Episode #13 HIPAA Security and Issues Dental Offices Face

With alarming magnitude of today's ransomware issues, do you ever wonder if your network is as secure as it should be? The safety and security of your practice and patient data hinges on the quality of your cybersecurity protocols. In addition, effective team training and working with qualified business associates who understand their legal obligations under the law are also critical. Join the Divas for this informative conversation about protecting your practice and your patients!

                                                 https://www.thecompliancedivas.com

Transcript

Copy

SPEAKER_00 0:04

Welcome. I'm Leslie Cannon. I'm Mary Gavoni.

SPEAKER_01 0:09

I'm Linda Harvey. I'm Olivia Wan, and together we are the Compliance Divas.

SPEAKER_03 0:18

Welcome to this episode of the Compliance Diva podcast. My name is Linda Harvey, and I'm serving as your moderator today. Recently, you may recall the Divas spoke about key components of the HIPAA safe harbor law that passed this earlier this year. And today we're going to take it a step deeper and discuss cybersecurity. Maintaining effective cybersecurity is quite challenging today amidst all the different exploding cyber threats. So, as always, our goal is to bring clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. You can subscribe to the ComplianceDiva podcast through your favorite podcast channel or on our website, thecompliancedeevas.com. Any resources that we mentioned today will be found on our podcast during our podcast can be found on the Compliance Diva website. And you're also welcome to submit questions to support at the ComplianceDivas.com. Support at ComplianceDevas.com. For the past several years, security threats such as ransomware have increased at an alarming rate. So allow me to paint a picture for you. Imagine this. Ransomware gangs have been shifting their focus to managed service IT providers known as MSPs. An MSP is a company that provides comprehensive IT services such as monitoring your network. And this is quite profitable for the hackers to attack these managed service providers because if they gain access to one MSP, they could potentially reach their clients and exploit them for ransom as well. So another scenario that's also happening is the alarming fact that cyber hackers have been taking advantage of industries that have been hardest hit by the pandemic, such as healthcare. One recent example is the July 2nd Revel, R-E-V-I-L, ransomware attack that effectively locked down at least 200 different managed service provider companies and their clients through a remote program called CASEA. You probably saw this in the news. So while this is actually information that's appearing to paint a bleak picture, there are ways you can protect your practice and your patients by implementing recognized safeguards and controlling this risk as much as possible proactively rather than trying to control your potential losses once you get ransomware. So, Leslie, can I start with you and ask you real quick, what are some ways? Let's think about, you know, when you think about protecting yourself, I think of, you know, you have to have a good IT partner. So can you talk to us about the value of that and how somebody could make sure they're venting their IT company?

