Breaking Compliance News Blog

No copycats: Finding your compliance voice

Posted by Margaret Scavotto, JD, CHC on 12/13/22 8:15 AM

Ask a kid what they want to be when they grow up, and you’ll hear a lot of “I want to sing like Taylor Swift!” and “I want to play football like Tom Brady!” or “I want to go to outer space like Elon Musk!”

It’s good to have a goal, and I want these kids to reach for the stars – as long as they remember what they bring to the table.

Taylor Swift, for example, is an alto. Tom Brady is a quarterback. And Elon Musk has lots of billions of dollars.

If the child is a soprano, she will never sing like Taylor Swift. Only one human in the world can be Taylor Swift. Anyone who tries to sing like Taylor Swift will inevitably fail.

The same is true for the aspiring quarterback who is also an excellent sprinter and would, in fact, make a great running back. And while you don't need billions of dollars to succeed as an entrepreneur and travel to outer space just for fun, the path might look different.

Lest you think I’m the anti-hero, keep this in mind: A child who wants to be a famous singer should use their own unique, beautiful voice. A child who wants to be a professional football player should play lots of football and figure out which position suits their natural talents. And an aspiring entrepreneur should spend their formative years learning which of their unique talents are most likely to translate into a successful business venture.

Cover bands don’t get record deals.

It’s good to have role models and to look elsewhere for inspiration. But what we bring to the table comes from within, that uniqueness, should not be underestimated.

A new Compliance Officer inheriting a decades-old compliance program from an experienced predecessor should soak up the lessons that are handed down. But the new professional should not stop there. He or she should also look inward and ask: What do I bring to this job? What ideas and strengths do I have that will make this program into something new?

New eyes often provide a fresh perspective. What can you change for the better?

Read More

Topics: Compliance Officer & Committee, compliance

Understaffing increases cybersecurity risk

Posted by Scott Gima on 12/6/22 10:21 AM

Workforce statistics: An (ISC)2 workforce survey of 11,779 cybersecurity practitioners and decision makers reported strong increases in cybersecurity workers:

  • The US cybersecurity workforce increased by 5.5% between 2021 and 2022.
  • Globally, the increase was 11.1%, or 464,000 new workers.

But demand for cybersecurity workers increased almost twice as fast resulting in an increase in need. In the US, the workforce gap increased by 9.0%. The global gap has climbed by 26.2% since 2021.

Why it matters: For organizations, unfilled cybersecurity jobs increase the risk of a successful cyber event. The (ISC)2 survey identified multiple staffing related problems:

  • 70% of organizations don’t have enough cybersecurity staff to be effective.
  • More than half believe their organization is at a “moderate” or “extreme” risk of cyberattack.
  • Oversights in certain procedures have been made.

These vulnerabilities worsened in 2022:

  • Not enough time for proper risk assessment and management
  • Oversights in process and procedure
  • Slow to patch critical systems
  • Not enough time to adequately train each cybersecurity team member and not enough training resources
  • Misconfigure systems

The top four reported reasons for the shortage:

  • 43% - my organization can’t find enough qualified talent.
  • 33% - My organization is struggling to keep up with turnover and attrition.
  • 31% - My organization doesn’t pay a competitive wage.
  • 28% - My organization doesn’t have the budget.

Tackling the problem: Multiple strategies were identified by the (ISC)2 survey. While all had a positive impact, some were more effective. Organizations that focused on training were least likely to have staffing shortages. These organizations focus on rotating job assignments, mentorship programs and encouraging employees outside of cybersecurity to join the field. Organizations that outsourced cybersecurity showed a higher percentage of staffing shortages. Effective strategies include the following:

Read More

Topics: HIPAA, security, compliance

Making Recognized Security Practices work for you

Posted by Scott Gima on 11/30/22 10:15 AM

One Big Thing

IImplementation of Recognized Security Practices (RSPs) for at least 12 months provide covered entities and business associates with the opportunity to reduce fines and penalties for violations of the HIPAA security rule.

Background

On January 5, 2021, Congress passed an amendment to the HITECH Act that requires the OCR to take into account the Recognized Security Practices of covered entities and business associates when they are able to show that RSPs have been in use for the 12 months prior to a HIPAA breach incident.

If RSPs are in place, the OCR may mitigate fines and remedies and allow an early and favorable termination of an audit..

Over the past months, the amendment has generated questions related to the uncertainty about what constitutes RSPs, and how to demonstrate their implementation. In response, on October 31, 2022, HHS-OCR released a video that addresses some of these concerns about RSPs.

What Are Recognized Security Practices?

Read More

Topics: HIPAA, security, compliance

*Free Issue* MPA’s Compliance and HIPAA News Reports

Posted by Margaret Scavotto, JD, CHC on 11/29/22 11:31 AM

Read More

Topics: Training and Education, compliance

Health System Ransomware Attack Lingers…

Posted by Scott Gima on 11/22/22 10:08 AM

CommonSpirit hospitals reported IT issues on October 3rd with a response that included taking systems offline, including their electronic medical records. CommonSpirit has 140 hospitals in 21 states.

