4.5 NAB CEUs!
4 AHIMA CEUs!
April 26th, 9:00 a.m. to 2:00 p.m. CST
Read More
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, Social Media, security, breach notification, privacy, webinar
Everyone knows email phishing scams are common. A CISA advisory provides details of a new email phishing scam that uses remote management software to steal money.
According to a recent Cybersecurity and Infrastructure Security Agency (CISA) joint advisory, the attacks were directed at federal civilian employees. But it is noteworthy because similar strategies can be used to target
anyone, including healthcare providers.
On January 25, 2023, the Cybersecurity and Infrastructure Security Agency released a
National Cyber Awareness System Alert, “Protecting Against Malicious Use of Remote Monitoring and Management Software” jointly with the National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC).
Why the Alert?
- The attackers recently used phishing emails to gain access to a victim’s computer using legitimate remote monitoring and management (RMM) software in financial schemes.
- The same tactics can be used for other purposes such as cybersecurity attacks or network backdoor access to conduct cyber espionage.
- Attackers use legitimate remote management software that cannot be detected by normal security measures that prevent unauthorized software installation.
What is portable executable RMM software?
- RMM software is commonly used by IT departments and managed service providers to provide remote technical support and troubleshooting.
- Every managed service provider and IT department use RMM software.
Background of Attacks
- In mid-June 2022, a federal civilian employee received a phishing email containing a phone number.
- The employee called the number, which led them to visit the malicious domain, myhelpcare[.]online. CISA found additional similar attacks on multiple federal civilian department networks.
- Attacks also used emails with a malicious link that downloaded the RMM software.
- The CISA alert mentioned that legitimate RMM software vendors AnyDesk and ScreenConnect were identified in these attacks. CISA indicated that any legitimate RMM software can be used in these types of attacks.
The CISA alert provided a copy of an actual phishing email. It includes urgency (response needed within 24 hours), a common theme of phishing emails:
0 Comments Click here to read/write comments
Topics: HIPAA, data breach, security
Read More
1 Comment Click here to read/write comments
Topics: Training and Education, HIPAA, Social Media, security, breach notification, privacy, webinar
The scheme
- 25 people were charged with wire fraud – administrators and employees of three Florida nursing schools as well as recruiters.
- The recruiters sought out individuals that were willing to pay $10,000 to $15,000 for fake nursing school documents that allowed them to take national nursing licensure examinations.
- A total of 7,600 fake nursing diplomas and transcripts (completion of required courses and clinicals) were provided to individuals from all over the US. The buyers wanted to take licensing exams to become registered nurses, licensed practical nurses, or licensed vocational nurse licenses.
- The three now closed nursing schools that issued the fake documents were Siena College, Sacred Heart International Institute, and Palm Beach School of Nursing.
- None of the individuals that bought the fake documents have been charged (yet).
Why is this Important?
- In a NY Times article, the special agent in charge for the Miami region of the Office of Inspector General said approximately 2,800 buyers passed the licensure exam.
- A large percentage of the 2,800 that passed are working.
- The NY Times article stated that providers that hired these nurses “included Veterans Affairs hospitals in Maryland and New York, a hospital in Georgia, a skilled nursing facility in Ohio, a rehabilitation center in New York and an assisted-living facility in New Jersey.”
What to do?
0 Comments Click here to read/write comments
Topics: HIPAA, data breach, security
The OCR notes serious concerns with Banner Health’s pervasive noncompliance with the HIPAA Security Rule
Banner Health
- OCR’s investigation of Banner’s data breach in 2016 found evidence of long-term, pervasive noncompliance with the HIPAA Security Rule across Banner Health’s organization, a serious concern given the size of this covered entity.
- Banner Health is one of the largest non-profit health systems in the country, with over 50,000 employees and operating in six states.
Findings
- No analysis to determine risks and vulnerabilities to electronic protected health information (ePHI) across the organization
- Insufficient monitoring of its health information systems’ activity to protect against a cyber-attack
- Failure to implement an authentication process to safeguard its ePHI
- Failure to have security measures in place to protect ePHI from unauthorized access when transmitted electronically
The Attack
- Banner Health discovered unauthorized access to process payment card data at some Banner Health food and beverage locations during a two-week period in June and July 2016.
- The attackers targeted payment card data, including cardholder name, card number, expiration date, and internal verification code, as the data was being routed through affected payment processing systems.
- Banner Health learned that attackers accessed patient information, health plan member and beneficiary information, and physician and other healthcare provider information.
- The attack hit 27 locations and 3.7 million individuals.
Why is this Important?
