Driving Information Governance: Compliance, Security, and Privacy as a Base for Information Governance

Transcription

1 Driving Information Governance: Compliance, Security, and Privacy as a Base for Information Governance Kathy Downing, MA, RHIA, CHPS, PMP Director Practice Excellence AHIMA Twitter: HIPAAqueen #IGNOW

2 Objectives for this Webinar Discuss information governance as used in other industries Outline how the IG Principles of Compliance and Information Protection lay a framework for enterprise wide information governance Identify links from security and privacy

3 Information Governance Not just HealthCare MasterCard Motorola AutoTrader McKesson UBS

4 HIPAA Penalty Tiers Show the Importance of Information Governance Did not know or by reasonable diligence would not have known Each Violation - $100-$50,000 All such violations/yr $1,500,000 Reasonable Cause Each Violation - $1,000-$50,000 All such violations/yr $1,500,000 Willful Neglect Corrected 30 days Each Violation - $10,000-$50,000 All such violations/yr $1,500,000 Willful Neglect Not corrected Each Violation - $50,000 All such violations/yr $1,500,000 4

5 The Year of the HealthCare Hack St. Joseph Health System reports that as many as 405,000 records may have been compromised, but actual damage remains speculative. Massive breach at health care company Anthem Inc

6 HIPAA Breaches Reach 30M Patients HIPAA data breaches climb 138 percent Information on 4.9 million Tricare Management Activity beneficiaries was stolen from a Science Applications International Corporation employee s car in This year, Complete Health Systems, based in Tennessee, reported that a network server was hacked and personal information was stolen, affecting 4.5 million people around the country. Illinois-based Advocate Health and Hospitals Corporation reported the theft of company computers, which impacted almost 4.03 million individuals in Health Net in California had a data breach in 2011 that affected 1.9 million people. In that case, IBM alerted Health Net that several unencrypted server hard drives were missing from a California-based data center.

7 Information Governance How could it help? If your organization has a breach and patient information is not the target of the attack there is still reputational damage and local concern. Enterprise wide effort to protect information, not just clinical information.

8 Insider Threat Consider the insider threat Malicious Accidental Solution Trust and policy are not enough. Organizations must invest in security, risk, and information governance training and enforcement.

9 Analyze sensitive data: Discover and classify sensitive data and uncover compliance risks automatically Know who is accessing data, spot anomalies, and stop data loss with real-time data, application, and file activity monitoring Rapidly analyze data usage patterns to uncover and remediate risks

10 Ponemon Study on Cost of a Breach Overall the average cost of a data breach across all industries was $194 per record. The cost of a data breach in healthcare was $240 per record. Before we examine what makes up these costs, let s look at some of the financial impact of a data breach. # of records / Cost 1 $ $2, $24,000 1,000 $240,000 10,000 $2,400,000

11 Cost of a Breach Per Ponemon Turnover of existing customers Diminished customer acquisition Detection and escalation costs Notification costs Post data breach costs

12 Protection Appropriate levels of protection from breach, corruption and loss must be provided for information that is private, confidential, secret, classified, essential to business continuity, or otherwise requires protection... Must address all sources, all media and must apply throughout the life of the information. AHIMA.ORG/INFOGOV

13 Security Roles and Information Governance Security Officers often focus efforts on: Clinical data Electronic data Expansion of the security officer s role to Information Governance Involvement in business continuity and disaster recovery planning Involvement in access management

14 Exercise #1 Does your organization have technical controls in place to safeguard information? Are technical controls defined, implemented and managed centrally? Are advanced controls and systems like encryption, master data management being evaluated and implemented? Is there a program of continuous monitoring, auditing, and improvement of technical safeguards?

15 OCR Audit Outcomes By Issue 8% 14% 14% 9% 4% 12% 18% 14% 7% Risk Analysis Access Management Security Incident Procedures Contingency Planning and Backups Workstation Security Media Movement and Destruction Encryption Audit Controls and Monitoring Integrity Controls

16 Security Safeguards Administrative - Administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity s workforce in relation to the protection of that information. Physical physical measures, policies, and procedures to protect a covered entity s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. Technical issues The technology and the policy and procedures for its use that protect electronic protected health information and control access to it. 16

17 Risk Assessment and Information Governance Every organization handles confidential information If a risk analysis is not conducted, then: How will you effectively know what the risks are to your information? How will you adequately determine if controls are implemented and appropriate? How will management and stakeholders make informed decisions? How will you establish an acceptable level of risk?