SPEAKER_00 3:11

Well, sure, Linda, I you know, I look at it this way. Uh we sometimes in dentistry uh are not performing procedures that are within our skill set. So for example, a general dentist might refer out complex oral surgery to an oral surgeon or a periodontist. And many times in dentistry, dentists are not usually uh well acquainted with the functions of the computers, the networks, the internet technology, um, how the software, the practice management software, and the imaging software speak to one another. So we hire an IT company to put that together for us. And there's many different IT companies out there that service businesses and help the machines talk to the internet and the printers talk to the server. However, they may not be acquainted with the healthcare industry and the rules that apply to us in healthcare with regards to HIPAA. So we need to make sure that even though we may have a well-intentioned and honest IT professional, maybe there's somebody in our neighborhood or somebody in our family that does this kind of work, we need to make sure that we are working with a company that is familiar with HIPAA and that meets the checklist because we're required as healthcare providers, uh, as covered entities, meaning that we're subject to HIPAA regulations, that we vet the company that we are working with. And I think that very few dental practices actually go through the vetting process to make sure that their technology company is HIPAA compliant within themselves. So, in other words, when they send someone into your practice to work on your server, uh, do they know for sure that that person isn't actually extracting information about patients or isn't actually installing some kind of a key logger software so that they can monitor the keystrokes that are taking place? And while that seems like this may be far-fetched, um unaware dental practices, and even well-intentioned uh owners of IT companies may have people, subcontractors that work for them that might have ulterior motives. So we need to vet the company, we need to make sure that they are willing to sign a business associates agreement with us. And that HIPAA requires that. That means that the IT company that we work with, they're the people that work with them and they themselves understand what their responsibility is with regards to patient data and reporting back to the dentist if there's any compromise to patient data on their end. The other part of that is that if they're not willing to sign a business associates agreement, this is not an IT company that understands HIPAA. So you should immediately start your search for a company that does deal with healthcare. And you might try and uh speaking with other uh colleagues in your area who find out who they use for IT and their and their practice management systems that uh talk to their internet and their other devices. Um, and then you also might, if you're unable to locate a reliable company, you might want to check with an association which is a professional organization, like the American Dental Association is a professional organization for dentists. A professional organization for computer IT people who specialize in dentistry is called the Dental Integrators Association or DIA. You can Google that association, and they have many referrals to different companies that understand HIPAA, that work specifically with the dental industry and uh will protect your practice in so much as they can. As you mentioned, you know, sometimes there's no way that you can be protected because it's outside of your control. But if you've done your part and HIPAA requires that you do a bit of an assessment and vet your vendors, if you've done your part, if you do have an incident, you'll be in much better shape at the end.

SPEAKER_03 7:29

Thank you, Leslie. I really liked your analogy about the skill set. You know, in on a dental team, we all have various skill sets. And one of them typically isn't technology, but sometimes the doctor or a family member or a patient, you know, dabbles in technology and they feel like they know enough to assemble their network, but they may not know all the changes that have occurred with how to monitor the network and maintain up-to-date software to protect yourselves. Olivia, did you have a thought?

SPEAKER_01 7:57

I do. We were performing a risk assessment with a client, and as a result, we gathered the business associate agreements, and their IT provider refused to sign the BAA and said candidly that they would not sign the business associate agreement and that they were not HIPAA compliant. So when I talked to the dentist about this, this was obviously a need to discuss finding a different IT provider that is accustomed to working in a healthcare environment.

SPEAKER_03 8:34

Olivia, that made my jaw drop. I don't know if our listeners heard that or not. But um, yes, that's one of the first things that you must have in place with any vendor that creates, maintains, access, or transmits your protected health information. And that's explicitly written into the federal laws. We took it a step further in the past couple of years with our clients and doing their risk analysis, and that we vetted their IT companies with a short questionnaire determining that they were HIPAA compliant. When was the last time they'd done their risk analysis? Uh, do they provide security training and HIPAA training? And how do they manage passwords for each one of their clients? So we could help our clients identify that their IT company did have best practices. So it's so very important. Uh Mary, you know, one thing I'm thinking about here is that with the podcast that Olivia moderated on the HIPAA-safe harbor law, we discussed some of the cybersecurity threats. So this would be a great place to kind of talk about some of those a little bit more detail. So can you help us there, please?

