Healthcare Privacy and Security: Workforce Competency. #privacysummit. Sean Murphy CISSP, ISSMP, HCISPP March 7, 2014
|
|
|
- Lesley Boyd
- 10 years ago
- Views:
Transcription
1 Healthcare Privacy and Security: Workforce Competency Sean Murphy CISSP, ISSMP, HCISPP March 7, 2014
2 Agenda: State of healthcare information protection Current solutions and impact Special environment of healthcare Healthcare-specific info protection competency Current healthcare info protection workforce Knowledge domains required Competency measures in action Return on investment Top 10 actions
3 Breaches are epidemic Often multiple per org Patients are affected Data loss is costly It is getting worse Healthcare lags behind SOURCE: ID Experts: Ponemon Study; Third Annual Benchmark Study on Patient Privacy & Data Security ; Dec 2012 ; Infographic included
4 SOLUTION?: Implement best practices from banking, military, telecomm, etc. IMPACT: Usually, intended. -- compliance -- privacy -- security Often, unintended. -- risk -- patient safety
5 NOW THEN
6 Protecting healthcare information Special environment Equipment Infrastructure Data Applications Regulations IT security budget Privacy and security concerns impact patient care
7 Healthcare information protection workforce competency measures can help Because information privacy and security in healthcare must happen Much of the risk can be addressed by InfoSec best practices Not all risk is equal and healthcare requires a tailored approach Additional $$$ are not coming Part of the answer is in recruiting and retaining the right people
8 Borrowed from Steve Person, from imagestore.slideshare cdn.com
9 Primary Sources of Information Protection Workforce Privacy Health Information Management Legal Risk Management Internal IT Staff Other Industry InfoTech Medical Technician Clinical Engineering Device System Administrators Super Users (Lab, Rad, Pharm)
10 Getting to the desired competencies Healthcare Industry Regulatory Environment Privacy and Security in Healthcare Information Governance and Risk Management Third Party Risk Management Privacy Ethical/Legal Program Management IT Security Incident Reporting Admin, Technical, and Physical Controls Business Continuity Disaster Recovery Telecommunications IT Security Medical Technician Healthcare Clinical Engineering Manufacturer/Vendor Risk Specific Medical Device Clinical Workflow IT Security Patient Safety
11 Competency measures: -- A level of assurance key personnel are trained and ready Competency measures validated by several information protection areas -- DOD Directive Position descriptions -- Information Technology -- Leading Professional Organization (like IAPP) -- National Initiative for Cybersecurity Education framework -- Healthcare C-level top two competencies desired: Privacy and Security Knowledge 66% and Knowledge of Healthcare Industry 55%
12 Workforce competency measures have return on investment -- Avoid fines and penalties -- Reduce risk of adverse actions Board action, Bond rating, Abnormal churn -- Increase due diligence -- Tailored risk management -- Enable initiatives: BYOD, HIE, Cloud Services -- Patient care improves -- More effective recruiting -- Turnover of employees reduced
13 Top 10 actions 1. Read the sources for this material a) b) csrc.nist.gov/nice/framework c) 2014 Healthcare Information Security Today survey (ISC) 2 d) Third Annual Patient Privacy and Data Security Study (Pomemon) 2. Take an inventory of all information protection POCs 3. Determine their competency areas and levels 4. Review your latest risk assessment and remediation actions 5. Examine current workforce competency credentials choices a) Consider Continuing Education requirements b) Evaluate domains covered
