryption but people continue to ask more about what they really need to do with encryption. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Episode 2: Let’s Talk Encryption The government and privacy advocates can’t agree on what ‘strong’ encryption even means Notes First, what can encryption do for you and wh...

Cybersecurity coverage being challenged in court has some important points that all businesses should consider. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Help Me With HIPAA   Notes COLUMBIA CASUALTY COMPANY v. COTTAGE HEALTH SYSTEM Data breach occurred Breach announcement said: Between October 8, 2013 and December 2, 2013, PHI of approximately 32,500 patients on the CEs servers wer...

Show Notes If they were shocked that no one was actually watching for security holes at Ashley Madison you can bet they will be shocked that you haven't been looking because Healthcare is supposed to be private. Ashley Madison: Nobody was watching Top 10 Tech Companies with Ashley Madison Accounts What kinds of things do you need to do to actually be considered looking for them, though? HIPAA Comp...

Show Notes When it comes to securing anything the weakest link in the chain is always people.  People are the ones who make mistakes, over-share, and are also the criminals.  This episode talks about what people can manage to do so you have to think of all kinds of things outside the norm. University of Pittsburgh MC BA breach after being hacked the year before Employee of the billing service call...

Mobile devices are vulnerable just like your network, servers, laptops, and desktops. Your risk analysis should include checking on any types of messages, pictures, or access to your data that can be done on your smartphones. Even if you don't put PHI on them they may be able to be used against you in some way to crack your network and your PHI. Patches Android updates and know your version of And...

Let's review email systems and how they can be secured for ePHI and other sensitive data. Find Healthcare IT HIPAA For MSPs Kardon Compliance Alston Article on Email Security   Notes Leigh from Florida sent us an email asking for us to explain some more specifics about email. She had been listening to Episode 8: HIPAA Myths Part 2  which mentioned it but she had specific questions how can email be...

Links ComplyAssistant FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Who is Gerry Blass Been in healthcare for the long ride Consultant for years Now consultant and software company ComplyAssistant  - when did you start development and what was your vision for it? What kinds and size of clients do you have - hospital, practices, BAs and CEs of all types ComplyAssistant  features  Due Di...

Culture of compliance   is the phrase OCR uses when defining what they are looking for in an audit or investigation. They also use the phrase   robust compliance program  in the same manner. Using these steps is a great way to make sure your organization is following their lead. Links ComplyAssistant Compliance Management Solution   Spher EHR Access Monitoring Solution FindHealthcareIT HIPAAforMSP...

In 2014 NIST introduced the National Cybersecurity Framework (CSF). It is designed for all businesses, large and small, to know things they should be doing to protect their businesses, data, customers, and more. Just how does it compare to HIPAA? Notes NIST Cybersecurity Framework DHS Getting Started for Small and Midsize Businesses (SMB) US Chamber of Commerce: Internet Security Essentials for Bu...

An interview with Ray Ribble discussing the AMS Spher product.  We learn how Spher can automatically "learn" what access patterns are normal and ask you when something isn't right. Your HIPAA compliance requirement to audit access logs may be solved with this tool.  Your very own HIPAA Breach Detection Service! Links The AMS SPHER™ Solution FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes...

Description What a HIPAA Risk Analysis includes and why you need it for your cybersecurity risk management. Glossary CReMaT'ed - Create, Receive, Maintain, Transmit CIA - Confidentiality, I ntegrity , Availability Links JPP Medical Record OCR Guidance on Risk Analysis Training Documentation for this episode FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Not a simple checklist it require...

We have a listener who called in with an example situation to find out what we thought.   Is the company a Business Associate?   Listen to Donna's answer in Episode A2. These short "answer episodes" are released weekly on Tuesday mornings when we have them come in. Send us your questions and we will publish them with our thoughts and the best answers we can muster!   Use the  Website form  or  Spe...

Description A Breach Response plan is a required element of your compliance program since HITECH became effective. Everyone must have a written plan and know what needs to be done. Glossary NIST National Institute of Standards and Technology Links NIST SP 800-61 Revision 2 - Computer Security Incident Handling Guide APDerm Resolution Agreement  See item 2(2) FindHealthcareIT HIPAAforMSPS.com Kardo...

How do I get rid of my printers properly?  Find out in HIPAA Answers Episode A1. Thanks for our listener questions that are coming in!  It took us a bit to work out the best way to get back to you, so sorry for the delay.   Today we introduce, HIPAA Answers episodes.  These short "answer episodes" will be released weekly on Tuesday mornings. Send us your questions and we will get them answered.  L...