SPEAKER_02 9:36

Absolutely. I want to mention one thing though, in what I always advise the practices that I work with when they are vetting or interviewing an IT company, that they request of them some type of a presentation, doesn't have to be a long one, but to the team to help them understand at a very basic level about the security measures that are in place. Um and we have to ask them, of course, to be um speaking in all non-tech language because most people don't understand that. But if they can boil it down to maybe five to seven key points, that this is what you need to know about how your system works and what it does and why it makes such a difference, because many people just believe that this is all running in the background. I don't have to worry about it unless something happens. And when something does happen, then they don't know what to do. And so they also need, and I think Leslie, you're gonna you're gonna talk about this in a bit. Um, what to do if, you know, I I log into my workstation and there's the dreaded ransomware screen. What do I do besides scream and yell at that point? So um, and there is a specific protocol to follow. So we talked before about several things that are very common in terms of cybersecurity threats. And the two most common are email phishing attacks and someone again trying to validate that your email address is valid. They may be also checking to see if there's open ports on your server so that they can, through your email address, be able to get into your server, which is where all your patients' protected health information is, or a ransomware attack where they encrypt everything on your server so that you can't access it and you have to pay money to get access back. Theft or loss of equipment is not as common in dentistry. Um, although there was an instance a number of years ago where an optometry or an ophthalmology practice, I can't remember which one, had a number of laptops stolen that had actual patient information stored on those laptops. And that resulted in a very, very large fine in the hundreds of thousands of dollars to that practice for not having appropriate safeguards. And again, one of the things we found out during the pandemic was that many of our imaging devices were vulnerable. So hopefully everyone's had their IT company look at all of those, the milling machines, the um scanners, impression scanners, and any other imaging software and devices to make sure that they are secured as well with a firewall and security software so that they can't be hacked. But the other thing that I still struggle with with teams is that they cannot use their workstation computers for their personal business in the practice. That is not allowed under HIPAA. Well, we can go on the internet for other things, so why can't we do it? No, no, no, no. You need to go to the internet for maybe you need to go to the Delta Dental Toolkit or something. That is business of the practice. There are safeguards in place at your end, hopefully, and at Delta Dental's end to make sure that that there's less chance of that being hacked. But you know, going to your especially your personal Facebook page or your personal email. And so you need to do that on your smart device that is not connected to the um internet that is connected to the server. It needs to be on a whole separate IP address. And I tell the same thing to the doctors. I know it's your practice, but if you need to do personal business, then have a laptop, have a desktop computer, whatever you want. But it needs to be set up for the internet on a whole different network if you're doing personal business. So those are things that really need to be considered because the the email phishing and the ransomware attacks typically happen because people are going to websites that they shouldn't be going to when someone's tracking them or they're doing risky, um, risky behaviors. And your IT professional can actually block employees from going to those types of websites. So that should be part of the security plan for your practice.

SPEAKER_03 14:21

That is so true, Mary. You've hit the nail on the head with a number of the points that you made. And I'd like to add to that that last time I was on the Office of Civil Rights Wall of Shame, which is their public uh portal where you can see all the open breaches that are being investigated and did a search just for dental. The top three causes were phishing, ransomware, and theft. So absolutely, those are top three areas. And it's very important that we really understand how to protect. And I like the idea of having your IT partner come and do sort of an in-service, a little luncheon learn for the team and talk, talk, layman's talk and understand so we can they can take away tips and realize what each individual needs to do and not use the work computers for any personal business or just surfing the web or anything. Olivia, earlier I talked about uh trying to control risk proactively so we can try to prevent loss. But sometimes it's it's not always possible. Things happen through human error. We click on an email or somebody makes a mistake somewhere and something doesn't get turned on or updated on the network. And how else can a practice then work through transferring that risk, you know, with cyber risk insurance? What should a dentist and an office manager be looking at with those kinds of programs and insurance coverages? Can you offer some tips in that area?

