Breaking Compliance News Blog

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

Top Privacy and Security Risks that Can Lead to HIPAA Violations

October 19, 2022

60 minutes

1.2 CCB CEUs

HIPAA breaches can occur everywhere. They come from conversations, from TikTok, from hackers, and from tricky phishing emails. They come from the employee down the hall, from hackers across the country, and from overseas. Later today or tomorrow, there will be new sources of potential HIPAA breaches.

The only way to stay one step ahead is to know and understand the trends and use that knowledge to develop, update or refine your HIPAA security program to mitigate the risk in your organization. Think – Security Risk Assessment and Management Plan. We will walk through top privacy and security risks that can lead to HIPAA violations – and discuss strategies to do something about them.

SIGN UP

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

A compliance officer recently asked me: How much do healthcare providers typically budget for compliance?

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

Compliance Training for SNFs

September 21, 2022

90 minutes

1.8 CCB CEUs

If the OIG walked into your organization and asked the nearest employee about their compliance program, would they reply with an immediate and clear answer? An awkward pause? An “I don’t know”?

For your employees to pass this test, your compliance program needs a strong training program. A PowerPoint slide presentation at hire and annually is not enough. Training should occur year-round and training programs must include the board, contractors and volunteers

This webinar will provide you with easy-to-use strategies for building an enduring, effective compliance training program.

SIGN UP

Top Privacy and Security Risks that Can Lead to HIPAA Violations

October 19, 2022

60 minutes

1.2 CCB CEUs

HIPAA breaches can occur everywhere. They come from conversations, from TikTok, from hackers, and from tricky phishing emails. They come from the employee down the hall, from hackers across the country, and from overseas. Later today or tomorrow, there will be new sources of potential HIPAA breaches.

The only way to stay one step ahead is to know and understand the trends and use that knowledge to develop, update or refine your HIPAA security program to mitigate the risk in your organization. Think – Security Risk Assessment and Management Plan. We will walk through top privacy and security risks that can lead to HIPAA violations – and discuss strategies to do something about them.

SIGN UP

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

Compliance Training for SNFs

September 21, 2022

90 minutes

1.8 CCB CEUs

If the OIG walked into your organization and asked the nearest employee about their compliance program, would they reply with an immediate and clear answer? An awkward pause? An “I don’t know”?

For your employees to pass this test, your compliance program needs a strong training program. A PowerPoint slide presentation at hire and annually is not enough. Training should occur year-round and training programs must include the board, contractors and volunteers

This webinar will provide you with easy-to-use strategies for building an enduring, effective compliance training program.

SIGN UP

Top Privacy and Security Risks that Can Lead to HIPAA Violations

October 19, 2022

60 minutes

1.2 CCB CEUs

HIPAA breaches can occur everywhere. They come from conversations, from TikTok, from hackers, and from tricky phishing emails. They come from the employee down the hall, from hackers across the country, and from overseas. Later today or tomorrow, there will be new sources of potential HIPAA breaches.

The only way to stay one step ahead is to know and understand the trends and use that knowledge to develop, update or refine your HIPAA security program to mitigate the risk in your organization. Think – Security Risk Assessment and Management Plan. We will walk through top privacy and security risks that can lead to HIPAA violations – and discuss strategies to do something about them.

SIGN UP

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

Compliance Training for SNFs

September 21, 2022

90 minutes

1.8 CCB CEUs

If the OIG walked into your organization and asked the nearest employee about their compliance program, would they reply with an immediate and clear answer? An awkward pause? An “I don’t know”?

For your employees to pass this test, your compliance program needs a strong training program. A PowerPoint slide presentation at hire and annually is not enough. Training should occur year-round and training programs must include the board, contractors and volunteers

This webinar will provide you with easy-to-use strategies for building an enduring, effective compliance training program.

SIGN UP

Top Privacy and Security Risks that Can Lead to HIPAA Violations

October 19, 2022

60 minutes

1.2 CCB CEUs

HIPAA breaches can occur everywhere. They come from conversations, from TikTok, from hackers, and from tricky phishing emails. They come from the employee down the hall, from hackers across the country, and from overseas. Later today or tomorrow, there will be new sources of potential HIPAA breaches.