14 Top 10 actions (continued) 6. Look at current position descriptions and job announcements 7. Consider potential candidates to obtain certification 8. Analyze next year s information protection budget a) Prioritize workforce competency impact 9. Tweet, We need healthcare-specific security and privacy credentials? RT if you 10.Tell me where I got it wrong a) Continue this important dialogue
15 Agenda: State of healthcare information protection Current solutions and impact Special environment of healthcare Healthcare-specific info protection competency Current healthcare info protection workforce Knowledge domains required Competency measures in action Return on investment Top 10 actions
16 Healthcare Privacy and Security: Workforce Competency Sean Murphy CISSP, ISSMP, HCISPP March 7, 2014
Healthcare and IT Working Together. 2013 KY HFMA Spring Institute
Healthcare and IT Working Together 2013 KY HFMA Spring Institute Introduction Michael R Gilliam Over 7 Years Experience in Cyber Security BA Telecommunications Network Security CISSP, GHIC, CCFE, SnortCP,
A PRACTICAL GUIDE TO USING ENCRYPTION FOR REDUCING HIPAA DATA BREACH RISK
A PRACTICAL GUIDE TO USING ENCRYPTION FOR REDUCING HIPAA DATA BREACH RISK Chris Apgar Andy Nieto 2015 OVERVIEW How to get started assessing your risk What your options are how to protect PHI What s the
Certification and Training
Certification and Training CSE 4471: Information Security Instructor: Adam C. Champion Autumn Semester 2013 Based on slides by a former student (CSE 551) Outline Organizational information security personnel
Security Risk Management Strategy in a Mobile and Consumerised World
Security Risk Management Strategy in a Mobile and Consumerised World RYAN RUBIN (Msc, CISSP, CISM, QSA, CHFI) PROTIVITI Session ID: GRC-308 Session Classification: Intermediate AGENDA Current State Key
How To Protect Yourself From Cyber Threats
Cyber Security for Non- Profit Organizations Scott Lawler CISSP- ISSAP, ISSMP, HCISPP Copyright 2015 LP3 May 2015 Agenda IT Security Basics e- Discovery Compliance Legal Risk Disaster Plans Non- Profit
Joe Dylewski President, ATMP Solutions
Joe Dylewski President, ATMP Solutions Joe Dylewski President, ATMP Solutions Assistant Professor, Madonna University 20 Years, Technology and Application Implementation Experience Served as Michigan Healthcare
SECURITY MODELS FOR CLOUD 2012. Kurtis E. Minder, CISSP
SECURITY MODELS FOR CLOUD 2012 Kurtis E. Minder, CISSP INTRODUCTION Kurtis E. Minder, Technical Sales Professional Companies: Roles: Security Design Engineer Systems Engineer Sales Engineer Salesperson
Cybersecurity Credentials Collaborative (C3) cybersecuritycc.org
Cybersecurity Credentials Collaborative (C3) cybersecuritycc.org October 2015 Collaboration Members Certification Matters The Cybersecurity Credentials Collaborative (C3) was formed in 2011 to provide
CYBERBOK Cyber Crime Security Essential Body of Knowledge: A Competency and Functional Framework for Cyber Crime Management
CYBERBOK Security Essential Body of Knowledge: A Competency and Functional Framework for Security Workforce Development aligned with ISO 31000* risk management principles and guidelines. *Note : ISO 31000
Mitigating and managing cyber risk: ten issues to consider
Mitigating and managing cyber risk: ten issues to consider The board of directors is responsible for managing and mitigating risk exposure. A recent study conducted by the Ponemon Institute 1 revealed
BIOS Steven Penn, Senior Director CSF Development And Educa9on Programs Bryan Cline, PhD Senior Advisor
1 CSF Roadmap 2015 BIOS Steven Penn, Senior Director CSF Development And Educa9on Programs Steve Penn is an experienced security professional with 15+ years of informa;on security experience. He currently
The Next Generation of Security Leaders
The Next Generation of Security Leaders In an increasingly complex cyber world, there is a growing need for information security leaders who possess the breadth and depth of expertise necessary to establish
North Texas ISSA CISO Roundtable