SPEAKER_01 15:43

Yes, thank you, Linda. And of course, we could never control our risk, but we can manage risk. And so one part of that is to align ourselves with best practices for cybersecurity and getting into compliance with HIPAA's rules and requirements, and also getting insurance, and that will help us to mitigate risk. And I wanted to share with our listeners, I actually pulled my application forms. I have uh cyber risk insurance both for my law practice and for my consulting business. And so I had two different applications to share information from. And on one of the applications, and they called it a short form, there's certain underwriting questions that you would have to answer. For example, does the applicant have up-to-date active firewall technology, patch management procedures, multi-factor login for privileged access, incident response plan, updated antivirus active on all computers and networks, intrusion detection software, uh, sensitive data backup procedures, disaster recovery plan, business continuity plan, or equivalent. And I want to point the listeners' attention to this, and it states if applicable, is the applicant HIPAA compliant? And so if a dentist filled out this application and answered that the dental practice was HIPAA compliant and they were not, and there was an incident, you might receive a letter, a reservation of rights. And I've dealt with those as an attorney, and of course, I'm not giving legal advice over this podcast, but sharing information. Reservation of rights is basically an insurer's notification to an insured that coverage for a claim may not apply. Such notification allows an insurer to investigate or even defend a claim to determine whether coverage applies in whole or in part without waiving its rights to later deny coverage based on the information revealed by the investigation. And so if you had a breach, um a serious situation, of course, that's very expensive, and they reviewed your application, and you said you were HIPAA compliant, but yet you were not in compliance, guess what? The insurance company will not pay for that claim. So it's so important to get ourselves into compliance. And on the other questionnaire, uh, one of the questions that I wanted to share with listeners, it stated for each vendor that processes or stores personal information for you, do you have a written agreement that makes the vendor financially responsible for the consequences of a cyber attack or data breach? And the next question Do you require service providers to demonstrate adequate security? So, as Linda so well pointed out, as well as Leslie and Mary, we have to vet these vendors to assure that they too are in compliance. Another thing, too, Linda, for dental practices to incorporate is this business interruption insurance. Because if there is a breach that puts a dental practice out of practice for three weeks to a month, how will you continue to pay the expenses that keep rolling through your practice? And so this business interruption insurance will help cover those expenses. Another thing to think about is you know, if you have a cyber attack and you're having to notify your patients that there was a breach, obviously you're complying with the law with breach notification, but think about losing your credibility where an attack occurred and patient's information is at risk, their social security numbers, date of birth, addresses, so forth. And so serious information here to get ourselves into compliance and manage our risk effectively with insurance coverage. Don't just simply check the boxes that you're doing everything that you're supposed to do, but actually have these things in practice.

SPEAKER_03 20:21

Olivia, thank you. That is a second wealth of information today. So I hope our listeners are can we we played this podcast several times because there's so much valuable information. So first, I want to just mention the fact with the underwriting questions, when that policy is taken out for the first time or it's renewed, you have to ethically and legally answer those questions appropriately and not just check a box. Um, I'm aware of one of our clients reaching out to us just as we were working with them and getting ready to do that. We've completed their policies and procedures, we were scheduling the training. They reached out to us and said, Hey, you advised us about cyber risk insurance, we're looking into it. And now it part of this underwriting is asking us, do we have cybersecurity training? Are you going to provide that for us during our HIPAA training? So we naturally address that. We always have addressed cybersecurity training as part of our comprehensive HIPAA training. So there are many, many components of it. And sometimes ensuring that you have a qualified trainer is even important because, as Mary mentioned, you know, having your IT vendor come in and help do the training would be one idea. So you have really thorough cyber risk and security training because it's not about checking a box anymore. We can't check a box and say we're compliant. The laws are much more explicit than that. And when the investigations happen because of a breach or complaint, you know, they're they're looking at very detailed information. So I also want to mention uh a follow up, Olivia, on the point that you made about um vetting vendors, and Leslie and Mary have talked about that as well. When we work with third party companies that are sort of in our supply chain, that we aren't actually paying for their service, but they are serving. As part of our software subscription or another subscription that we have, but we know the name of, say, the imaging center, the imaging software, or whatever the service is, how do we reach through and ensure that that third party is vetted? Because we don't have a legal obligation to go that far, but we do have a legal obligation to be sure that our data is protected. So starting with your primary vendors is an important area. And if as we go along and later and wrap up, ladies, uh if anyone has any tips for our listeners about vetting third parties that are down the supply chain, I would love to hear for those. But Leslie, let's bring it back now around to the fact that if suppose someone gets a ransomware attack, they've they've put all the place things in place that everyone's talked about today during our podcast. What are top three things that you can think of that our listeners should do?