The only way to stay one step ahead is to know and understand the trends and use that knowledge to develop, update or refine your HIPAA security program to mitigate the risk in your organization. Think – Security Risk Assessment and Management Plan. We will walk through top privacy and security risks that can lead to HIPAA violations – and discuss strategies to do something about them.

SIGN UP

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

What is Callback Phishing?

CrowdStrike, a third-party cybersecurity firm, recently disclosed a new phishing tech support campaign. Hackers send out a fake email from a reputable cybersecurity firm (like CrowdStrike). The email falsely claims your business had a cybersecurity event and is working with the company’s security department to address a possible issue with the employee’s workstation. The letter asks the employee to urgently call a provided phone number to resolve the issue on their workstation.

If a call is made, the hackers will trick the caller into installing remote desktop software. Once given access, the hacker now has access to the user’s workstation and will attempt to move through the network to initiate a ransomware attack.

A New Version of an Old Scam

This tech support phishing attack is a new twist on an old scam. A May 2022 blog post discussed a FTC alert on Senior Tech Support Scams, which happened to a family member.

It is highly likely that these emails will get into an inbox because they contain no malicious links or attachments which diminishes the effectiveness of spam or anti-phishing filters.

Use your HIPAA training program to increase awareness

Training and education is the most effective method to prevent callback phishing attempts. A phishing reporting policy may be a worthwhile addition to your HIPAA and/or cybersecurity policies. Here are some simple training reminders:

• Do not call the number provided. Assume any email from a well-known cybersecurity firm like CrowdStrike is a phishing email, especially if the email alleges a breach of your environment and requests an urgent call back.
• Follow your organization’s phishing reporting policy. Call or forward the email to your Security Officer and/or IT department and let them handle the matter. If it is legitimate, they will let you know.
• Pat yourself on the back, you just prevented a phishing attack.

Update your HIPAA Security Risk Analysis

Revisit and update your HIPAA Security Risk Analysis. Add callback phishing as a threat where appropriate. Document your anticipated mitigation strategies including training. Lastly, document when each mitigation effort has been implemented, and include dates so progress can be easily understood.

MPA can handle your HIPAA Security Risk Analysis

The HIPAA Security Risk Analysis is a lot to tackle. We all know it’s even more challenging to accomplish during COVID times. MPA can conduct your HIPAA Security Risk Analysis, saving you time and improving your security. Reply to this email to learn more information.

MPA scours OIG, DOJ, FBI, OSHA, & OCR updates so you don't have to.

We summarize enforcement trends and deliver the latest compliance and HIPAA developments to your inbox with our Monthly Compliance News Report.

Read MPA’s News Report to stay current with compliance news and developments. Then, forward the News Report (or excerpts) to your Board, Compliance Committee, and management team, to keep them informed with little effort. MPA’s clients use the News Report to find ideas for compliance and HIPAA training, and identify areas where policies or audits are needed.

This month’s issue includes:

• A summary of the 48 OIG health care fraud enforcement cases announced last month
• Examples of False Claims, Kickback, opioid, and state enforcement from last month
• Items added to the OIG Work Plan  
• The latest OIG Advisory Opinion
• Twelve new HIPAA enforcements
• OCR guidance on nondiscrimination in telehealth
• The OIG's audit report of nursing home life safety and emergency preparedness noncompliance
• An update on the Uber breach
• Updates to Medicare's Care Compare website
• ... and more!
• You can read a sample report here. 

Price: $300/year

Cancel any time.

Subscribe today

The HIPAA Security Rule requires covered entities and business associates to complete a HIPAA Security Risk Analysis, and to periodically update it. Per industry standards, the Security Risk Analysis should be updated annually at the very minimum.

When investigating a breach, the OCR also reviews the organization’s compliance with the HIPAA Security Rule. One of the OCR’s top findings is the failure to conduct and/or update a comprehensive risk analysis.

In a recent interview, Lisa Pino, HHS OCR Director stated: “We are a law enforcement agency and we have to instill that sense of accountability when obligations of the law are not in compliance.” And that “hacking and IT incidents are still a growing threat.” She goes on to state that “this is really a time for organizations to bolster their security profile. This is an opportunity for them to reset and really establish, if not already, an enterprise-wide risk analysis instead of a reactive stance… an ongoing risk management is a must from a business perspective.”

