Secure Endpoint Management. Presented by Kinette Crain and Brad Lewis

Transcription

1 Secure Endpoint Management Presented by Kinette Crain and Brad Lewis

2 Brad Lewis Brad Lewis - Service Specialist 14 years of IT experience In-House Support Manager Network Administrator Assessing Risk: A Path to Action

3 Kinette Crain Kinette Crain - Services Analyst Managed IT Sales Manager IT Education Manager IT and Software Installation & Project Management Assessing Risk: A Path to Action

4 Regulatory Requirements HIPAA HITECH Omnibus

5 EHR Incentive Program

6 Compliance Audits Meaningful Use: Pre and post payment audits Maintain supporting documentation, including risk assessments 5-10% can expect audits, including random selection process HIPPA Compliance: There s still a lot of work to be done to ensure compliance Few had conducted complete or accurate risk assessments The reasonableness and appropriateness of encryption must be addressed How are we measuring up?

7 Business Pressures Consumerization of IT BYOD Initiatives What are your challenges?

8 Endpoint Protection Definition: Endpoint protection refers to a methodology and strategy of protecting your facility s network to comply with security standards. Endpoints include PCs, laptops, smart phones, or other wireless and mobile devices. What is endpoint protection?

9 Administrative Safeguards Security Management Data Encryption Secure Risk Assessment Mobile Device Management

10 Administrative Safeguards Decide Understand the risks to your organization before you decide which endpoint devices will be allowed. Do I have a comprehensive policy?

11 Administrative Safeguards Decide Understand the risks to your organization before you decide which endpoint devices will be allowed. Access Consider how endpoint devices affect the risks (threats and vulnerabilities) to the health information your organization holds. Do I have a comprehensive policy?

12 Administrative Safeguards Decide Understand the risks to your organization before you decide which endpoint devices will be allowed. Access Consider how endpoint devices affect the risks (threats and vulnerabilities) to the health information your organization holds. Identify Identify your organization s mobile device risk management strategy, including privacy and security safeguards. Do I have a comprehensive policy?

13 Administrative Safeguards Decide Understand the risks to your organization before you decide which endpoint devices will be allowed. Access Consider how endpoint devices affect the risks (threats and vulnerabilities) to the health information your organization holds. Identify Identify your organization s mobile device risk management strategy, including privacy and security safeguards. Document Develop, document, and implement the organization s endpoint security policies and procedures to safeguard health information. Do I have a comprehensive policy?

14 Administrative Safeguards Decide Understand the risks to your organization before you decide which endpoint devices will be allowed. Access Consider how endpoint devices affect the risks (threats and vulnerabilities) to the health information your organization holds. Identify Identify your organization s mobile device risk management strategy, including privacy and security safeguards. Document Develop, document, and implement the organization s endpoint security policies and procedures to safeguard health information. Train Conduct endpoint privacy and security awareness and training for providers and professionals. Do I have a comprehensive policy?

15 Security Management Strategy and Key benefits: Malicious Software protection Minimal system resources Scans removable storage Central Management Console Is your security centrally managed?

16 Security Management Strategy and Key benefits: Malicious Software protection Minimal system resources Scans removable storage Central Management Console Patch Management Automated patch deployment Comprehensive reporting Patch compliance Is your security centrally managed?

17 Security Management Strategy and Key benefits: Malicious Software protection Minimal system resources Scans removable storage Central Management Console Patch Management Automated patch deployment Comprehensive reporting Patch compliance Media Sanitization - Procedure for all endpoint types Is your security centrally managed?

18 Security Management Strategy and Key benefits: Malicious Software protection Minimal system resources Scans removable storage Central Management Console Media Sanitization - Procedure for all endpoint types Patch Management Automated patch deployment Comprehensive reporting Patch compliance Remote Monitoring & Management (RMM) User defined monitoring & alerts Alert messaging Log monitoring Is your security centrally managed?

19 Data Encryption Key Benefits: Comprehensive multi-platform coverage Ease of deployment Central Management Console Compliance with privacy mandates AES-NI hardware chipset compatibility Password recovery options Do you have a data encryption strategy?

20 Meaningful Use Stage 2 The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-phi. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision. Is encryption mandatory?

21 Meaningful Use Stage 2 The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-phi. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision. Is encryption mandatory?

22 Audit Findings Encryption is an addressable implementation specification Most people, once gone through the addressable analysis, do encrypt Those that don t encrypt, didn t go through the analysis How are we measuring up?

23 Data Encryption Common myths surrounding data encryption: Passwords protect laptops Data encryption is not practical Data encryption solutions are hard to manage Data encryption is too expensive Do these myths exist at your facility?

24 Mobile Device Management Strategy: Document your policy Consider embracing BYOD Communicate Responsibility Take Access Control seriously Best Practices Are mobile devices managing you?

25 Mobile Device Management Strategy: Document your policy Consider embracing BYOD Communicate Responsibility Take Access Control seriously Best Practices Are mobile devices managing you?

26 Establish Administrative Safeguards Conduct a Security Risk Assessment Establish Security Management Data Encryption where appropriate Implement Mobile Device Management platform Are you ready?

27 Customer Implementation Implementation Percentage Malicious Software Protection Malicious Software Protection

28 Customer Implementation Implementation Percentage Malicious Software Protection Implementation Percentage

29 Customer Implementation Implementation Percentage Malicious Software Protection Remote Mgmt System Implementation Percentage

30 Customer Implementation Implementation Percentage Malicious Software Protection Remote Mgmt System Data Encryption Implementation Percentage

31 Customer Implementation Implementation Percentage Malicious Software Protection Remote Mgmt System Data Encryption Implementation Percentage Mobile Device Mgmt

32 Customer Implementation Malicious Software Protection Remote Mgmt System Data Encryption Implementation Percentage Risk of Loss / Theft Mobile Device Mgmt

37 Implications $,$$$,$$$ Sutter Health $1,200,000 $400,000 $50,000 Affinity Health Plan Idaho State University Hospice of North Idaho What if I do nothing?

38 10 Largest HIPAA Breaches of , , , , ,153 66,601 65,750 64,846 42,000 36,609 Utah Department of Health Emory Healthcare South Carolina Department of Health and Human Services Alere Home Monitoring Memorial Healthcare System Howard University Hospital Apria Healthcare The University of Miami Safe Ride Services Integrated Medical Services Could it happen to you?

43 Consumer Backlash Research link 1 in 4 consumers of a data breach become a victim Consumers with stolen SSNs were 5 times more likely to be a victim Advocate Health Care class action lawsuit filed by 4 million patients Massachusetts Medical Group pays $140,000 in privacy suit What will happen next?

44 Conclusion Business Drivers Regulatory Pressures Consumer Backlash Endpoint Protection

45 Questions?

46 Questions? Marty Toland - Managed IT Services Director Oversees the implementation and management for Managed IT Services division CPSI Networking & Internet Services Director Assessing Risk: A Path to Action

47

48 Join the Conversation Keyword TruBridge facebook.com/trubridgeservices

49 Thank You!