Cyber Security – POET LLC

Your Business is About to Get Hacked

Hackers are looking for weaknesses and, when found, they’ll pounce.

If any of the following resemble your practice, you are definitely in trouble.

1. You have higher than average employee turnover.

If you’re losing employees more than the norm than there may be a reason behind this – like lower than average pay, less than fabulous working conditions, etc. When employees leave they sometimes take data with them – usually inadvertently but sometimes on purpose to use with a competitor or other vengeful reasons. Re-address your employee concerns and do your best to limit turnover – you will reduce a chance of a hack that way

2. Your staff is remote and/or mobile.

When employees are moving around they are moving around with your data – it can be easily lost or stolen. If an employee or contractor is remote then they are connecting to your database through online services and these have a chance of being hacked. Work with an IT person to make sure you have strong data management and connection tools in place for these remote people and make sure they’re being monitored

3. You have no IT support.

Speaking of an IT (information technology) person: get one. Even the smallest of companies are exposed to a data hack. Paying someone to evaluate your risks, install software, monitor activity and keep things up to date is a critical and essential business cost – even the work is done monthly (it all depends on your size and activity)

4. You do not buy security software.

Subscribe to one of the great security applications like McAfee, Norton, Malwarebytes or Bitdefender. There are many others. These software applications are inexpensive, run quietly in the background of every device and are checking for malware, viruses, infected websites and other tools of the hacker. Make sure this software is always updated.

5. Your employees do not get trained.

Most security problems, particularly at small companies, are from employee-related errors – clicking on bad websites, opening up infected files, etc. Invest in a day of training a few times a year with a good IT security firm so that your employees are well aware of potential problems and can avoid doing dangerous stuff.

6. You have no procedures for securing data.

If you are handling health, financial or other personal information about your customers, and it gets stolen, you could have a big problem on your hands. Keeping this data in an unprotected place means that hackers are going to find it. If this is you, then you’re going to need procedures and policies around the safeguarding of confidential customer data. And after they’re written training will be required to ensure that your employees are complying.

7. Your computers and operating systems are old.

Thousands of computers around the world are still running older, out of date versions of Microsoft Windows. All hackers need is one vulnerable computer to attack and then can get on a network and wreak havoc. One of the best ways to avoid a hack is to ensure that all of your computers are running the most recent versions of Windows or iOS all the time. If a desktop or other device is too old to handle the new operating systems then buy a new one. The cost will pale in comparison to the cost you’ll incur if you’re hacked

8. You have no BYOD policy.

Are your employees allowed to bring their own devices (a BYOD policy) and use them for work? That’s what most companies do. Unfortunately, this can create security issues if they are not monitored. Many companies use remote management software to install company apps on their employees’ devices for a secure access while other companies issue their own devices to their employees which have been secured. So, what is your Bring Your Own Device policy? Every company must have one and every company must have an IT person monitoring those devices.

9. Password changes are not enforced.

Most people are pretty complacent with passwords – the most common one, if you can believe it, is still “1234.” You must require a more complicated password for your employees to enter your network – a combination of letters, numbers and symbols – and this password should be required to be changed every month or two. That way passwords are more difficult to hack and hackers may move on to another easier target.

What is the Security Rule Anyway?

The Security Rule specifically sets out to ensure the “confidentiality, integrity,
and security” of electronic protected health information (ePHI). What does that mean?
• Confidentiality: ePHI is not available or disclosed to unauthorized persons.
• Integrity: ePHI is not altered or destroyed in an unauthorized manner.
• Availability: ePHI is accessible and usable on demand by an authorized person.

Security Training Tips for Frontline Employees

The shift towards digital solutions has had a profound impact and benefit. However, it has also introduced new challenges, particularly concerning security, which is why your frontline employees need to be properly trained to ensure your business and customers are protected.

As frontline sectors continue to embrace technology, the dependency on digital tools and platforms grows. Employees now rely on various devices and software to perform their duties, from processing transactions and managing customer interactions to accessing sensitive information. Point-of-sale systems, digital customer service platforms, electronic health records, and mobile apps are now standard tools in these environments.

The Importance of Security Training for Frontline Workers

Frontline workers extend beyond emergency responders. It’s an encompassing term to describe individuals who are the first point-of-contact between a company and its customers. They can handle sensitive information, greet patrons as they enter facilities, or provide direct support when needed

Why is front line training so vital?

