Community Health Systems (CHS) Breach Brings New Focus on Network Security

March 31, 2014

The recent systems breach at Community Health Systems (CHS) is a wakeup call for all medical practices to take a closer look at the strength of their network security. Virtually every medical practice utilizes some degree of Electronic Protected Health Information (ePHI) in their day-to-day operations. For example, ePHI may be contained in network servers, electronic health record systems (EHR), practice management systems, and billing records, in addition to the equipment that creates, maintains, transmits or stores ePHI. Even practices that were previously exempt from HIPAA are considered covered entities under Texas law and must protect patient data.

CSO Online, a website that provides news, analysis and research on security topics, is reporting that the Heartbleed bug is to blame for the CHS breach. In April 2014, TMLT first alerted policyholders about the dangers of the Heartbleed Bug and encouraged all practices to assess possible vulnerabilities resulting from this threat.

In wake of the CHS breach, Tony Nelson, CISSP with Artanis Solutions, Inc. has a few practical tips for practices and their IT or network administrators to consider:

Firewall Security is minimum protection for your network and an integral part of your overall defense-in-depth network security:
- Ensure your firewall rules are up-to-date and documented.
- Configure your firewall to send alerts of suspicious network traffic to your IT/network staff (e.g. suspicious network traffic).
- Firewall logs should be routinely reviewed by IT/network administrators.
Consider technology advances to detect and prevent network intrusion. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor and respond to potential malicious activity on your network.
Consider encryption of data at rest on your servers. Even if your network was hacked, an encrypted server would not allow protected or sensitive data to be accessed in a usable format.
Consider penetration testing. Penetration testing should be done annually to detect issues with network security.

The HIPAA Security Rule contains three categories of safeguard, outlined in the Security Matrix below:

Administrative
Physical
Technical

Each safeguard has a number of security standards that must be met by medical practices and their Business Associates. The HIPAA Security Rule requires a covered entity to comply with the safeguards and standards. Together with reasonable and appropriate Administrative and Physical Safeguards, successful implementation of the Technical Safeguards standards will help ensure that a covered entity will protect the confidentiality, integrity, and availability of ePHI.

The following Security Matrix is found in many HHS publications.

ADMINISTRATIVE SAFEGUARDS
Standards	Sections	Implementation Specifications (R)= Required, (A)=Addressable
Security Management Process	§ 164.308(a)(1)	Risk Analysis	(R)
		Risk Management	(R)
		Sanction Policy	(R)
		Information System Activity Review	(R)
		Information System Activity Review
Assigned Security Responsibility	§ 164.308(a)(2)
Workforce Security	§ 164.308(a)(3)	Authorization and/or Supervision	(A)
		Workforce Clearance Procedure	(A)
		Termination Procedures	(A)
Information Access Management	§ 164.308(a)(4)	Isolating Health Care Clearinghouse Functions	(R)
		Access Authorization	(A)
		Access Establishment and Modification	(A)
Security Awareness and Training	§ 164.308(a)(5)	Security Reminders	(A)
		Protection from Malicious Software	(A)
		Protection from Malicious Software
		Log-in Monitoring	(A)
		Password Management	(A)
Security Incident Procedures	§ 164.308(a)(6)	Response and Reporting	(R)
Contingency Plan	§ 164.308(a)(7)	Data Backup Plan	(R)
		Disaster Recovery Plan	(R)
		Emergency Mode Operation Plan	(R)
		Emergency Mode Operation Plan
		Testing and Revision Procedures	(A)
		Applications and Data Criticality Analysis	(A)
Evaluation	§ 164.308(a)(8)
Business Associate Contracts and Other Arrangements	§ 164.308(b)(1)	Written Contract or Other Arrangement	(R)

