Musings of a Corporate Consigliere

Thoughts & Advice on Consulting Challenges

Home Archives for healthcare

1 Comment

Leaving the Back Door Unlocked – FTP

No Need to Knock…

When the HITECH Act of 2009 and Final Rule for HIPAA passed in 2013, the security of vendors and third parties became a concern for covered healthcare entities; big and small.  Whenever a partner connects to your network and has access to your Protected Health Information (PHI) you are on the hook for their privacy and security readiness.  The lack of a Business Associate Agreement (BAA) or other excuses no longer apply.  This includes all entities that handle PHI, even dentists.  For some reason a lot of dentists don’t believe HIPAA mandates apply to them.

With this in mind the FBI released a Private Industry Alert “Cyber Criminals Targeting FTP Servers to Compromise Protected Health Information” on March 22nd to be alert healthcare entities of (File Transfer Protocol) FTP server vulnerabilities, quote:

The FBI recommends medical and dental healthcare entities request their respective IT services personnel to check networks for FTP servers running in anonymous mode. If businesses have a legitimate use for operating a FTP server in anonymous mode, administrators should ensure sensitive PHI [Protected Health Information] or PII [Personally Identifiable Information] is not stored on the server.”

[Read more…]

Leave a Comment

The MACRA Muddle

Cybersecurity and MACRA Not Really Complimentary

The Wrong Tools for the Wrong Job

An important conversation I’ve had with healthcare providers is the topic of MACRA or Medicare Access and CHIP Re-authorization Act.   The biggest takeaway I’ve had is that physician’s are only vaguely aware of this massive piece of legislation that has the potential to upend how they practice medicine.  I can understand why this is the case, over the last 10 years healthcare providers have been hammered with so many changes (HIPAA, HITECH, HL7, ICD-10, EMRs) that I’m surprised they still know how to get to work in the morning.

As an industry the consensus around MACRA and it’s benefits can be distilled to one word “terrible”.  With an manifold increase in bureaucratic oversight and reporting and a tiny bump in compensation we will see doctors, who can, transition away from accepting insurance and move toward cash on the barrel.

These sentiments are reflected in the cybersecurity community as well.  HIPAA and HITECH were a substantial, if ham-handed, push to get healthcare entities to address data security.  MACRA has little in the way of assisting healthcare providers deal with securing patient data.  The new legislation is primarily focused on the transition to “population health” and pay for performance models rather than cybersecurity.  There is a nod toward data protection with MACRA requiring the removal of Social Security Numbers (SSNs) from Medicare Cards.  The purported benefits from this initiative is to better protect patient financial and federal healthcare information.

However, SSNs cost about a buck on the black market and it’s a good chance that any patient that is receiving federal benefits has already had their SSN compromised long ago.  Just look at the government hacks (OPM, IRS, VA, etc.) that have occurred over the last several years.

As for private financial information, the removal of the SSN on the cards may have some small positive impact but financial institutions have done only a fraction better at protecting sensitive information.  A quick data correlation on a patient name in widely available online hacker databases can confirm SSNs and other information without physical access to a Medicare or Medicaid card.

In the end the removal of SSNs from Medicaid cards smacks of too little and far too late. More akin to government mandates on buggy whip construction.

Let me know your thoughts in the comments below.

Leave a Comment

HIPAA and the Cloud – Clearing the Air

Healthcare entities and Cloud Service Providers (CSPs) have been reluctant to form business partnerships due to the uncertainty of HIPAA Privacy and Security concerns.  Cloud technology was not mentioned in the original HIPAA legislation from 1996 nor included in the HITECH Act of 2009.  Barring large-scale EMR outsourcing to a private cloud hosted by their vendor; healthcare organizations shied away from other CSP services.  The Department of Health and Human Services had not provided any definitive guidance and healthcare providers did not have a clear understanding of the risk and compliance pitfalls.

This hasn’t stopped healthcare staff from utilizing all manner of consumer-grade cloud solutions. From Dropbox, Box and iCloud, healthcare staff sync their mobile, tablet and laptop device files to readily available solutions that are not HIPAA “compliant” nor do any of these entities have a Business Associate Agreement (BAA) with the overall healthcare provider.  This is a huge compliance risk to healthcare organizations.  There will be a large cost associated with the move toward CSPs who will sign a Business Associates Agreement (BAA) since many consumer solutions will not agree to the privacy and security stipulations of HIPAA.

