Today, we are talking about a new OCR settlement that was released from a 2016 hacking attack on Banner Health’s network, causing a data breach of over 2.81 million individuals. We’ll review the OCR CAP. But suffice it to say… until we have more engagement from every person connecting to the internet, we will never make real progress in the battle against cyber criminals.
In this episode:
OLD Attack NEW Settlement – Ep 394
Today’s Episode is brought to you by:
Kardon
and
HIPAA for MSPs with Security First IT
Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity.
The Privacy and Security Boot Camp
3.5 day In Person Event
Mar 12, 13, 14 and 15, 2023
PriSecBootCamp.com
Great idea! Share Help Me With HIPAA with one person this week!
Learn about offerings from the Kardon Club
and HIPAA for MSPs!
Thanks to our donors. We appreciate your support!
If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com
Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA
If you see a couple of numbers on the left side you can click that and go directly to that part of the audio. Get the best of both worlds from the show notes to the audio and back!
OLD Attack NEW Settlement
[05:15] Banner Health is the largest employer in Arizona, and one of the largest in northern Colorado. They had a data breach resulting from a hacking incident by a threat actor in 2016 which disclosed the PHI of 2.81 million consumers. OCR just announced a settlement with them that includes a whopping $1.25 million payment and a 2 Year CAP.The “potential” violations specifically include:
- “Lack of an analysis to determine risks and vulnerabilities to electronic protected health information across the organization” Lack of an SRA. Shocking – I know.
- “Insufficient monitoring of its health information systems’ activity to protect against a cyber-attack, failure to implement an authentication process to safeguard its electronic protected health information” No monitoring – Check the box and wait until next year’s compliance approach.
- “Failure to have security measures in place to protect electronic protected health information from unauthorized access when it was being transmitted electronically.” Failure to encrypt in transit.
Usually the press release ends with standard language. But the language has now changed to include the following statement:
What’s in the CAP?
[28:41] Banner Health Resolution Agreement and Corrective Action Plan | HHS.govIn the press release it includes a summary of the CAP requirements. I personally am excited to see this because the CAP was so often hidden and not discussed other than the fact it existed. Here is the bullet list of steps Banner agreed to follow:
- Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic patient/system data across the organization
- Develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI
- Develop, implement, and distribute policies and procedures for a risk analysis and risk management plan, the regular review of activity within their information systems, an authentication process to provide safeguards to data and records, and security measures to protect electronic protected health information from unauthorized access when it is being transmitted electronically, and
- Report to HHS within thirty (30) days when workforce members fail to comply with the HIPAA Security Rule.
Let’s break that out to bullets shall we…
Incorporate All:
- Electronic equipment
- Data systems
- Programs
- Applications
That are
- controlled,
- administered,
- owned,
- shared
By Banner or its affiliates that Banner
- owns
- controls
- manages
That
- contain,
- store,
- transmit
- or receive Banner ePHI
Banner will then include a complete inventory of all
- electronic equipment,
- data systems,
- off-site data storage facilities,
- and applications
- contain or store ePHI
A paragraph looks like a bunch of words but when you break it down like this, you see just what is expected in an SRA by OCR.
So, go take a look at the information in this settlement. Share it with others. Use it in meetings or discussions or presentations. OCR’s CAPs always have good information explaining what’s important and what you should be doing and what to document.
Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!
HIPAA is not about compliance,
it’s about patient care.TM
Special thanks to our sponsors Security First IT and Kardon.