According to Healthcaredive.com, based on website information, hospitals in seven states have been impacted. Scheduling issues and procedure delays have been reported.

Systems being restored. On November 9, CommonSpirit announced that it continued to “work diligently to bring systems online and restore functionality as quickly and safely as possible, including electronic health records….” We know that, after the attack, many clinicians were unable to access medical records, and patient access to the MyChart portal was impacted.

Why it matters: There are no details on whether there has been a data breach of PHI – CommonSpirit says a forensic investigation is ongoing. But the news reports provide a clear picture of the operational impact that occurs in response to a ransomware attack – IT systems and applications have to be taken down to contain the impact or spread of the attack.

Security risk analysis and business continuity planning. A business continuity plan prepares your organization to respond quickly with temporary procedures and measures to continue key operational tasks and get systems back online as quickly as possible.

What to do: Identify and prioritize tasks that include but are not limited to electronic medical records (scheduling, documentation, orders, medications, and communication), communication, payroll, billing, collections, and food and supply ordering.

Every critical task must be reviewed to minimize patient risk. For example: a new medication order. What steps are now needed to get a new medication order from the physician to the bedside? Will human runners be needed? How and who will review, transcribe, and double check orders to prevent errors?

Email – don’t under estimate its impact. Business continuity takes a hit when email is inaccessible. Is your inbox your de facto “to do” list? Imagine how you are going to be able to tackle routine tasks without access to your inbox. Don’t overlook other email folders, as well as the inability to communicate by email for at least a couple of weeks if not longer….

Read More

Topics: HIPAA, security, compliance

Carrie Zombies: Compliance Lessons from the Bike Rodeo

Posted by Margaret Scavotto, JD, CHC on 10/31/22 11:45 AM

Read More

Topics: Culture of Compliance, compliance

*Free Issue* MPA’s Compliance and HIPAA News Reports

Posted by Margaret Scavotto, JD, CHC on 10/27/22 12:06 PM

Read More

Topics: Training and Education, compliance

Earn CEUs with MPA's FREE Compliance Culture Webinar!

Posted by Margaret Scavotto, JD, CHC on 10/25/22 1:31 PM

 

 

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

 

We hope you can join us for our final webinar of 2022:

 

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

Boeing. Theranos. The Challenger space shuttle.
 
Every compliance program needs policies, training, reporting, leadership and audits to succeed – but it’s not enough. Federal guidance makes clear that an effective compliance program requires a strong culture to support it. Practical experience also teaches us that culture will make or break a compliance program.
 
We will walk through proven strategies you can take at the employee, management and board levels to cultivate a compliance culture that takes your company in a direction of employee trust, internal reporting, audits with integrity, and compliance strength.
 

 

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

Read More

Topics: Training and Education, HIPAA, compliance

$5 Million hospice therapy false claims settlement

Posted by Scott Gima on 10/18/22 11:50 AM

A whistleblower complaint by a hospice employee led to a $5.59 million settlement. Allegations include:
Read More

Topics: Compliance Basics, Penalties and Enforcement, false claims, hospice

Earn CEUs with MPA's FREE Compliance & HIPAA Webinars!

Posted by Margaret Scavotto, JD, CHC on 10/13/22 10:14 AM

 

 

Sign up for MPA's FREE Compliance & HIPAA webinars:

All webinars start at 11:00 a.m. CST  and are presented by Margaret Scavotto and Scott Gima

 

Top Privacy and Security Risks that Can Lead to HIPAA Violations

October 19, 2022

60 minutes

1.2 CCB CEUs

HIPAA breaches can occur everywhere. They come from conversations, from TikTok, from hackers, and from tricky phishing emails. They come from the employee down the hall, from hackers across the country, and from overseas. Later today or tomorrow, there will be new sources of potential HIPAA breaches.

The only way to stay one step ahead is to know and understand the trends and use that knowledge to develop, update or refine your HIPAA security program to mitigate the risk in your organization. Think – Security Risk Assessment and Management Plan. We will walk through top privacy and security risks that can lead to HIPAA violations – and discuss strategies to do something about them.

SIGN UP

 

Compliance Culture Lessons from the Headlines

November 9, 2022

90 minutes

1.8 CCB CEUs

Boeing. Theranos. The Challenger space shuttle.
 
Every compliance program needs policies, training, reporting, leadership and audits to succeed – but it’s not enough. Federal guidance makes clear that an effective compliance program requires a strong culture to support it. Practical experience also teaches us that culture will make or break a compliance program.
 
We will walk through proven strategies you can take at the employee, management and board levels to cultivate a compliance culture that takes your company in a direction of employee trust, internal reporting, audits with integrity, and compliance strength.
 

 

The Compliance Certification Board (CCB)® has approved these events for up to 1.8 and 1.2 Respectively/ live CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.”

Read More

Topics: Training and Education, HIPAA, compliance

    Privacy Policy           Terms of Use