PHYSICAL SAFEGUARDS
Standards	Sections	Implementation Specifications (R)= Required, (A)=Addressable
Facility Access Controls	§ 164.310(a)(1)	Contingency Operations	(A)
		Facility Security Plan	(A)
		Access Control and Validation Procedures	(A)
		Access Control and Validation Procedures
		Maintenance Records	(A)
Workstation Use	§ 164.310(b)
Workstation Security	§ 164.310(c)
Device and Media Controls	§ 164.310(d)(1)	Disposal	(R)
		Media Re-use	(R)
		Accountability	(A)
		Data Backup and Storage	(A)
TECHNICAL SAFEGUARDS
Standards	Sections	Implementation Specifications (R)= Required, (A)=Addressable
Access Control	§ 164.312(a)(1)	Unique User Identification	(R)
		Emergency Access Procedure	(R)
		Emergency Access Procedure
		Automatic Logoff	(A)
		Encryption and Decryption	(A)
Audit Controls	§ 164.312(b)
Integrity	§ 164.312(c)(1)	Mechanism to Authenticate Electronic Protected Health Information	(A)
Person or Entity Authentication	§ 164.312(d)
Transmission Security	§ 164.312(e)(1)	Integrity Controls	(A)
Transmission Security	§ 164.312(e)(1)	Encryption	(A)
ORGANIZATIONAL REQUIREMENTS
Standards	Sections	Implementation Specifications (R)= Required, (A)=Addressable
Business associate contracts or other arrangements	§ 164.314(a)(1)	Business Associate Contracts	(R)
Business associate contracts or other arrangements	§ 164.314(a)(1)	Other Arrangements	(R)
Requirements for Group Health Plans	§ 164.314(b)(1)	Implementation Specifications	(R)

POLICIES AND PROCEDURES AND DOCUMENTATION REQUIREMENTS
Standards	Sections	Implementation Specifications (R)= Required, (A)=Addressable
Policies and Procedures	§ 164.316(a)
Documentation	§ 164.316(b)(1)	Time Limit	(R)
		Availability	(R)
		Updates	(R)

TMLT formed the Product Development and Consulting Services department to respond to changes in the health care industry and physician practice needs.

TMLT has invested tremendous resources in our claims and risk management services to provide expert advice to our insured physicians. One of the primary objectives of our department is to expand the access to this expertise on a fee-based consulting basis – with current policyholders and prospective clients – including developing new products to meet evolving medical professional liability market needs.

TMLT is ready to help physician practices meet with their To Do List as needed.

To Do List	Solution
POLICIES AND PROCEDURES - REVIEW AND UPDATE HIPAA and Texas Medical Privacy and Security require you to have updated policies and procedures	TMLT Privacy and Security Toolkit The toolkit guides practices with existing policies through a review and highlights what revisions need to be made. It also guides practices, just developing policies and procedures, to understand the HIPAA rules and Texas law.
NOTICE OF PRIVACY PRACTICES (NPP) - REVIEW AND UPDATE Recent changes to HIPAA (Omnibus Rule) and Texas Medical Privacy and Security require you to revise your Notice of Privacy Practices	Notice of Privacy Practices An important document that tells your patients how you will use and disclose their protected health information (PHI). Changes with Omnibus require you to review and revise your NPP. Changes to Texas law require you to notify patients if you electronically disclose PHI.
BUSINESS ASSOCIATE (BA) & BUSINESS ASSOCIATE AGREEMENT (BAA) - IDENTIFY ALL BAs & REVIEW AND REVISE BAAs BAs are now held to the same requirements under HIPAA as Covered Entities (CE)	Business Associates and Business Associate Agreements Identify all your BAs, anyone who you share your PHI with. Determine if you had an existing BAA with them prior to March 26, 2013 à if yes, you have until September 22, 2014 to get an updated BAA signed. If you did not have a BAA, get one signed as soon as possible. Learn more about BAs and BAAs in TMLT’s Privacy and Security Toolkit.
SECURITY RISK ANALYSIS	TMLT staff can conduct a Security Risk Analysis for your practice. Security Rule requires a Risk Analysis if you do electronic billing or have EHR. Meaningful Use requires a Risk Analysis annually.
TRAINING Physician and Staff HIPAA Training	TMLT Privacy and Security Toolkit Includes “Introduction to Developing Physician Office Training”. TMLT can develop training for your office. Texas law is more stringent than Federal Law on training.
KNOW YOUR STATE LAW	TMLT Privacy and Security Toolkit The Comparison Tool highlights Texas and federal law differences.

