August 17, 2017

Preparing for a Cyber Security Audit: Part X

By

EDITOR'S NOTE: Edward Roche, in association with RACmonitor, is writing a series of articles on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the tenth installment in the series.

The U.S. Department of Health and Human Services (HHS) recently defined a security rule formally known as its Security Standards for the Protection of Electronic Protected Health Information (e-PHI).

This rule sets standards for information and communications technology (ICT) in any healthcare organization. Compliance with the rule is mandatory. Enforcement powers of the government are codified at 45 C.F.R. Part 160, Subparts C, D, and E. If there is a violation, then civil money penalties (CMP) may be imposed.

One part of the rule calls for identification of and protection against “reasonably anticipated threats to the security or integrity” of e-PHI. What does “reasonably anticipated” mean? In particular, does it refer only to the psychological side of “anticipation,” or does it translate deeper into organizational actions?

Here, we will argue that “reasonably anticipate” means not only the purely psychological side, but it also implies that your organization must take specific tangible steps to anticipate a ransomware or other form of cyberattack, and effectively deal with it should it occur.

Preparing for a Cyber Audit

In previous articles in this series, we have reviewed the high-level steps of a cyber audit. First comes a “desk audit,” in which the healthcare provider is given a number of questions that must be answered in writing within 10 business days. Second, it is possible for certain providers to be chosen for more in-depth, on-site audits that can last for 3-5 days. Third, if necessary, the organization can be subjected to even more detailed audits that may lead to penalties.

Section §160.410 of this rule sets forth the “affirmative defenses” that might be used by the healthcare provider. For example, the provider might attempt to show that it demonstrated “reasonable diligence” in combatting hacking. What follow are a few of the steps that might be taken to demonstrate “reasonable diligence” in protecting against malware attacks.

Tabletop Exercise 

The tabletop exercise is a simulation of how your organization would respond to a cyberattack. The U.S. Department of Homeland Security offers generous documentation on how to conduct these exercises. In addition, there are a number of commercial security consulting organizations that can help you conduct this type of drill – for a fee.

The purpose of the tabletop is twofold: First, it is designed to raise awareness of the issues that must be dealt with, and to clarify who is responsible for handling them; second, it is designed to find glitches or flaws in how the organization responds. These glitches are particularly important to understand because only once they are identified, they can be fixed.

In many cases, a tabletop exercise is the first time an organization is forced to think through how it might respond to a cyberattack, and who is responsible for doing what.

Document Everything

The entire tabletop exercise and all of the details must be scrupulously documented. Of particular concern is documentation of any issues found in the organizational response, and exactly what steps were taken to rectify the problem(s) and mitigate the potential for serious damage.

For even the most hard-headed auditor, it is music to the ears to see well-organized documentation illustrating how your organization has been systematic in anticipation of a threat and responsible in the formulation of an effective response.

Strictly Enforce Security Protocols

The auditors will be looking not only for security protocols that are on the books – everyone has those – but also for evidence that the protocols are being used. Because of this, it is necessary to maintain a log of every single breach of a security protocol, including the date, time, systems affected, persons involved, how it was discovered, and what actions were taken to make sure it does not happen again.

It goes without saying, however, that in order to enforce a security protocol, an organization must have one in the first place, and everyone must understand how it applies to them personally.

Book of Security Protocols

Your organization should be able to present documentation of each security protocol. This includes how to log on to a system, how to log off, how to choose passwords, how to keep passwords safe, how to respond to phishing emails, how to handle email attachments, and so on.

Not only is it necessary to have complete documentation of your security protocols, but it also is useful to have documentation verifying that each employee in the organization is fully aware of all protocols that they might need in the event of a security breach.

Standing Patient Notification Protocol

In the case of any substantial security breach, your organization will be required to notify patients that their records have been compromised. In order to prepare for this, your organization must have documentation of drafts of the notification letter, with specification of the principles that will govern exactly when (and to whom) notifications will be sent.

Documentation of Security Maintenance 

Each modification or maintenance made to your information system with an aim of improving cyber security must be completely documented. In particular, there must be a clean record showing the date, time, and other report of any security patch that is applied to your information system.

After all, it is difficult to conclude that an organization is not taking “reasonable steps” towards effective cyber security when the documentation shows otherwise.

In some cases, an information systems organization may resist the adding of an additional “bureaucratic” step of recording their every move, but be assured, it is necessary, because it proves due diligence on the part of your organization.

Preparing for a cyber audit involves taking tangible steps to improve the security of your information system. But being secure is not adequate, for the purposes of an audit.

Instead, it is necessary to be able to show documentation of everything you have done. In this way, you can feed the audit monster before it bites off your hand.

In future issues of this series, we will go into greater detail about cyber audits.

Edward Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

This email address is being protected from spambots. You need JavaScript enabled to view it.

Related Articles

  • How Coding Errors Lead to Overpayment Recoveries
    CMS offers advice through its Medicare Learning Network Connects bulletin to avoid coding errors. Mistakes happen, and errors do occur in the coding industry. The May 24 Centers for Medicare and Medicaid Services (CMS) Medicare Learning Network (MLN) Connects bulletin…
  • Analysis: Bias Alleged in Extrapolation Audits
    Improper use of extrapolation statistics is stunningly egregious, according to the author. Over the years, I have written extensively about the statistical extrapolations that are a large part of the audit process. In general, auditors—both government and private—make use of…
  • Feds Propose Delay of 340B Enforcement Rules
    HRSA claims delay will have no impact on current stakeholders. The Health Resources and Services Administration (HRSA), which administers Section 340B of the Public Health Service Act, has published a proposal to delay for another year the ceiling price and…