- The OCR indicated that hacking is the largest threat to ePHI, with 74% of 2021 reported breaches involving hacking/IT incidents.
- This settlement and corrective action plan remind us that healthcare providers must take action to protect the privacy and security of PHI. It is just as important to document all measures taken to secure ePHI.
- The corrective action plan states that Banner must do the following to address the findings of the OCR’s investigation:
- Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic patient/system data across the organization.
- Develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
- Develop, implement, and distribute policies and procedures for a risk analysis and risk management plan, the regular review of activity within their information systems, an authentication process to provide safeguards to data and records, and security measures to protect electronic protected health information from unauthorized access when it is being transmitted electronically.
What you should do
(Hint: Turn Banner’s Corrective Action Plan into a checklist)
0 Comments Click here to read/write comments
Topics: HIPAA, data breach, security
Sign up for MPA's FREE Compliance & HIPAA webinars:
All webinars start at 11:00 a.m. CST and are presented by Margaret Scavotto and Scott Gima
Plan a Successful Compliance Week in 2023
February 22, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
Your compliance program is only as strong as the culture behind it - and the knowledge and buy-in of
your team. It takes year-round activities and awareness to support that culture. In this webinar, we will discuss approaches to plan a fun and engaging Compliance Week for your staff. Whether it's been a year since you held Compliance Week - or whether compliance has been back-burnered during the pandemic and your culture needs a boost - it's time to schedule a Compliance Week!
Learn how to plan a Compliance Week that includes employee feedback, and reinforces compliance as a positive force in your organization.
This program has been approved for Continuing Education for 1.5 total participant hours by AB/NCERS—Approval #20240221-1.50-A90033-DL.
SNF Compliance Update
April 19, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
It’s been a long road since the Affordable Care Act mandated compliance and ethics programs for nursing homes in 2010. Since then, we have had rules issued; enforcement delayed; a pandemic; and, as of October 24, 2022, enforcement via CMS survey. Compliance is never easy in the highly regulated world of long-term care – but it has only gotten harder since this mandate was announced.
In this webinar, we will discuss the status of compliance and ethics programs for nursing homes; review other reasons to comply (DOJ, OIG, OCR, etc.); walk through a step-by-step process to implement or review your program; and identify best practices for a compliance program that lasts.
This program has been approved for Continuing Education for 1.5 total participant hours by NAB/NCERS—Approval #20240418-1.50-A90034-DL
The Compliance Certification Board (CCB)® has approved these events for up to 1.8 ive CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, compliance
Read More
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, Social Media, security, breach notification, privacy, webinar
Sign up for MPA's FREE Compliance & HIPAA webinars:
All webinars start at 11:00 a.m. CST and are presented by Margaret Scavotto and Scott Gima
Plan a Successful Compliance Week in 2023
February 22, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
Your compliance program is only as strong as the culture behind it - and the knowledge and buy-in of
your team. It takes year-round activities and awareness to support that culture. In this webinar, we will discuss approaches to plan a fun and engaging Compliance Week for your staff. Whether it's been a year since you held Compliance Week - or whether compliance has been back-burnered during the pandemic and your culture needs a boost - it's time to schedule a Compliance Week!
Learn how to plan a Compliance Week that includes employee feedback, and reinforces compliance as a positive force in your organization.
This program has been approved for Continuing Education for 1.5 total participant hours by AB/NCERS—Approval #20240221-1.50-A90033-DL.
SNF Compliance Update
April 19, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
It’s been a long road since the Affordable Care Act mandated compliance and ethics programs for nursing homes in 2010. Since then, we have had rules issued; enforcement delayed; a pandemic; and, as of October 24, 2022, enforcement via CMS survey. Compliance is never easy in the highly regulated world of long-term care – but it has only gotten harder since this mandate was announced.
In this webinar, we will discuss the status of compliance and ethics programs for nursing homes; review other reasons to comply (DOJ, OIG, OCR, etc.); walk through a step-by-step process to implement or review your program; and identify best practices for a compliance program that lasts.
This program has been approved for Continuing Education for 1.5 total participant hours by NAB/NCERS—Approval #20240418-1.50-A90034-DL
The Compliance Certification Board (CCB)® has approved these events for up to 1.8 ive CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, compliance
Sign up for MPA's FREE Compliance & HIPAA webinars:
All webinars start at 11:00 a.m. CST and are presented by Margaret Scavotto and Scott Gima
HIPAA Security Update
January 25, 2023
90 minutes
1.8 CCB CEUs
Healthcare is the #1 target of cyber-attacks, and the threat continually increases. Your HIPAA security program is your defense, and the key to maintaining continuity of care. In this webinar, we will illustrate why the HIPAA Security Risk Analysis is the best way to identify and reduce security risks and prevent cyber-attacks. We will also address the 2021 HITECH amendment’s Recognized Security Practices for covered entities and business associates: what providers can and should implement, and how doing so can yield favorable results after a breach. This webinar will also cover new and emerging risks from the Office for Civil rights, news coverage, and best practices.