SPEAKER_00 22:49

Well, I consulted with a uh HIPAA expert who deals with cybersecurity breaches and security incidents. And she said the number one first most important thing to do is to stop, take a breath, and just consider your very next steps carefully. So the first thing that you can do, that you can actually do, is you can isolate your infected computer immediately. If you can unplug your Ethernet cable from the internet, that's the first step to preventing any further harm. Now, my uh expert told me that usually by the time someone realizes that there's something askew, uh, that it's probably too late. There's probably already been uh much that has been done, much damage that has been done, but maybe not. So you power off the effective devices, but also you don't want to do it in a way that's gonna corrupt any data. Because the next step is you're gonna contact your IT company, your trusted, vetted uh IT professional, and you're gonna uh have them do an analysis to see was it a security incident or was there actually a breach? And uh, you know, training is so important to prevent this in the first place. But what else is also important is to make sure that you have backups that are reliable and restorable backups. Because if you have safe copies of all of your data, then this threat is pointless if it's, let's say, a ransomware attack asking you for money in order to encrypt your or decrypt your data. So uh a restoration, even if it's a slightly older one, I'd rather I'd rather spend you know a few hours restoring data as uh that's maybe from uh that I missed today that's missing from that backup than having a week's worth of data or a month's worth of data or no data that where I have to restore everything. I think if you know, imagine if you uh walked into your office, turned on your computers, and your appointment schedule was not accessible, or your images or your patient files. It's like, you know, where do you even start to go back to even contact? Who do you know is going to walk in the door? And so it's to me that's just overwhelming. And that's where the take a breath is important. And uh one other thing I want to point out about your IT professional is that they should be more than willing to test a restoration of your backup. I've heard over and over again that uh people have asked their IT company, how do I know if my backups are really working? How do I know that that when I if something happens and I'm going to be able to restore my backups? Well, the IT company should be willing to do at least a quarterly full restoration to make sure that those backups are indeed uh backups that are that are uh doing what they're supposed to be doing. As far as uh other things to keep in mind is that uh as Olivia mentioned, you're gonna have some downtime. And some of the uh different programs that I have been tuned into lately as I'm tracking the most recent cyber attacks, is that uh it's possible that your business could be uh down for as long as 10 business days. So you do need to be prepared for the fact that you're not gonna be able to reopen your doors the next day. It may be several days. And so that's something that uh gives an opportunity for an analysis to be done to see forensically what information has actually been breached. And at that point, again, your IT company is going to be invaluable in guiding you in this uh what you would say this dissection of what actually occurred.

SPEAKER_03 26:42

Mary, what can you add to that for us? Excellent. Thank you, Leslie. Yes, yes, very good.

SPEAKER_02 26:47

With those recommendations. Um, one of the things I think, again, kind of like we talked in another podcast about eyewash stations, the backup drives sort of get to be um taken for granted in a practice. And if you're working very closely with your IT um professionals, they will recommend typically that you have an external hard drive or several that you rotate on a daily basis to do a local backup of your information and then you have a cloud backup as well, redundant systems. But make sure that if you're doing that local backup, there has to be what the the tech world calls airspace between that drive and your server, meaning that it is disconnected from the server in order to be safe from a ransomware attack or some other kind of a breach. So you may have to time when you actually run those backups. Some people will do it at night, leave it plugged in when they go home because it may take a while to run. You may have to adjust the time to make sure that you do have that airspace, or at least you have the backup, as Leslie said, from the day before. Um, because restoring your data from a local drive is going to be a much faster process than having to restore it just from a cloud backup. So those are some interesting things. And I'm so glad, Leslie, that you mentioned about pulling the Ethernet cable, because the first thing that people think they should do is just shut down your computer. And by the time you've done that, then you may have lost some of the evidence that needs to be gathered about a particular breach. So we pull the Ethernet cable first thing after after we take our deep breath. But make sure that you practice this. It's just like practicing for a medical emergency. What would we do if there was a data breach? Um, how how do we treat this? What do we do? Who do we call? And make sure that you feel comfortable that um your IT person has explained what that protocol is.

