The Department of Health and Human Services reduced its fines for violations of HIPAA — the law requiring health care industries to protect customer data, according to a notice this week in the Federal Register. Driving the news: The new rules reduce a maximum fine of $1.5 million to a maximum fine of $250,000.Read More
The Department of Health and Human Services is lowering its top fines for less egregious HIPAA violations. Meanwhile, it’s pledging to make a “big push” to enforce patients’ right to access their health records. HHS will keep its revised interpretation of the HITECH Act penalty caps in mind “for all enforcement operations,” says Roger Severino, director of the HHS Office for Civil Rights, which enforces HIPAA.Read More
Cybercriminals stole the health records of more than 9 million Americans last year, according to data from U.S. Health and Human Services. The data collected includes breaches from hospitals, health insurers and other health organizations covered by the Health Insurance Portability and Accountability Act, which makes breaches public when they affect more than 500 people.Read More
New research from the Clearwater Cyber Intelligence Institute finds that laptop computers continue to present a substantial data security risk for the healthcare industry. Clearwater operates a database that holds millions of risk records from hospitals, delivery systems, and business associates. Data mining and informatics teams at the firm use analytics to identify common security weaknesses in provider organizations, insurance companies, and other entities.Read More
Hospitals and health systems are continuing to struggle with laptop vulnerabilities, caused primarily by endpoint data loss, excessive user permissions, and dormant accounts, according to new findings from Clearwater CyberIntelligence Institute. In fact, 70 percent of all high and critical risk scenarios for laptop vulnerabilities were caused by those risk areas. CCI researchers analyzed data from Clearwater’s proprietary database, which is exclusively focused on cybersecurity risks to hospitals, Integrated Delivery Networks, and business associates.Read More
ONE OF THE critical information governance (IG) functions is successful execution of an organization’s privacy and security responsibilities. Chief among these responsibilities is to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information(ePHI). This assessment is a foundation upon which other security processes will depend. Poor or non-existent risk analysis processes have been a finding in 89 percent of settlement agreements and civil money penalties imposed by the US Department of Health and Human Services’ Office for Civil Rights (OCR). In 2018 alone, the cost was over $24 million for organizations that failed to implement effective risk analysis or risk management processes.Read More
Unsecure Laptops Still a Major Security Threat For HealthcareRead More
In this interview, Michelle Johns, Chief Risk Officer of IU Health and Bob Chaput, Executive Chairman of Clearwater discuss their innovative work benchmarking risk within and between large health systems. They also explore why insurance captives have become so strategically important to innovation.Read More
Clearwater Executive Chairman Bob Chaput To Keynote Healthcare Internet of Things Conference Cyber Risk Management Expert to Share Insight on Medical Device […]
Clearwater Partners with NSA Centers of Academic Excellence To Advance Cyber Defense Education Company’s IRM|Pro Software Prepares Students to Meet […]
The security of medical images took center stage this past week as Senator Mark Warner of Virginia demanded that TridentUSA and its affiliate MobileXUSA outline their cybersecurity practices after ProPublica reported the imaging firms left millions of medical records and patient data exposed online.
On July 25, 2019 the Governor of New York signed into law the “Stop Hacks and Improve Electronic Data Security Act” (SHIELD ACT) effective March 21, 2020.
The digital transformation of healthcare is rapidly driving the adoption of new technology and information systems to support key business initiatives. We are experiencing a veritable explosion in health care data, systems and devices.