Recently HHS released their Guidance on HIPAA & Cloud Computing.  Providing the basic risk and compliance building blocks so healthcare entities can start making appropriate decisions with an eye toward managing their compliance and risk obligations.

I had the opportunity to review the new guidance document with the Connected Health Initiative (CHI).   This group is heavily involved in the promotion of innovation in mHealth, telehealth and provides a group of like-minded companies to discuss and navigate the regulatory waters in healthcare. [Read more…]

Leave a Comment

Cyber Liability Coverage – A Piece of the Risk Management Puzzle

Is cyber-liability insurance a must have for today’s enterprise?  How should an organization go about evaluating adding this type of policy to their other stable of risk management vehicles?  Let’s take a look at the current market and a few of the questions that need answers before a company invests in a cyber-liability policy.

Cyber-liability insurance is gaining in popularity as a supplement to Commercial General Liability policies (CGL) and could be a good investment for a business looking to hedge their risk.  The ROI for this type of policy would have to be weighed against the business model, the data stored and the potential damages they could incur in the event of a data breach.  Companies in the healthcare and financial sectors should seriously consider obtaining one of these policies due to the regulatory burden and potential non-compliance penalties these industries face.

Is the cost worth it?

Currently, the cost of cyber-liability policies are quite low.  However, with a record number of data breaches in 2015, the cost of these policies is climbing quickly.  However they are still quite reasonable. Based on a small breach of 100,000 client records, an enterprise would pay nearly $50k in postage for sending notification letters alone. Most cyber-liability premiums, based on revenue, size and industry hover between $1500.  Large multi-billion dollar firms may pay up around $50,000. [Read more…]

Leave a Comment

Technology Planning. 11 Tips for SMBs.

The model(s) behind technology spending has been changing dramatically over the last several years with virtualization, consumer devices and “as a service” offerings complicating the procurement process.  While they offer tremendous opportunities for astute technology consumers, there are also significant risk that the unprepared enterprise technology consumer may realize with insufficient information.

Add to this the increasing cybersecurity concerns, regulatory compliance regimens and staffing issues; even the largest firms are facing difficulty making informed decisions.

One of the questions I get from my small business clients is how can I perform technology audit to take stock of what it has, identify gaps, and create a plan for new tech purchases?

The first step would be to look at your enterprise strategic plan.  What are your business goals for the next three years?  What technologies would facilitate reaching those goals? Do you have technologies in house that fill that need currently? Can they be upgraded or configured to meet these objectives?  If not, what technologies are available (Cloud or on-premise) to meet your objectives?

These very high level steps fall into the basic strategic planning process, governance and portfolio management. [Read more…]

Leave a Comment

Medical Device Madness. No Excuses

image by Colin

In my last post, I touched on the issue of cybersecurity vulnerabilities in medical devices and how the healthcare industry struggles to manage this risk.  We also mentioned the June 2013 FDA Safety Memo that outlined what it perceived as the new responsibilities for manufacturers, healthcare entities and the FDA itself regarding the securing of these devices.

Recently I published an online course in collaboration with the Financial Times / ExecSense on this topic.  I covered quite a bit of the problematic history of medical device security as well as some strategies on how to address this issue on the technology and business fronts.  Healthcare leadership push-back on recalcitrant medical device vendors  will be key in addressing this problem.   Painful cultural change will also be necessary.

Review the June 2013 safety communication, the FDA broke down the responsibilities of the healthcare organization, medical device manufacturer and the FDA itself. If you are in the healthcare arena, the document is short and well worth the read (Link Above), but I’ll put up some highlights:

Healthcare Providers
• Monitoring network activity for unauthorized use.
• Making certain appropriate antivirus software and firewalls are up-to-date.
• Protecting individual network components through routine and periodic evaluation, including updating security patches and disabling all unnecessary ports and services

Device Manufacturers
• Take steps to limit unauthorized device access to trusted users only, particularly for those devices that are life-sustaining or could be directly connected to hospital networks. Appropriate security controls may include: user authentication, for example, user ID and password, smartcard or biometric; strengthening password protection by avoiding hard-coded passwords and limiting public access to passwords used for technical device access; physical locks; card readers; and guards.
• Protect individual components from exploitation and develop strategies for active security protection appropriate for the device’s use environment. Such strategies should include timely deployment of routine, validated security patches and methods to restrict software or firmware updates to authenticated code. Note: The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity.