North Texas ISSA CISO Roundtable Roundtable Topic Threat Against Our Well Being The Most Effective Methods in Combating and Responding to the Cyber Attack Event Sponsor Moderator and Panelists David Stanton
Rogers Insurance Client Presentation
Rogers Insurance Client Presentation Network Security and Privacy Breach Insurance Presented by Matthew Davies Director Professional, Media & Cyber Liability Chubb Insurance Company of Canada [email protected]
The Imperative for High Assurance Credentials: State Identity Credential and Access Management (SICAM) Guidance and Roadmap
The Imperative for High Assurance Credentials: State Identity Credential and Access Management (SICAM) Guidance and Roadmap AAMVA Region I Conference E-ID, DLDV, and Privacy Conducting Business Securely
Status of the Industry: 2015 Global Information Security Workforce Study
SESSION ID: PROF-M01 Status of the Industry: 2015 Global Information Security Workforce Study MODERATOR: Julie Peeler Foundation Director (ISC)2 PANELISTS: Cheri Caddy Director for Cybersecurity Policy
Checklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security
Checklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security Ali Pabrai, MSEE, CISSP (ISSMP, ISSAP) For Daily Compliance & Security Tips, Follow ecfirst @ Agenda Review the
Privacy / Network Security Liability Insurance Discussion. January 30, 2013. Kevin Violette RT ProExec
Privacy / Network Security Liability Insurance Discussion January 30, 2013 Kevin Violette RT ProExec 1 Irrefutable Laws of Information Security 1) Information wants to be free People want to talk, post,
Security Transcends Technology
INTERNATIONAL INFORMATION SYSTEMS SECURITY CERTIFICATION CONSORTIUM, INC. Career Enhancement and Support Strategies for Information Security Professionals Paul Wang, MSc, CISA, CISSP [email protected]
Real World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services
Real World Healthcare Security Exposures Brian Selfridge, Partner, Meditology Services 2 Agenda Introduction Background and Industry Context Anatomy of a Pen Test Top 10 Healthcare Security Exposures Lessons
THIRD PARTY (VENDOR) SECURITY RISK MANAGEMENT
1 THIRD PARTY (VENDOR) SECURITY RISK MANAGEMENT IAPP KnowledgeNet Presentation Boston, April 24, 2012 About Kyle Lai 2 Kyle Lai, CIPP/G/US, CISSP, CISA, CSSLP, BSI Cert. ISO 27001 LA President and CTO
Managing Business Risk with HITRUST Leveraging Healthcare s Risk Management Framework
Managing Business Risk with HITRUST Leveraging Healthcare s Risk Management Framework Introduction This presentation is intended to address how an organization can implement the HITRUST Risk Management
Applying Framework to Mobile & BYOD
Applying Framework to Mobile & BYOD Framework for Improving Critical Infrastructure Cybersecurity National Association of Attorneys General Southern Region Meeting 13 March 2015 [email protected]
FedVTE Training Catalog SPRING 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SPRING 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov If you need any assistance please contact the FedVTE Help Desk here or email the
HITRUST CSF Assurance Program
HITRUST CSF Assurance Program Simplifying the Meaningful Use Privacy and Security Risk Assessment September 2010 Table of Contents Regulatory Background CSF Assurance Program Simplifying the Risk Assessment
EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA
EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA Paul R. Lazarr, CISSP, CISA, CIPP, CRISK Sr. Managing Consultant, IBM Cybersecurity and Biometrics January 21, 2016 PERSONAL BACKGROUND
(ISC)² Foundation Announces 2014 Information Security Scholarship Recipients
NEWS FOR IMMEDIATE RELEASE Media Contact: Alex Lyons Merritt Group, Inc. 703-390-1527 [email protected] (ISC)² Foundation Announces 2014 Information Security Scholarship Recipients 33 recipients of
HITRUST CSF Assurance Program You Need a HITRUST CSF Assessment Now What?