18 Assessment vs. Analysis Assessment A judgment about something based on an understanding of the situation Analysis The close examination of something in detail in order to draw conclusions from it

19 4 New Risk Assessment Factors ( )[78FR5639] 1. Nature and extent of PHI involved 2. Unauthorized person who used the PHI or to whom it was disclosed 3. Whether the PHI was actually acquired or used 4. Extent to which the risk to the PHI has been mitigated 19

20 Relationships Surrounding Risk Threat 6. which protects against a Exploits or compromises a... Vulnerability or Gap 2. which leads to a But this can be minimized by a... Control or Safeguard 4. and result in... Something Bad Happening 3. that can damage an... Asset, Process or Capability RISK

21 Using Infection As An Example Threat Vulnerability Impact Control Germ Bacteria Microorganism Mouth Nose Wounds Rash Infection Disease Medication Hand washing Surgery

22 Industry Recognized Risk Analysis Methodologies International Organization of Standardization (ISO) provides guidance in the ISO standard which specifies a structured, systematic process for analyzing risks to create a risk treatment plan National Institute of Standards and Technology (NIST) Special Publication (SP) Revision 1, Guide for Conducting Risk Assessments provides guidance for carrying out each of the steps in their risk analysis process Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE) provides a standard approach for a risk-driven and practice-based information security evaluation

23 Information Governance for Mobile Devices Information Governance for mobile computing can include building security into the mobile applications. Are your nurses texting your physicians? How are they identifying patients? Do you offer encrypted texting options?

24 What Are Mobile Devices? Smart Phones with personal computer-like functionality Laptops, netbooks and ultrabooks Tablet computers Universal Serial Bus (USB) devices (thumb drives) Digital cameras Radio frequency identification (RFID) devices Source: Mobile Device Security, 2013 AHIMA Convention, Brian Evans, CISSP, CISM, CISA, CGEIT

25 Greatest Data Protection Risks Source: The Risk of Regulated Data on Mobile Devices & in the Cloud Ponemon Institute June 2013 Only 19 percent say their organizations actually know how much regulated data is on mobile devices

26 Mobile Device Threats Theft or physical loss Stored/synchronized data to a public cloud Inadvertent or maliciously leaked information Eavesdropped or intercepted communication Unauthorized access Unauthorized or unlicensed software Malware and malicious code Jail breaking (Apple) or Rooting (Android)

27 Ensure Minimum Security Requirements Use a password or other user authentication Keep security software up-to-date Install or enable encryption Install or activate wiping and/or remote disabling Disable and do not install file-sharing applications Install or enable a firewall Research mobile applications (apps) before downloading Maintain physical control of your mobile device Use VPNs to send or receive health information over public Wi-Fi networks Install or enable security software Delete all stored health information before discarding or reusing the mobile device Source: Office of National Coordinator

28 Information Governance Mobile Device Policy Requires a cross functional IG team Clarify how mobile devices are being used EHR Access Financial system access Consider legal and compliance issues Consider Mobile Device Management Develop your Communications and Training Plan Update and Fine-Tune this one can t stay on the shelf!

29 Mobile Device Management (MDM) An MDM solution would enforce certain security control settings on a personally-owned device to comply with organizational policy Concern: Users may consider this unacceptable since it manages the entire device Once you become part of our network, we are going to apply our network policies to your device A wipe or kill command could erase personal data MDM can control what apps are allowed on a device Some organizations have created their own App store 29

30 Privacy Roles and Information Governance HIPAA privacy rule 2003 Privacy Officer, Privacy Official in Place Time to expand this role outside of clinical information. Enterprise wide standards Enterprise wide access Paper and electronic

31 OCR Audit Outcomes By Issue 4% 2% Business Associates Identify Verification 11% 18% Minimum Necessary Authorizations 9% 8% Deceased Individuals Personal Representatives 7% 17% Judical and Administrative Procedures Group Health Plan Requirements Source: ocr.gov

32 Exercise #2 Has your organization fully implemented identity access management? Is access managed through a central process according to minimum necessary? Do you have access creep?

33 Breach Investigation Process Gather all the facts of the potential breach Document specifically who, when, where, why and how the situation occurred Identify those impacted and what PHI was potentially compromised Analyze & evaluate all the facts objectively to determine whether or not an impermissible access, use, or disclosure of PHI can be substantiated. 33

34 Breach Investigation Process More than just clinical Once a violation is substantiated outline the mitigation, sanctions, education, and prevention remediation actions that will be taken Confirm your notification processes Document all actions and communications (internal and/or external) 34

35 Breach Response / Incident Management Process

36 Discovery and Report Workforce shall report any potential event that adversely affects the confidentiality, integrity, or availability of Institutional Information, regardless of form (electronic or paper).