FDA
• The FDA released a draft guidance on how manufacturers should address cybersecurity in their pre-market submissions. The FDA also has guidance on how manufacturers should address cybersecurity issues related to products that use off-the-shelf software.

The most interesting sentence in the document and the most powerful is The FDA typically does not need to review or approve medical device software changes made solely to strengthen cybersecurity . Of course the inclusion of the word “typically” provides device manufacturers with some significant wiggle room. However this statement begins to take the air out of the standard vendor re-certification argument when it comes to patching and endpoint protection.

Adding more fuel to the fire is the recent release of the Health and Human Services (HHS) Office of Inspector General (OIG) Fiscal Year 2014 Work Plan, which outlines their intent of focusing on medical device security. The work plan states that OIG “will determine whether hospitals’ security controls over networked medical devices are sufficient to effectively protect associated electronic protected health information – ePHI – and ensure beneficiary safety.” The document then clarifies that “Computerized medical devices … pose a growing threat to the security and privacy of personal health information. Such medical devices use hardware, software, and networks to monitor a patient’s medical status and transmit and receive related data using wired or wireless communications.

With both the FDA and HHS OIG now in the act, healthcare clinical project managers and security professionals may finally get the ammunition they need to bend the ear of medical device manufacturers. At present it is primarily the healthcare organization that has to contort its requirements and security concerns to ensure they receive vendor support for their devices.

I’d like to hear some feedback from other healthcare PMs and security professionals on this topic. So please feel free to drop me a line in the comments below!

Leave a Comment

Medical Device Madness. Security Suffering

“We can’t add a virus scanner to our device or we’ll have to get re-certified by the FDA.” If you have any time in the trenches as a healthcare project manager, you have heard those words spoken by a medical device rep. Famous for falling back on the “FDA re-certification” argument, these words have clipped the wings of many a project security and usability requirement. Since many of these devices are sold by a few key players (Phillips, GE) healthcare providers had little choice but to grit their teeth and allow insecure hardware and software to be attached to their network. Then the real challenge begins as the quirky device(s) begins to show unexpected behaviors and generally fails to play well with standardized enterprise systems. If the healthcare organization deploys an operating system patch or places their standard endpoint protection on the device, they run the risk of the vendor halting support during a device issue until the offending patch or software is removed. This can quickly escalate into a patient safety issue, so many times organizations accept the risk and keep their medical devices unpatched and under-protected.

For years medical providers have petitioned the FDA to clarify the rules around cybersecurity and medical devices. Do device manufacturers have to re-certify every time they apply an operating system patch or install endpoint protection? The issue gained more urgency as HIPAA penalties for patient data breaches became more common. Organizations rightly questioned the re-certification argument from vendors since some of the most sensitive protected health information (PHI) is passed through or collected by these devices. How can organization’s effectively manage their security risks and protect against breaches if their key devices remain vulnerable to the most common security issues; outdated patches and endpoint protection? So healthcare IT had to get creative about protecting these devices. Separate medical VLANs, additional physical security, hamstrung endpoint protection and a lot of reluctant risk acceptance. While these steps help mitigate the risk of a breach, organizations still have to contend with similar issues that led to the recent Target credit card breach; default admin passwords, patching issues and third party system access.

Clarity on these concerns may finally be on the horizon. While not a strongly worded as some healthcare security and IT practitioners would like, the FDA has recently released (June 2013) a Safety Communication on the topic of medical devices and cybersecurity. It is the first series of memos and articles that point toward the FDA beginning to crack down on the issues of medical device security.

In my next post I will summarize the FDA Medical Device Safety memo as well as provide some additional thoughts on how to address this thorny problem.  As always please feel free to leave comments below!