Direct Customer Interaction
Protecting Sensitive Information
Identifying Threats
Compliance with Regulations
Building Customer Trust

For Additional Helps and Tips Visit: Vector Security’s Security Blog.

FBI and HHS release Joint Cybersecurity Advisory

The Federal Bureau of Investigation (FBI) and the U.S. Department of Health and Human Services (HHS) have issued a joint cybersecurity advisory (CSA) to share known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with a social engineering campaign. The campaign focuses on healthcare, public health entities, and providers, recognizing healthcare organizations as prime targets for hackers due to their large scale, reliance on technology, access to personal health information, and the significant consequences of disruptions in patient care.. ~Ann Ribeiro, Industrial Cyber News Editor

Physicians Can Delegate Breach Notifications to Change Healthcare

However, this delegation is only allowable if Change Healthcare or UHC are business associates of the covered entity. OCR made clear that the ultimate responsibility for ensuring such notifications occur remains with the covered entity, meaning physicians may still need to provide breach notifications under those circumstances.

FTC Mandates Vendors Notify Patients of Breaches

The Federal Trade Commission (FTC) has amended its Health Breach Notification Rule to require vendors of personal health records (PHR) and related entities not covered by HIPAA to notify individuals, the FTC, and, at times, the media, when a breach in protected health information (PHI) occurs. The change will take effect July 29.

Physicians do not have to notify patients if their PHI is leaked via a PHR vendor that is not a business associate of the physician. That responsibility falls to the vendors themselves.

Notice of Data Breach Update

Texas physician practices and other health care facilities soon will be required to give more timely and public notice of any breaches of computerized data, including electronic health records (EHRs) and billing information.

During the 2023 regular legislative session, state lawmakers passed Senate Bill 768 by Sen. Tan Parker (R-Flower Mound), which takes effect Sept. 1. The law requires anyone doing business in Texas to notify the state attorney general of computer security breaches involving the sensitive, personal information of at least 250 individuals as soon as possible, and not later than 30 days after discovery, down from 60 days.

2022 Tech Trends from Iconic IT

The pandemic has sped everything up.

Here’s some of the big trends Iconic believes you’ll be seeing a lot more of in 2022:

1. Companies will invest more in cybersecurity insurance than ever before.

2. Cloud-based desktop software like Microsoft’s Cloud PC will grow in popularity.

3. Companies of all sizes will rely on SIEM cybersecurity defenses.

4. Mobile devices will become a bigger target for hackers.

With more employees than ever working remotely, they’re more likely to use poorly protected cell phones and computers on unsecured wifi. According to Digital Information World, 40 percent of mobile phones are prone to attack, and in need of better authentications and cybersecurity software.

5. AI-enabled cybersecurity software will help companies mitigate network threats in their networks, and the Internet of Things.

Ransomware Threat Targeting HealthCare Providers. 11/09/2020

You can’t afford to continue to look the other way.

SOME GREAT TIPS TO SHARE WITH YOUR STAFF.

Loading…

Taking too long?

Reload document

|

Open in new tab

Download [101.31 KB]

HEIGHTENED RANSOMWARE THREAT: ACTION STEPS

MGMA members-the federal government has announced a heightened risk of malware/ransomware attacks on the healthcare industry-including physician practices and inpatient facilities. We wanted to identify some actions you can take to reduce your risk and resources to assist you.

Actions to reduce your risk:

Discuss the issue of cybersecurity with your IT/website vendor and have them block known sites that provide known functionality to the malware (reference the IOC list below)
Have your IT/website vendor monitor endpoint detection on servers and workstations for changes in applications and running services
Have your IT/website vendor monitor all new account creations. Especially critical are those with administrator access
Have your IT/website vendor confirm that your data backup systems are in place and working effectively. Remember that offsite data storage is preferable
Ensure your practice’s business continuity and disaster recovery plans are up-to-date and readily available
Discuss the heightened threat with your administrative and clinical staff and the increased need to stay highly diligent during this time
Consider instituting a practice-wide policy prohibiting staff use of personal email accounts as a method to decrease your risk
Remind staff not to open emails and/or attachments from unknown senders (and even be cautious with attachments from recognized senders)
Encourage staff to inform you regarding any suspicious email or cyber incident

Resources:

HHS Bulletin: us-cert.cisa.gov/sites/default/files/publications/…

IOC List: gist.github.com/aaronst/…

MGMA member-benefit Cybersecurity Action Steps

Robert Tennant MA
Director of Health Information Technology Policy MGMA Government Affairs
Washington DC

Tag: Cyber Security