37 Breach Response / Incident Management Team Chief Information Officer Chief Information Security Officer Chief Medical Information Officer Corporate Compliance Officer Director, Health Information & Privacy Director, Internal Audit Director, Office of Institutional Assurances Director, Risk Management General Counsel Hospital President SCRI President Research Integrity Officer VP Human Resources VP Marketing & Communications Leaders from affected departments

38 Information Governance & Social Media Not just Facebook! Web Publishing Blogs, wikispaces microblogging (twitter) Social Networking LinkedIn File Sharing / storage Google drive Drop Box Photo libraries

39 Biggest Risks of Social Media Lack of a Social Media Policy Who can use social media What they can state / discuss Training is key Employees accidental or intentional Legal Risks This risk is avoidable with an information governance policy, guidelines, monitoring

40 IG Social Media Guideline Examples Specifies authorized individuals Clear distinctions between business and personal use of social media and whether a person can use social media while at work. Strictly forbids any profanity, statements that could be defamatory, inflammatory, Outlines sanctions Draws clear rules on use of company logos Instructs employees shall not have an expectation of privacy when using social media for company purposes. Outlines negative impact on brand.

41 Social Media Will Be Governed According to Policy In Gartner's report from March of 2013 on the "Six Questions to Drive Records Management in Your Social Initiatives," it is clearly stated that social media content requires records management, just like all other content, but many organizations don't know how to create an effective management process. In 2015, more organizations will look to incorporate social media content in their policy definition and explore methods on enforcing the policy across the various systems.

42 Compliance Information practices and processes must comply with organization policies and all applicable laws, regulations, and standards.

43 Enhance IG Awareness and Training Ensure users know what NOT to do: Share passwords or user credentials Allow the use of mobile devices by unauthorized users Store or send unencrypted confidential information Ignore security software updates Download applications from untrusted sources Leave mobile devices unattended Use unsecured Wi-Fi networks for sharing confidential information Discard devices without wiping all confidential information Ignore organizational policies and procedures Source: Office of National Coordinator

44 Valuation of Information Assets Information is being created at a pace faster than organizations can analyze and extract value from it, which means that the potential value of the information may be far greater than the actual value an organization is able to derive. Organizations simply cannot afford to ignore the value of their information assets.

45 New Leaders Will Continue to Emerge / The Evolution of the Privacy, Security, and Compliance Officer In the last few years, there has been a tremendous uptick in the creation of information governance steering committees; however, there is still a need for an executive in each organization to drive the information governance initiative across their company. This executive must have the authority (and oversight) to manage the program.

46 Workforce Awareness Formal IG Training Awareness Program Monitoring and Accountability Regulatory and Legal Response

47 Compliance Expanded Information assets inventory Information asset classification Total cost of ownership Managed inventory of information Patient information request response

48 Wrap Up Compliance + Privacy + Security= Chief Information Governance Officer

49 Resources The Final HITECH Omnibus Rule (January 25, 2013) Combined HIPAA/Omnibus Rule mbined/index.html U.S. Department of Health and Human Services Office for Civil Rights: HIPAA Administrative Simplification - 45 CFR Parts 160, 162, and 164 Information Governance, Robert F. Smallwood 49

50 IG PulseRate a quick check into your organization s IG maturity. Free instant assessment of the maturity level of IG in your organization available at Review and rate the key success measures that impact organizational IG maturity Evaluate your organization s strengths and help identify weaknesses that may be impeding your organization s path to enterprise information governance

51 Driving IG for HealthCare: Recommended Reading AHIMA. Information Governance Principles for Healthcare Chicago, IL. AHIMA, Available at: ARMA International. Generally Accepted Recordkeeping Principles. ARMA International, Available at Cohasset Associates and AHIMA. A Call to Adopt Information Governance Practices Information Governance in Healthcare. Minneapolis, MN. Cohasset Associates, Cohasset Associates and AHIMA. Professional Readiness and Opportunity 2015 Information Governance in Healthcare. Minneapolis, MN. Cohasset Associates, Implementing Health Information Governance, Linda Kloss, MA, RHIA, FAHIMA Enterprise Health Information Management and Data Governance, Merida L Johns, PhD, RHIA. The Information Governance Initiative. The Information Governance Initiative Annual Report and New York, NY. The Joint Commission. Information Management (IM) Chapter, Comprehensive Accreditation Manual for Hospitals, 2014, Oakbrook Terrace, IL: The Joint Commission, 2014, pp.im-1 IM-10. The Sedona Conference. Commentary on Information Governance The Sedona Conference Working Group Series. A project of The Sedona Conference Working Group on Electronic Document Retention and Production (WGI)

52