Leave a Comment

Of Portals and Patient Care: Education and the Healthcare PM

Patient Education, Literacy and Patient Portals are Making Healthcare InroadsPatient Education and Literacy are among the key topics that are bandied about in the Preventative Medicine discipline and its quest to reduce healthcare costs.  Of course the fact that 42 percent of patients do not understand “empty stomach” guidelines for medication is a cause for concern and a data point for how effective healthcare and wellness education has been to date.With that in mind  AtTask  has published a short piece of mine that covers Patient Education and how it impacts healthcare professionals and the project managers tasked with implementing Patient Education-based projects.

Here’s a bit of the post and then follow the link for the remainder of the article:

I had mentioned in my last post, Hazards on the HIE Road – A Map for Project Managers, that I was going to discuss Patient Education and what projects that PMs were going to be exposed to in this space.

Like most things in healthcare, patient portals and education are linked to HIPAA, Meaningful Use and the Joint Commission. Project Managers must understand the various technological, business and healthcare related drivers that are moving these tools to the fore.

Patient Learning and the tools associated with that discipline have gained considerable traction in the healthcare field. Driven by regulatory, technological, and patient forces, healthcare providers are launching suites of tools that allow patients to access their medical records online, order tests and interact with providers. Medical professionals are relying more on patient portals and other tools to drive better results for their practice and efficiently facilitate patient visits.

Not only do patient learning tools and portals educate the client, they provide risk management and business process management benefits. These tools help coordinate the distribution of clinical, administrative, and financial activities including multi-disciplinary and multi-care settings, plans of care, active care coordination, and the automation of compliance management with a healthcare provider.

– See more at: Of Portals and Patient Care: Education and the Healthcare PM

Leave a Comment

Hazards on the HIE Road – A Map for Project Managers

Quite a few pitfalls await the Project Manager

Quite a few pitfalls await the Project Manager

Health Information Exchanges are at the  forefront of information security and general news these days.  Since HIEs play an important role within the overall state and federal Health Insurance Marketplaces and the security controls within these marketplaces are looking a bit dubious; the overall discussion of HIEs and how they impact healthcare project managers is a timely topic.

With that in mind my latest AtTask Work Management blog post is up.  I cover the HIE technical, regulatory and process backgrounds and how it impacts healthcare project managers.

Here’s a bit of the post and then follow the link for the remainder of the article:

In my last post, “Healthcare’s Creative Destruction & the Project Manager” I mentioned that I would outline Health Information Exchanges and what a project manager should know about the current state of this local, state and federal initiatives.  Why is this topic so important?  In the scale of software development and database integration, few projects like the Nationwide Health Information Network (NwHIN) have been so sweeping in scope; no matter the industry.

One facet that defines the scope of this massive effort is the dollars spent.  The Affordable Care Act mandates (Meaningful Use) that healthcare providers shift to Electronic Medical Records (EMR). Without EMRs, a NwHIN would not be possible.  In order to facilitate this, the Federal government has doled out $12.6 billion in subsidies to providers since 2012.  For the first two months of 2013, $425 million has been handed out for EMR meaningful use.  These large numbers do not take into account the vast sums that will be spent on local, state and federal HIE/HIX promotions, setup and operations (currently estimated at $5 billion).

– See more at: Hazards on the HIE Road – A Map for Project Managers

Leave a Comment

Healthcare’s Creative Destruction and the Project Manager

My latest AtTask Work Management blog post is up.  I cover the current creative destruction that is ongoing in healthcare and how this is impacting the project manager and the discipline as a whole.

Here’s a snippet and then follow the link for the remainder of the article:

“It’s already here; the churn of healthcare change.  Small physician practices are being swallowed up by large healthcare organizations. Older practitioners are retiring sooner, rather than slog through the tremendous business process and regulatory changes that are buffeting healthcare. Local, state and the federal government are embarking on a massive data sharing project with Health Information Exchanges.

These issues all lead to a tremendous amount of risk for the healthcare project manager. To combat this, a PM in healthcare will have to have contract, technology, regulatory, and business savvy when piloting an outreach or new clinic project.”

– See more at: Healthcare’s Creative Destruction & the Project Manager

Share!

ContactUs.com