HITRUST CSF Assurance Program You Need a HITRUST CSF Assessment Now What? Introduction This material is designed to answer some of the commonly asked questions by business associates and other organizations
Stepping Through the Info Security Program. Jennifer Bayuk, CISA, CISM
Stepping Through the Info Security Program Jennifer Bayuk, CISA, CISM Infosec Program How to: compose an InfoSec Program cement a relationship between InfoSec program and IT Governance design roles and
CONTINUING PROFESSIONAL EDUCATION (CPE) POLICIES & GUIDELINES
(ISC) 2 CONTINUING PROFESSIONAL EDUCATION (CPE) POLICIES & GUIDELINES 2015 (ISC)² CPE Policies & Guidelines (Rev. 10, April 21, 2015) 2015 International Information Systems Security Certification Consortium,
Vendor Management. Outsourcing Technology Services
Vendor Management Outsourcing Technology Services Objectives Board and Senior Management Responsibilities Risk Management Program Risk Assessment Service Provider Selection Contracts Ongoing Monitoring
FedVTE Training Catalog SUMMER 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SUMMER 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov Access FedVTE online at: fedvte.usalearning.gov If you need any assistance please
How To Protect Yourself From A Hacker Attack
Cybersecurity Demystified: Information Technology Security Trends Joe Oleksak, Plante Moran Agenda Data Security Trends Example Attacks Industry Examples An Answer 1 Who Are The Victims? Targets - victims
Presentation for : The New England Board of Higher Education. Hot Topics in IT Security and Data Privacy
Presentation for : The New England Board of Higher Education Hot Topics in IT Security and Data Privacy October 22, 2010 Rocco Grillo, CISSP Managing Director Protiviti Inc. Quote of the Day "It takes
Developing National Frameworks & Engaging the Private Sector
www.pwc.com Developing National Frameworks & Engaging the Private Sector Focus on Information/Cyber Security Risk Management American Red Cross Disaster Preparedness Summit Chicago, IL September 19, 2012
Controls over CIS. Ryan O Halloran, Senior Manager KPMG Hobart. TAO Client Information Session. May 2015
Controls over CIS Ryan O Halloran, Senior Manager KPMG Hobart TAO Client Information Session May 2015 Agenda The KPMG presenters information: Ryan O Halloran Advisory Senior Manager, Hobart Tel: (03) 6230
Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University
Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University Andreas Athanasoulias, CISM, CISSP Information Security Officer & Security Consultant Brief introduction My career path
Be Afraid, Be Very Afraid!!! Hacking Out the Pros and Cons of Captive Cyber Liability Insurance
Be Afraid, Be Very Afraid!!! Hacking Out the Pros and Cons of Captive Cyber Liability Insurance Today s agenda Introductions Cyber exposure overview Cyber insurance market and coverages Captive cyber insurance
Logging In: Auditing Cybersecurity in an Unsecure World
About This Course Logging In: Auditing Cybersecurity in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that
HIPAA Overview and updates since HITECH and PPACA
HIPAA Overview and updates since HITECH and PPACA Presented by: Angela Miller, CMC, CHC Medical Auditing Solutions LLC 2013 (c)2013 Medical Auditing Solutions LLC 1 Learning Objectives Overview the high
Understanding changes to the Trust Services Principles for SOC 2 reporting
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding changes to the Trust Services Principles for SOC 2 reporting
The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II).
Page 1 of 7 The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II). Domain I provides a solid foundation for the governance of
EHS Privacy and Information Security
EHS Privacy and Information Security Resident Orientation 26 June 2015 Steve Winter CISSP, CNE, MCSE Senior Information Security Engineer Privacy and Information Security Office Erlanger Health System
October 24, 2014. Mitigating Legal and Business Risks of Cyber Breaches
October 24, 2014 Mitigating Legal and Business Risks of Cyber Breaches AGENDA Introductions Cyber Threat Landscape Cyber Risk Mitigation Strategies 1 Introductions 2 Introductions To Be Confirmed Title
www.pwc.com The data breach lifecycle: From prevention to response IAPP global privacy summit March 6, 2014 (4:30-5:30) Draft v8 2-25-14
www.pwc.com The data breach lifecycle: From prevention to response IAPP global privacy summit (4:30-5:30) Draft v8 2-25-14 Common Myths 1. You have not been hacked. 2. Cyber security is about keeping the
Organizational Structure What Works
Organizational Structure What Works Evan Wheeler Director, Omgeo Session ID: PROF-001 Session Classification: Professional Development Once you have gotten past the first few months, you will be presented
Third-Party Cybersecurity and Data Loss Prevention
Third-Party Cybersecurity and Data Loss Prevention SESSION ID: DSP-W04A Brad Keller Sr. Vice President Santa Fe Group Jonathan Dambrot, CISSP CEO, Co-Founder Prevalent Networks 3rd Party Risk Management
Art Gross President & CEO HIPAA Secure Now! How to Prepare for the 2015 HIPAA Audits and Avoid Data Breaches
Art Gross President & CEO HIPAA Secure Now! How to Prepare for the 2015 HIPAA Audits and Avoid Data Breaches Speakers Phillip Long CEO at Business Information Solutions Art Gross President & CEO of HIPAA
Risk Management: IT Vendor Management and Outsourcing
www.pwc.com Risk Management: IT Vendor Management and Outsourcing Definitions Third Party is any entity not under direct business control of a given organization. Many people equate third parties with
Auditing emerging cyber threats and IT controls
Auditing emerging cyber threats and IT controls Robert Baldi Director of IT Audit, ACI Worldwide Warren Fish Manager of IT Audit, ACI Worldwide Competency The trouble with competence is that it is always
What can HITRUST do for me?