To Do List

Solution

POLICIES AND PROCEDURES - REVIEW AND UPDATE

HIPAA and Texas Medical Privacy and Security require you to have updated policies and procedures

TMLT Privacy and Security Toolkit

The toolkit guides practices with existing policies through a review and highlights what revisions need to be made.
It also guides practices, just developing policies and procedures, to understand the HIPAA rules and Texas law.

NOTICE OF PRIVACY PRACTICES (NPP) - REVIEW AND UPDATE

Recent changes to HIPAA (Omnibus Rule) and Texas Medical Privacy and Security require you to revise your Notice of Privacy Practices

Notice of Privacy Practices

An important document that tells your patients how you will use and disclose their protected health information (PHI).
Changes with Omnibus require you to review and revise your NPP.
Changes to Texas law require you to notify patients if you electronically disclose PHI.

BUSINESS ASSOCIATE (BA) & BUSINESS ASSOCIATE AGREEMENT (BAA) - IDENTIFY ALL BAs & REVIEW AND REVISE BAAs

BAs are now held to the same requirements under HIPAA as Covered Entities (CE)

Business Associates and Business Associate Agreements

Identify all your BAs, anyone who you share your PHI with.
Determine if you had an existing BAA with them prior to March 26, 2013 à if yes, you have until September 22, 2014 to get an updated BAA signed.
If you did not have a BAA, get one signed as soon as possible.
Learn more about BAs and BAAs in TMLT’s Privacy and Security Toolkit.

SECURITY RISK ANALYSIS

TMLT staff can conduct a Security Risk Analysis for your practice.
Security Rule requires a Risk Analysis if you do electronic billing or have EHR.
Meaningful Use requires a Risk Analysis annually.

TRAINING

Physician and Staff HIPAA Training

TMLT Privacy and Security Toolkit

Includes “Introduction to Developing Physician Office Training”.
TMLT can develop training for your office.
Texas law is more stringent than Federal Law on training.

KNOW YOUR STATE LAW

TMLT Privacy and Security Toolkit

The Comparison Tool highlights Texas and federal law differences.

For additional information on TMLT’s Toolkit, Risk Analysis or consulting services; call Stephanie Downing at 1-800-580-8658.

Community Health Systems (CHS) Breach Brings New Focus on Network Security

Previous Article

Next Article

Community Health Systems (CHS) Breach Brings New Focus on Network Security

Previous Article

Next Article

Most Recent Articles

If you suspect one of your patients may harm himself or others, can you report your suspicions to the police without violating patient privacy?

Learn the top violations that prompt investigations of medical spas, according to the American Med Spa Association.

A practice’s technology services or products can cause errors and omissions (E&O) that could lead to claims, including bodily injury to others.

With the growing popularity of medical spas comes an increased risk of malpractice lawsuits for physicians who offer medical spa services within their practices.

Approximately 100 million people in the U.S. had their personal information obtained by a software engineer who gained unauthorized access to Capital One credit card applications and customer data.

Allergan announced that they are recalling Biocell textured breast implants from the global market.

TMLT CEO Robert Donohoe on TMLT's 40th anniversary.

New legislation places a 10-day limit on opioid prescriptions for acute pain.

The requirement for Texas physicians to check the Texas Prescription Monitoring Program before prescribing certain controlled substances has been delayed until March 20.

In Texas, health care liability claims have their own statutes of limitations and how these laws are applied can be tricky.

This article explores the topic of suicide, particularly risk management considerations and legal implications for physicians and health care providers treating potentially suicidal patients.

An ob-gyn based in Austin, Texas, discusses her work to increase awareness of human trafficking in health care settings.

Physicians received a fraudulent questionnaire asking for confidential information.

More on the FDA's announcement to halt sales of transvaginal mesh products

Dr. Milman co-teaches TMLT’s 2019 summer CME seminar series in San Antonio and Forth Worth.

From a legal and liability perspective, a “medical director” is a physician who serves in an administrative capacity as head of an organized medical staff

Learn about employment and human resources issues through the EPLI Pro website.

HHS released voluntary cyber security practices to the health care industry with the aim of providing practice guidelines to reduce cyber security risks.

Texas physicians will be required to use new schedule II prescription forms beginning June 1, 2019.

A company by any other name is not the same.