Plan a Successful Compliance Week in 2023
February 22, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
Your compliance program is only as strong as the culture behind it - and the knowledge and buy-in of
your team. It takes year-round activities and awareness to support that culture. In this webinar, we will discuss approaches to plan a fun and engaging Compliance Week for your staff. Whether it's been a year since you held Compliance Week - or whether compliance has been back-burnered during the pandemic and your culture needs a boost - it's time to schedule a Compliance Week!
Learn how to plan a Compliance Week that includes employee feedback, and reinforces compliance as a positive force in your organization.
This program has been approved for Continuing Education for 1.5 total participant hours by AB/NCERS—Approval #20240221-1.50-A90033-DL.
SNF Compliance Update
April 19, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
It’s been a long road since the Affordable Care Act mandated compliance and ethics programs for nursing homes in 2010. Since then, we have had rules issued; enforcement delayed; a pandemic; and, as of October 24, 2022, enforcement via CMS survey. Compliance is never easy in the highly regulated world of long-term care – but it has only gotten harder since this mandate was announced.
In this webinar, we will discuss the status of compliance and ethics programs for nursing homes; review other reasons to comply (DOJ, OIG, OCR, etc.); walk through a step-by-step process to implement or review your program; and identify best practices for a compliance program that lasts.
This program has been approved for Continuing Education for 1.5 total participant hours by NAB/NCERS—Approval #20240418-1.50-A90034-DL
The Compliance Certification Board (CCB)® has approved these events for up to 1.8 ive CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, compliance
Sign up for MPA's FREE Compliance & HIPAA webinars:
All webinars start at 11:00 a.m. CST and are presented by Margaret Scavotto and Scott Gima
HIPAA Security Update
January 25, 2023
90 minutes
1.8 CCB CEUs
Healthcare is the #1 target of cyber-attacks, and the threat continually increases. Your HIPAA security program is your defense, and the key to maintaining continuity of care. In this webinar, we will illustrate why the HIPAA Security Risk Analysis is the best way to identify and reduce security risks and prevent cyber-attacks. We will also address the 2021 HITECH amendment’s Recognized Security Practices for covered entities and business associates: what providers can and should implement, and how doing so can yield favorable results after a breach. This webinar will also cover new and emerging risks from the Office for Civil rights, news coverage, and best practices.
Plan a Successful Compliance Week in 2023
February 22, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
Your compliance program is only as strong as the culture behind it - and the knowledge and buy-in of
your team. It takes year-round activities and awareness to support that culture. In this webinar, we will discuss approaches to plan a fun and engaging Compliance Week for your staff. Whether it's been a year since you held Compliance Week - or whether compliance has been back-burnered during the pandemic and your culture needs a boost - it's time to schedule a Compliance Week!
Learn how to plan a Compliance Week that includes employee feedback, and reinforces compliance as a positive force in your organization.
This program has been approved for Continuing Education for 1.5 total participant hours by AB/NCERS—Approval #20240221-1.50-A90033-DL.
SNF Compliance Update
April 19, 2023
90 minutes
1.8 CCB CEUs
1.5 NAB CEUs
It’s been a long road since the Affordable Care Act mandated compliance and ethics programs for nursing homes in 2010. Since then, we have had rules issued; enforcement delayed; a pandemic; and, as of October 24, 2022, enforcement via CMS survey. Compliance is never easy in the highly regulated world of long-term care – but it has only gotten harder since this mandate was announced.
In this webinar, we will discuss the status of compliance and ethics programs for nursing homes; review other reasons to comply (DOJ, OIG, OCR, etc.); walk through a step-by-step process to implement or review your program; and identify best practices for a compliance program that lasts.
This program has been approved for Continuing Education for 1.5 total participant hours by NAB/NCERS—Approval #20240418-1.50-A90034-DL
The Compliance Certification Board (CCB)® has approved these events for up to 1.8 ive CCB CEUs based on a 50-minute hour, each. Continuing Education Units are awarded based on individual attendance records. Granting of prior approval in no way constitutes endorsement by CCB of this event content or of the event sponsor.
0 Comments Click here to read/write comments
Topics: Training and Education, HIPAA, compliance