What can HITRUST do for me? Dr. Bryan Cline CISO & VP, CSF Development & Implementation [email protected] Jason Taule Chief Security & Privacy Officer [email protected] Introduction
Managing Cyber & Privacy Risks
Managing Cyber & Privacy Risks NAATP Conference 2013 NSM Insurance Group Sean Conaboy Rich Willetts SEAN CONABOY INSURANCE BROKER NSM INSURANCE GROUP o Sean has been with NSM Insurance Group for the past
Privacy Liability & Data Breach Management Nikos Georgopoulos 1 st Athens Privacy & Data Breach Management Conference
Privacy Liability & Data Breach Management Nikos Georgopoulos 1 st Athens Privacy & Data Breach Management Conference N.G. Privacy Liability Insurance Presentation to Athens 1 st Privacy & Data Breach
Cloud Assurance: Ensuring Security and Compliance for your IT Environment
Cloud Assurance: Ensuring Security and Compliance for your IT Environment A large global enterprise has to deal with all sorts of potential threats: advanced persistent threats (APTs), phishing, malware
AUSTIN INDEPENDENT SCHOOL DISTRICT INTERNAL AUDIT DEPARTMENT TRANSPORTATION AUDIT PROGRAM
GENERAL: The Technology department is responsible for the managing of electronic devices and software for the District, as well as the Help Desk for resolution of employee-created help tickets. The subgroups
CyberSecurity for Law Firms
CyberSecurity for Law Firms Cracking the Cyber Code: Recent Headlines, Reinforcing the Need and Response Planning July 16, 2013 Making the Case Matthew Magner Senior Underwriting Officer Chubb & Son, a
THE AMERICAN LAW INSTITUTE Continuing Legal Education
1 THE AMERICAN LAW INSTITUTE Continuing Legal Education Mobile Technology, Health Care, and Data Security: Minimizing the Risks and Leveraging the Benefits June 26, 2014 Telephone Seminar/Audio Webcast
Cyber Security and Data Privacy Acumin Specialist Cloud Services
Cyber Security and Data Privacy Acumin Specialist Cloud Services Cloud Security Resourcing Information Assurance and Cyber Security Governance, Risk and Compliance Traditional Security and Business Continuity
Don t Get Left in the Dust: How to Evolve from CISO to CIRO
SESSION ID: CXO-W04 Don t Get Left in the Dust: How to Evolve from CISO to CIRO JC-JC James Christiansen VP Information Risk Management Accuvant [email protected] Bradley J. Schaufenbuel, CISSP
The Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant
THE MARKET LEADER IN IT, SECURITY AND COMPLIANCE SERVICES FOR COMMUNITY FINANCIAL INSTITUTIONS The Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant Agenda
Cloud Security and Managing Use Risks
Carl F. Allen, CISM, CRISC, MBA Director, Information Systems Security Intermountain Healthcare Regulatory Compliance External Audit Legal and ediscovery Information Security Architecture Models Access
Work Toward Your Bachelor s Degree
By completing a series of Walden s Professional Development courses, you can earn credits toward a number of bachelor s programs at Walden University. To receive credit, you will need to complete all of
Voluntary Cybersecurity Initiatives in Critical Infrastructure. Nadya Bartol, CISSP, SGEIT, [email protected]. 2014 Utilities Telecom Council
Voluntary Cybersecurity Initiatives in Critical Infrastructure Nadya Bartol, CISSP, SGEIT, [email protected] 2014 Utilities Telecom Council Utility cybersecurity environment is full of collaborations