Most entities failed OCR audit of risk analysis

Pino also referenced the OCR’s 2016-2017 HIPAA Audit Industry Report released in December 2020. She points out that the report provides valuable information that is still relevant today. In that report, the OCR found that only 14% of covered entities “are substantially fulfilling their regulatory responsibilities to safeguard ePHI they hold through risk analysis activities.”

For the 86% of covered entities who failed to meet risk analysis requirements, there were some common issues:

• “Some entities provided irrelevant documentation, such as a document that describes a patient’s insurance prescription coverage and rights; a document that discusses pharmacy fraud, waste and abuse; and a conflict of interest and code of conduct employee sign-off page.”
• "Providers commonly submitted documentation of some security activities of a third-party security vendor, but no documentation of any risk analysis that served as the basis of the activities.”
• "Entities offered third party template policy manuals that contain no evidence of entity-specific review or revision and no evidence of implementation."

If you have not conducted a HIPAA Security Risk Analysis, or if it has been more than one year since you have updated yours, that’s a big risk.

Perhaps as risky as driving a vehicle without insurance. Or eating the marshmallow casserole someone plopped down on the picnic table on a hot, sunny day four hours ago.

It’s not worth the risk.

Without a current HIPAA Security Risk Analysis, organizations do not know where their security risks are – which means they are likely unmitigated. Think of it as a data breach waiting to happen.

Every day, security risks in healthcare increase:

• According to IBM’s Cost of a Data Breach 2022, the healthcare industry has had the highest average data breach cost for 12 years in a row – and the average cost of a data breach in the healthcare industry is $10.10 million

• According to the 2022 SonicWall Cyber Threat Report, ransomware attacks decreased 23% globally in the first half 2022. But, in the healthcare industry, ransomware attacks increased by 328% during this timeframe.

What’s your HIPAA breach risk tolerance?

Do you update your HIPAA Security Risk Analysis at least annually, and mitigate risks you identify in a timely manner? If so, you have reason to sleep well at night. Keep up the good work.

Or, are you more of the dangerous-casserole-taster type, operating with an outdated HIPAA Security Risk Analysis – or, worse, none at all? If so, has your organization calculated the likelihood of experiencing a breach (very high), and the expected costs of a breach (also very high)?

MPA can handle your HIPAA Security Risk Analysis

The HIPAA Security Risk Analysis is a lot to tackle. We all know it’s even more challenging to accomplish during COVID times. MPA can conduct your HIPAA Security Risk Analysis, saving you time and improving your security. Reply to this email to learn more information.

A surgeon tweeted a selfie of himself operating on a patient while wearing a bike helmet.

A dentist texted a video of himself extracting a tooth while standing on a hoverboard.

A nursing home contracted with a chicken farm for medical records shredding services.

No, I’m not making these up. They actually happened. These are all potential HIPAA violations.

And they show that HIPAA TRAINING DOES NOT HAVE TO BE BORING.

Which of the following will your staff more likely remember?

1. HIPAA stands for the Health Insurance Portability and Accountability Act, or
2. A surgeon tweeted a selfie of himself operating on a patient while wearing a bike helmet. This is a potential HIPAA issue – what if patient information, or the actual patient, was visible in the background? Selfies and patient care are a bad idea.

Definitely #2. It is more memorable, which makes it a much more effective. Why? It provides opportunities for discussion. Employees do not need to know what HIPAA stands for. Honestly, I’m not even concerned if employees spell it: HIPPA instead of HIPAA. If an employee spells it HIPPA but understands what may be potential privacy risks, training is successful. All of our clients and webinar attendees like this type of real-world training.

Let us make your HIPAA training memorable

MPA mines news stories, enforcement actions, and client experiences (don’t worry – we always keep them anonymous).. These real-world and memorable scenarios are what we put in our HIPAA training:

• Training tailored to healthcare Privacy Officers, Security Officers, board members, and employees.
• Training that is fun and interactive. We play everyone’s favorite interactive HIPAA game: “Is it a breach?!”
• Live zoom training, and also recorded trainings that you can add to your learning management system.