CPHIMS Privacy and Security - 07072016 PDF

PRIVACY/SECURITY
JULY 7, 2016
ADDI TI ONS BY JACK KOLK, CI SSP, CSSLP
CONTENT
• General
• Healthcare Environment (19)
• Technology Environment (10)
• Systems
• Analysis (14)
• Design (5)
• Selection, Implementation, Support, and Maintenance (8)
• Testing and Evaluation (3)
• Privacy and Security (6)
• Administration
• Leadership (29)
• Management (6)
3
PRIVACY & SECURITY OBJECTIVES
1. Participate in defining organizational privacy and security
requirements, policies and procedures
2. Utilize procedures and tools to identify potential privacy and security
breaches
3. Provide appropriate physical environment and safeguards to protect
assets
4. Assess privacy and security risks
5. Implement processes to mitigate privacy and security vulnerabilities
6. Manager user access control according to established policies and
procedures
7. Ensure confidentiality, integrity, and availability of data
8. Define organization roles (e.g., information security, physical security,
compliance) responsible for managing vulnerabilities
9. Develop data management controls (e.g., data ownership, criticality,
security levels, protection controls, retention and destruction
requirements, access controls)
10. Maintain disaster recovery and business continuity plans
11. Perform privacy and security audits
4
VULNERABILITIES ARE MORE COMMON
THAN YOU KNOW AND GROWING
5
VULNERABILITIES ARE MORE COMMON
THAN YOU KNOW AND GROWING
6
INTRODUCTIONS
• Multiple laws, regulations, standards for privacy and

security
• ISO
• FISMA
• HIPAA
• Gramm-Leach-Bliley (GLB) 1999
• PCI Processing Rules
• UK Data Protection Act of 1998
• European Data Protection Directive
• NIST is emerging as the de facto standard
7
PRIVACY VS SECURITY
• Privacy tends to define WHAT

• Information/data is to be held confidential and is permitted
to be disclosed to those with a need to know
• Security is the HOW
• Set forth the technical, physical and procedural controls or
limits
8
KROLL PREDICTS THAT THE NEW CYBERSECURITY
ISSUES FOR 2014 WILL INCLUDE:
9
KEY COMPONENTS OF PRIVACY LAWS
• General rules of privacy

• Individual rights
• Privacy Administration requirements
• General Security
10
GENERAL RULES OF PRIVACY
• What data is to be protected

• How data is to be used, disclosed and safeguarded
• Which organizations are affected and covered by
the rules
11
INDIVIDUAL RIGHTS
• Greater control of data by the individual

• Right of access
• Right to restrict access
• Confidential communication channels
• Accounting of disclosures
• Personal Representative
• Gains access on behalf of the individual when that person is
incapable of making decisions
12
PRIVACY ADMINISTRATIVE
REQUIREMENTS
• Designation of privacy/security officer
• Development of policies and procedures
• Processing of complaints
• Monitoring of ongoing compliance
• Training program
• Sanctions program
13
GENERAL SECURITY
• Controls of limitations on the data contained in

systems
• Controls regarding the workforce members
• Controls regarding the physical environment where
the data and people reside
14
COMPLIANCE PROCESS
• Awareness
• Assessment
• Remediation
• Maintenance
15
ASSESSMENT
• The process of identifying how an organization’s

current practices differ from international, federal
and state laws, requirements and standards
16
DOCUMENT GATHERING
• General: Organizational charts, new employee training

materials, results from the previous internal and external audits
• Workforce Information (Administrative): Employee
handbook, Security and Privacy training materials,
disclosure/sanctions policies, system use auditing and
reporting
• Physical Safeguards: Related workforce
clearance/access ability to physical structures, inventory of all
software, portable devices, media, policies/procedures
governing workstation security
• Technical Safeguards: Network diagrams,
policies/procedures defining electronic access privileges,
audit and integrity controls, authentication of person or entity,
controls for transmission security
17
GAP ANALYSIS
• Compare regulatory requirement to organization’s

current baseline
• Determine the extent of the gaps
• Identify the steps necessary to achieve compliance
18
FACILITY WALKTHROUGH
• Goal is to identify areas which could result in

unauthorized access to health information
• Terminal Access
• Facility Controls
• Employee Interviews
19
TECHNICAL BASELINE
• Identify network infrastructure, network access points

and network vulnerabilities from which to measure
compliance gaps.
• Sample techniques may include:
• Domain footprint
• Vulnerability Scans
• Ping Sweeps, Port Scans etc.
• Port scans take ping sweeps to a different level. Port scans actually
“look” at a machine that is alive and scan for an open port. Once
the open port is found, it scans the port to find the service it is
running. Once it finds the service the port is running, it gives the
intruder power and knowledge about your system.
• Password Evaluations
• Network Port Scans
20
THREATS AND VULNERABILITIES
• Identification of threats
• Identification of Vulnerabilities
• NIST ICAT vulnerability database:
• http://icat.nist.gov
• Likelihood Determination
• Impact Analysis
• Risk Determination
21
THREATS AND VULNERABILITIES
• Threats are constantly evolving, you need to keep Up!
22
REMEDIATION
• The process of closing the gaps between current

privacy and security practices and the
requirements, laws, and standards
23
POLICIES AND PROCEDURES (P&P)
• Identify representative team to develop P&P

• Collect existing P&P that relate to privacy and
security
• Identify business partners
• Interview supervisors and front line workers
• Contact trade associations, state bar, and other
sources of information on relevant regulations,
standards, and laws for your region
• Place draft P&P into customary “project plan”
process
24
PHYSICAL ENVIRONMENT
• Cleaning Personnel • Information carried

