Preparing for a Cyber Security Audit: Part X

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series of articles on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the tenth installment in the series.

The U.S. Department of Health and Human Services (HHS) recently defined a security rule formally known as its Security Standards for the Protection of Electronic Protected Health Information (e-PHI).

This rule sets standards for information and communications technology (ICT) in any healthcare organization. Compliance with the rule is mandatory. Enforcement powers of the government are codified at 45 C.F.R. Part 160, Subparts C, D, and E. If there is a violation, then civil money penalties (CMP) may be imposed.

One part of the rule calls for identification of and protection against “reasonably anticipated threats to the security or integrity” of e-PHI. What does “reasonably anticipated” mean? In particular, does it refer only to the psychological side of “anticipation,” or does it translate deeper into organizational actions?

Here, we will argue that “reasonably anticipate” means not only the purely psychological side, but it also implies that your organization must take specific tangible steps to anticipate a ransomware or other form of cyberattack, and effectively deal with it should it occur.

Preparing for a Cyber Audit

In previous articles in this series, we have reviewed the high-level steps of a cyber audit. First comes a “desk audit,” in which the healthcare provider is given a number of questions that must be answered in writing within 10 business days. Second, it is possible for certain providers to be chosen for more in-depth, on-site audits that can last for 3-5 days. Third, if necessary, the organization can be subjected to even more detailed audits that may lead to penalties.

Section §160.410 of this rule sets forth the “affirmative defenses” that might be used by the healthcare provider. For example, the provider might attempt to show that it demonstrated “reasonable diligence” in combatting hacking. What follow are a few of the steps that might be taken to demonstrate “reasonable diligence” in protecting against malware attacks.

Tabletop Exercise 

The tabletop exercise is a simulation of how your organization would respond to a cyberattack. The U.S. Department of Homeland Security offers generous documentation on how to conduct these exercises. In addition, there are a number of commercial security consulting organizations that can help you conduct this type of drill – for a fee.

The purpose of the tabletop is twofold: First, it is designed to raise awareness of the issues that must be dealt with, and to clarify who is responsible for handling them; second, it is designed to find glitches or flaws in how the organization responds. These glitches are particularly important to understand because only once they are identified, they can be fixed.

In many cases, a tabletop exercise is the first time an organization is forced to think through how it might respond to a cyberattack, and who is responsible for doing what.

Document Everything

The entire tabletop exercise and all of the details must be scrupulously documented. Of particular concern is documentation of any issues found in the organizational response, and exactly what steps were taken to rectify the problem(s) and mitigate the potential for serious damage.

For even the most hard-headed auditor, it is music to the ears to see well-organized documentation illustrating how your organization has been systematic in anticipation of a threat and responsible in the formulation of an effective response.

Strictly Enforce Security Protocols

The auditors will be looking not only for security protocols that are on the books – everyone has those – but also for evidence that the protocols are being used. Because of this, it is necessary to maintain a log of every single breach of a security protocol, including the date, time, systems affected, persons involved, how it was discovered, and what actions were taken to make sure it does not happen again.

It goes without saying, however, that in order to enforce a security protocol, an organization must have one in the first place, and everyone must understand how it applies to them personally.

Book of Security Protocols

Your organization should be able to present documentation of each security protocol. This includes how to log on to a system, how to log off, how to choose passwords, how to keep passwords safe, how to respond to phishing emails, how to handle email attachments, and so on.

Not only is it necessary to have complete documentation of your security protocols, but it also is useful to have documentation verifying that each employee in the organization is fully aware of all protocols that they might need in the event of a security breach.

Standing Patient Notification Protocol

In the case of any substantial security breach, your organization will be required to notify patients that their records have been compromised. In order to prepare for this, your organization must have documentation of drafts of the notification letter, with specification of the principles that will govern exactly when (and to whom) notifications will be sent.

Documentation of Security Maintenance 

Each modification or maintenance made to your information system with an aim of improving cyber security must be completely documented. In particular, there must be a clean record showing the date, time, and other report of any security patch that is applied to your information system.

After all, it is difficult to conclude that an organization is not taking “reasonable steps” towards effective cyber security when the documentation shows otherwise.

In some cases, an information systems organization may resist the adding of an additional “bureaucratic” step of recording their every move, but be assured, it is necessary, because it proves due diligence on the part of your organization.

Preparing for a cyber audit involves taking tangible steps to improve the security of your information system. But being secure is not adequate, for the purposes of an audit.

Instead, it is necessary to be able to show documentation of everything you have done. In this way, you can feed the audit monster before it bites off your hand.

In future issues of this series, we will go into greater detail about cyber audits.

Print Friendly, PDF & Email
Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Explore the top-10 federal audit targets for 2024 in our webcast, “Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets,” featuring Certified Compliance Officer Michael G. Calahan, PA, MBA. Gain insights and best practices to proactively address risks, enhance compliance, and ensure financial well-being for your healthcare facility or practice. Join us for a comprehensive guide to successfully navigating the federal audit landscape.

February 22, 2024
Mastering Healthcare Refunds: Navigating Compliance with Confidence

Mastering Healthcare Refunds: Navigating Compliance with Confidence

Join healthcare attorney David Glaser, as he debunks refund myths, clarifies compliance essentials, and empowers healthcare professionals to safeguard facility finances. Uncover the secrets behind when to refund and why it matters. Don’t miss this crucial insight into strategic refund management.

February 29, 2024
2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

HIM coding expert, Kay Piper, RHIA, CDIP, CCS, reviews the guidance and updates coders and CDIs on important information in each of the AHA’s 2024 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.

April 15, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

SPRING INTO SAVINGS! Get 21% OFF during our exclusive two-day sale starting 3/21/2024. Use SPRING24 at checkout to claim this offer. Click here to learn more →