Preparing for a Cyber Security Audit: Part X

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series of articles on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the tenth installment in the series.

The U.S. Department of Health and Human Services (HHS) recently defined a security rule formally known as its Security Standards for the Protection of Electronic Protected Health Information (e-PHI).

This rule sets standards for information and communications technology (ICT) in any healthcare organization. Compliance with the rule is mandatory. Enforcement powers of the government are codified at 45 C.F.R. Part 160, Subparts C, D, and E. If there is a violation, then civil money penalties (CMP) may be imposed.

One part of the rule calls for identification of and protection against “reasonably anticipated threats to the security or integrity” of e-PHI. What does “reasonably anticipated” mean? In particular, does it refer only to the psychological side of “anticipation,” or does it translate deeper into organizational actions?

Here, we will argue that “reasonably anticipate” means not only the purely psychological side, but it also implies that your organization must take specific tangible steps to anticipate a ransomware or other form of cyberattack, and effectively deal with it should it occur.

Preparing for a Cyber Audit

In previous articles in this series, we have reviewed the high-level steps of a cyber audit. First comes a “desk audit,” in which the healthcare provider is given a number of questions that must be answered in writing within 10 business days. Second, it is possible for certain providers to be chosen for more in-depth, on-site audits that can last for 3-5 days. Third, if necessary, the organization can be subjected to even more detailed audits that may lead to penalties.

Section §160.410 of this rule sets forth the “affirmative defenses” that might be used by the healthcare provider. For example, the provider might attempt to show that it demonstrated “reasonable diligence” in combatting hacking. What follow are a few of the steps that might be taken to demonstrate “reasonable diligence” in protecting against malware attacks.

Tabletop Exercise 

The tabletop exercise is a simulation of how your organization would respond to a cyberattack. The U.S. Department of Homeland Security offers generous documentation on how to conduct these exercises. In addition, there are a number of commercial security consulting organizations that can help you conduct this type of drill – for a fee.

The purpose of the tabletop is twofold: First, it is designed to raise awareness of the issues that must be dealt with, and to clarify who is responsible for handling them; second, it is designed to find glitches or flaws in how the organization responds. These glitches are particularly important to understand because only once they are identified, they can be fixed.

In many cases, a tabletop exercise is the first time an organization is forced to think through how it might respond to a cyberattack, and who is responsible for doing what.

Document Everything

The entire tabletop exercise and all of the details must be scrupulously documented. Of particular concern is documentation of any issues found in the organizational response, and exactly what steps were taken to rectify the problem(s) and mitigate the potential for serious damage.

For even the most hard-headed auditor, it is music to the ears to see well-organized documentation illustrating how your organization has been systematic in anticipation of a threat and responsible in the formulation of an effective response.

Strictly Enforce Security Protocols

The auditors will be looking not only for security protocols that are on the books – everyone has those – but also for evidence that the protocols are being used. Because of this, it is necessary to maintain a log of every single breach of a security protocol, including the date, time, systems affected, persons involved, how it was discovered, and what actions were taken to make sure it does not happen again.

It goes without saying, however, that in order to enforce a security protocol, an organization must have one in the first place, and everyone must understand how it applies to them personally.

Book of Security Protocols

Your organization should be able to present documentation of each security protocol. This includes how to log on to a system, how to log off, how to choose passwords, how to keep passwords safe, how to respond to phishing emails, how to handle email attachments, and so on.

Not only is it necessary to have complete documentation of your security protocols, but it also is useful to have documentation verifying that each employee in the organization is fully aware of all protocols that they might need in the event of a security breach.

Standing Patient Notification Protocol

In the case of any substantial security breach, your organization will be required to notify patients that their records have been compromised. In order to prepare for this, your organization must have documentation of drafts of the notification letter, with specification of the principles that will govern exactly when (and to whom) notifications will be sent.

Documentation of Security Maintenance 

Each modification or maintenance made to your information system with an aim of improving cyber security must be completely documented. In particular, there must be a clean record showing the date, time, and other report of any security patch that is applied to your information system.

After all, it is difficult to conclude that an organization is not taking “reasonable steps” towards effective cyber security when the documentation shows otherwise.

In some cases, an information systems organization may resist the adding of an additional “bureaucratic” step of recording their every move, but be assured, it is necessary, because it proves due diligence on the part of your organization.

