Page 31 - Layout 1

BUSINESS
He reviewed a number of corrective action plans mandated by the
Office for Civil Rights, whose post-breach review will begin by ex-
amining the practice’s most recent risk assessment, IT logs and per-
sonnel policy and procedure guide training records. “One
unencrypted laptop left unattended in a car,” said Robertson, “has
brought down whole enterprises.”
Tips to Staying Safe in Your Own Data
Crucial to successful responses in both cases was a close relation-
ship with their IT managed services provider. Making sure your
practice’s MSP is aware of and responsible for all of HIPAA’s Secu-
rity Rule mandates, particularly regarding anti-malware updates, soft-
ware patches and monitoring IT assurance should be part of its
business associate agreement.
GCS’s Joe Gleinser says he is asked for the best advice to those
new to the business: “First, recognize the magnitude of the risk and
build a multi-layered shield. Unfortunately, I don’t see ransomware
taken seriously at the Executive Level, but perhaps that might change
as more stories get told.”
Staff training of new security threats and email policies is vital to the name of the virus or malware; and the origin of the incident
an enhanced immune system. Says Gleinser, “We’ve responded to
more than eighty-five ransomware attacks since January 2016. Al-
most every case has been caused by a phishing attack through email.”
Unfortunately, despite strong immune systems, viruses still find a
path to infect otherwise healthy systems. An incident response plan
is needed to deal with a chaotic and calamitous situation. Adrian P.
Senyszyn, JD, who serves as attorney for ABCD Pediatrics, and is
an expert on cyber incidents, speaks to the need to preserve evidence.
“You need to help prove the low probability of compromise to pro-
tected health information.”
First, he advises, disconnect: have your IT
company disconnect your network from the In-
ternet, the more quickly, the better.
Investigate and document the incident imme-
diately. Make sure IT staff accurately document
their findings in an incident report that should
be signed and dated. Screenshots or photo-
graphs taken by cell phones will help document
evidence. Treat everything as though it was a
crime scene … it is.
If possible, have the MSP maintain the infected
IT system in a digital sandbox, neither shutting it
off nor wiping it clean. By wiping the malware
from your system, you are likely destroying the
evidence that proves the ransomware did not ex-
filtrate data to cyber criminals
Determine the scope of the incident by identifying and docu-
menting which networks, systems, or applications were affected;
or vulnerability that caused it. Staff should document information
related to the attack in separate incident reports that are signed
and dated.
You also should consider whether a forensic investigation of your
computers and servers would be appropriate.
Besides your IT manager, there are two other names at the top of
your disaster-recovery call sheet: contact your medical professional
THE LAW:
Ransomware is a HIPAA reportable incident,
regardless of whether PHI was removed from
the system.
The Office for Civil Rights (OCR) of Health
and Human Services (HHS) has made it clear:
with 4,000 daily attacks, it is a serious threat
that exploits “human and technical weak-
nesses” and “The presence of ransomware
(or any malware) on a covered entity’s or
business associate’s computer systems is a
security incident under the HIPAA Security
Rule.” (FACT SHEET: Ransomware and HIPAA
- HHS.gov)
continued on page 32
visit us at www.bcms.org 31