SPEAKER_03 28:58

Thank you so much. And listen, I want to circle back. I I think you you gave some really good tips to our listeners. And the first thing is we've got to take that deep breath because as soon as something happens, we don't expect whether it's a cyber risk attack or medical emergency or some other situation, we stop breathing and our minds stop thinking. So taking that deep breath, unplugging the computers from the internet, perfect, and um, and then calling your IT company. First steps are very important. And then you have that whole issue of whether or not to tell our patients and what do we tell our patients in the fact that if we have to shut down for a couple of days, because this is actually a crime scene, and cybersecurity and ransomware is an international crime. So we don't want to put that out on Facebook. We our staff should talk about it, not only among ourselves, not outside the practice, and come and deciding with the advice of your attorney what to tell your patients is going to be very important. So those are some key tips. Um, Olivia, did you have a thought on that?

SPEAKER_01 29:53

I wanted to share with our listeners that we had a dental office that reached out to us that had a breach, but it was in the administrative person's email account. So, problem number one, they were using a free email account. And when they determined that there was a very serious breach, which uh actually robbed the funds that were being wired for the purchase of an x-ray equipment, the forensics revealed that there were several different emails that had patient information, which triggered notification. At any rate, this process ended up costing about $100,000. But luckily, the dental practice did have insurance, and so the insurance plan covered the expenses of forensics, the attorney that was assigned, and notification. So, just once again emphasizing how important it is to manage this risk because these cyber criminals are staying one step ahead of us.

SPEAKER_03 31:03

So true, Olivia. And so staying, trying to stay up with them is a vigilant, ongoing process. So I'd like to also share a situation that for a client that came to us that was in the middle of a breach. And one of the first things they did was hire a new IT company because they had someone unqualified, a friend or someone taking care of their network, and they immediately spent $50,000 to that investment. So thankfully, working with a third-party breach expert as their instant response team leader helped them navigate their policy and all the correct steps. And they were able to really pretty much secure almost 100% reimbursement for all their expenses because of the type of insurance that they had, and the coverage was really good. Leslie, thoughts.

SPEAKER_00 31:47

You know, one of the things that is so important is employee training. And I had just this weekend had a hygienist email me with this question. She said, My office manager wants us to have annual HIPAA training. And she said, Is this required for my license renewal? I've never had this request to have HIPAA training. I've been with this practice for 20 years, and I don't understand why my office manager is so adamant about HIPAA training. And I responded back with that your office manager is very wise because this is required by HIPAA. And uh one common method for ransomware attacks is to trick employees into either providing their login credentials via a phishing link or downloading a file that contains malware. So this awareness training is so important. And uh, kudos to your office manager for uh coming to the realization after 20 years that this is what we need to do, especially in today's environment of severe cyber attacks happening everywhere with healthcare providers being very low-hanging fruit.

SPEAKER_03 32:57

Absolutely. So, so Davis, this is an amazing conversation. I think we probably could talk quite a bit more. There's so much to share, but we we've shared today the fact that you need to have a qualified IT partner, and Leslie's given us some tips on how to vet your IT vendor. Mary, thank you for revisiting the cybersecurity threats and helping listeners to be mindful of the training and areas of caution on related to email phishing and ransomware and theft, and Olivia's valuable tips on cyber risk insurance and what types of questions you're gonna have to answer to be able to ethically and legally respond to your insurance carrier and be in compliance. So, and Leslie, your three tips about how to react and respond if you do have a ransomware attack. So there's so much information in this. I again, I hope our listeners will take time and maybe even listen to some of our podcasts on HIPAA several times because this is complex information, it's newer information than what we're used to. And we think about infection control and ocean, some of those areas. And so I'd like to leave our listeners with a final thought. In today's world, effectively protecting your practice and your patients takes every bit as much effort and skill as it does to attract and maintain new patients. Thank you for joining us.