Preparing for a cyber audit involves taking tangible steps to improve the security of your information system. But being secure is not adequate, for the purposes of an audit.

Instead, it is necessary to be able to show documentation of everything you have done. In this way, you can feed the audit monster before it bites off your hand.

In future issues of this series, we will go into greater detail about cyber audits.

Print Friendly, PDF & Email

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

The Inpatient Admission Order: Master the Who, When, and How

The Inpatient Admission Order: Master the Who, When, and How

During this webcast Dr. Ronald Hirsch delves into the inpatient admission order process including when to get it, when it becomes effective, its impact on billing and payment, who can write it, how to cancel it, the effects on the beneficiary, and more. You’ll leave with a clear understanding of inpatient orders and guidelines for handling improper orders that you can implement immediately.

June 20, 2024
Navigating AI in Healthcare Revenue Cycle: Maximizing Efficiency, Minimizing Risks

Navigating AI in Healthcare Revenue Cycle: Maximizing Efficiency, Minimizing Risks

Michelle Wieczorek explores challenges, strategies, and best practices to AI implementation and ongoing monitoring in the middle revenue cycle through real-world use cases. She addresses critical issues such as the validation of AI algorithms, the importance of human validation in machine learning, and the delineation of responsibilities between buyers and vendors.

May 21, 2024
Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Comprehensive Inpatient Clinical Documentation Integrity: From Foundations to Advanced Strategies

Comprehensive Inpatient Clinical Documentation Integrity: From Foundations to Advanced Strategies

Optimize your inpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. Participants will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.

June 26, 2024
Advanced Inpatient Clinical Documentation Integrity: Harnessing Technology, Analytics, and Compliance

Advanced Inpatient Clinical Documentation Integrity: Harnessing Technology, Analytics, and Compliance

Join expert Angela Comfort, MBA, RHIA, CDIP, CCS, CCS-P., as she helps you navigate advanced inpatient CDI technologies, regulatory changes, and system interoperability. Angela will provide actionable strategies for integrating AI and predictive analytics into CDI practices, ensuring seamless system interoperability, and maintaining compliance with evolving regulations. Attendees will learn to select and implement advanced EHR systems and CDI software, leverage data analytics to enhance documentation accuracy, and stay audit-ready with the latest compliance updates. Real-world case studies and practical tools will empower you to drive continuous improvement in CDI, improve patient outcomes, and enhance organizational efficiency. Don’t miss this opportunity to advance your CDI practices and stay ahead in this dynamic field.

July 11, 2024
Foundations of Inpatient Clinical Documentation Integrity: Enhancing Accuracy and Compliance

Foundations of Inpatient Clinical Documentation Integrity: Enhancing Accuracy and Compliance

Join expert Angela Comfort, MBA, RHIA, CDIP, CCS, CCS-P, for an insightful webcast on improving inpatient clinical documentation integrity (CDI). Inaccurate documentation can lead to misdiagnosis, improper treatment, and compromised patient safety. High workloads, lack of standardized practices, and outdated EHR systems contribute to these issues, affecting care quality and financial outcomes. Angela will offer practical strategies and tools to enhance accuracy, consistency, and timeliness in documentation. Attendees will learn to use standardized templates, checklists, and advanced EHR systems, while staying compliant with regulations. Improve patient care, ensure accurate billing, and reduce audit risks with actionable insights from this essential webcast.

June 26, 2024
Mastering E/M Coding: Navigating the Evolving Landscape

Mastering E/M Coding: Navigating the Evolving Landscape

Join industry expert, Kathy Pride, RHIT, CPC, CPMA, CCS-P, for an in-depth exploration of Evaluation and Management (E/M) coding, tailored for healthcare professionals navigating recent guideline changes. Dive into advanced topics beyond mere code selection, including shared visits, criteria for selecting E/M levels, and documentation best practices. Gain clarity on complex guideline terminology and ensure compliance with regulatory standards. This comprehensive session is essential for coders, auditors, educators, and practitioners seeking to enhance their proficiency in E/M coding and maximize revenue capture.

June 19, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

Honor Memorial Day with Savings! Get 20% off all items using code MEMORIAL24 at checkout. Shop today and save! Offer valid until May 31. Exclusions apply.

Happy World Health Day! Our exclusive webcast, ‘2024 SDoH Update: Navigating Coding and Screening Assessment,’  is just $99 for a limited time! Use code WorldHealth24 at checkout.