• Computer Screens between buildings
• Conversations • Key Policy
• Copying Health • PDAs
Information • Printers and Faxes
• Desks/Countertops • Record Storage
• Disposal of Paper • Workforce Vigilance
• Home Office • Visitors
25
TECHNICAL ACCESS CONTROLS
• Minimum Necessary
• Principles for Access Profiles
• Access to information must not be so restricted as to
interfere with the quality and efficiency of healthcare
• Access shall be sufficiently restricted to afford
patients’/members’ information as much privacy and
security as possible
• Modification or Termination of Access
26
DATA MANAGEMENT CONTROLS
• Device and Media Controls

• Electronic Transmission of Health Information
• Integrity
• Data Authentication Controls
• Authentication of Person or Entity
27
MAINTENANCE
• The process of maintaining compliance –

confirming that changes to policies and procedures
have actually taken place and that staff has been
trained to adhere to the new policy
28
TRAINING
• Methods of Training
• Direct review of P&P
• Powerpoint slides and lectures
• Online/automated training
• Use of examples/vignettes
• Use of video
• Training Content
• Awareness training
• Workstation use
• P&P
• Sanctions/testing
• Training Delivery Controls
29
RISK MANAGEMENT
• Risk Assessment – The process to determine initial

level of risk
• Risk Mitigation – The process to decrease the
determined level of risk
• Evaluation and Assessment – The process to monitor
and take action to maintain the decreased level of
risk
30
AUDITING/MONITORING TOOLS
• Self Audit
• Checklists
• Facility walkthroughs
• Interviews
• Report of Findings
• Areas of Non-compliance
• Corrective Action Plans
31
PRIVACY AND SECURITY INCIDENTS
• Implement Processes to:

• Respond quickly to an alleged breach
• Determine what occurred
• Prevent recurrence of any violation or policy or law
• Take steps to mitigate any harm
• Train All Workforce Members on Incident Reporting
Processes ( which needs to be in place! )
32
AUDIT TRAIL
• Provides a mechanism to monitor user activity

(accountability by individual)
• Provides a mechanism to identify suspicious activity
and/or breaches of information
• Provides necessary data for the organization to
reconstruct any past events where integrity of data
may be questions
• The act of monitoring functions as a deterrent to
internal workforce members from seeking
inappropriate access to health and other sensitive
information
33
CONTINGENCY PLANNING
• Data Backup Plan

• Disaster Recovery Plan
• Emergency Mode Operation Plan
• Testing and Revision
• Applications and Data Criticality Analysis
34
QUESTION 32
• Which of the following best describes the general

concepts of privacy?
• A. how data is to be protected, safeguarded, used,
disclosed.
• B. which organizations are covered by the rules.
• C. which technology is to be used to safeguard data.
• D. data integrity and availability.
35
ANSWER 32
• A. General privacy rules deal with an organization’s

ability to keep information protected, and to define
to whom and when it is to be used or disclosed.
36
QUESTION 33
• The CIO of a health plan is gathering information

related to the security posture of the organization in
preparation for a security gap analysis. Which of the
following is LEAST useful?
• A. network diagrams
• B. existing policies and procedures
• C. organizational charts
• D. credentialing data
37
ANSWER 33
• D. Credentialing information is not directly relevant

to the security posture of the health plan.
38
QUESTION 34
• Which of the following best describes the general

process of gap analysis for privacy and security
compliance?
• A. identifying the gaps between legacy and target
systems
• B. comparison of the regulatory requirements to the
organization’s current baseline
• C. comparison of different business functions within
an organization
• D. analysis of industry best practices as compared
with an organization’s practices
39
ANSWER 34
• B. The general process of conducting a gap

analysis includes comparing the requirements of the
regulation (or law or other requirement) with the
organization’s current conduct specific to the
requirement in question.
40
QUESTION 35
• The ability for an organization to ensure electronic

health information in its possession is kept consistent
with its source, protecting the data from improper
alteration or destruction is defined as
• A. authentication
• B. integrity
• C. verification
• D. security
41
ANSWER 35
• B. Keeping data integrity means that the data is

kept true to its source and that it is not
inappropriately accessed, changed, altered, or
destroyed.
42
QUESTION 36
• Which of the following would be the LEAST

important consideration when implementing
technical access controls?
• A. minimum necessary definitions
• B. principles for access profiles
• C. termination or modification of access
• D. general ledger data
43
ANSWER 36
• D. When implementing technical access controls,

answers a, b, and c are all important
considerations; answer d is not related.
44

CPHIMS Privacy and Security - 07072016 PDF

Uploaded by

Copyright:

Available Formats

CPHIMS Privacy and Security - 07072016 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CPHIMS Privacy and Security - 07072016 PDF

Uploaded by

Copyright:

Available Formats

PRIVACY/SECURITY

• Multiple laws, regulations, standards for privacy and

• Privacy tends to define WHAT

• General rules of privacy

• What data is to be protected

• Greater control of data by the individual

• Controls of limitations on the data contained in

• The process of identifying how an organization’s

• General: Organizational charts, new employee training

• Compare regulatory requirement to organization’s

• Goal is to identify areas which could result in

• Identify network infrastructure, network access points

• Threats are constantly evolving, you need to keep Up!

• The process of closing the gaps between current

• Identify representative team to develop P&P

• Cleaning Personnel • Information carried

• Device and Media Controls

• The process of maintaining compliance –

• Risk Assessment – The process to determine initial

• Implement Processes to:

• Provides a mechanism to monitor user activity

• Data Backup Plan

• Which of the following best describes the general

• A. General privacy rules deal with an organization’s

• The CIO of a health plan is gathering information

• D. Credentialing information is not directly relevant

• Which of the following best describes the general

• B. The general process of conducting a gap

• The ability for an organization to ensure electronic

• B. Keeping data integrity means that the data is

• Which of the following would be the LEAST

• D. When implementing technical access controls,

You might also like