Institute Discusses IG’s Role in Cybersecurity Preparedness
[caption id="attachment_15264" align="alignright" width="473"]
Institute Covered Hot HIM Topics
Opening the institute was Mark Segal, principal at Digital Health Policy Advisors, LLC and chair of the HL7 Policy Advisory Committee, who delivered a punch with information regarding the 21st Century Cures Act, interoperability, information blocking, and TEFCA. His message was clear, “privacy and security, combined with APIs, information blocking, and patient right of access will create new privacy and security opportunities and challenges.” Segal also spoke on the long-standing topic of a national patient identifier. “Although patient matching is very high on the [Trump] Administration’s priority list, a national patient identifier is very low on their priority list,” he said.Iliana Peters, JD, LLM, CISSP, former deputy director for health information privacy at the Department of Health and Human Services’ Office for Civil Rights, and current shareholder, health care services, at Polsinelli, further expanded on the need for secure data to combat cyber threats. She level-set her session by saying that “good data privacy and security is fundamental to ensuring patients’ trust in the healthcare system and to helping healthcare clients succeed in an ever-changing landscape of threats to data security.” Enforcement cases were highlighted, detailing the incident that caused the breach, how the organization handled the risk assessment, and the outcomes of such cases, including associated penalties. Other cybersecurity and cyber threat breakout sessions highlighted processes to avoid attacks, what current threats exist today, and what is anticipated in the future.
Information Governance and Cybersecurity Align
Additional sessions focused on information governance (IG) and how it aligned with cybersecurity, best practices, and information sharing with a business associate. Multiple panels allowed panelists to share experiences about their IG programs and recommendations/lessons learned in order to help attendees advance their organizations’ IG initiatives. A detailed overview of the protections in place for substance use disorder records under 42 CFR Part 2 were discussed, those required of the “lawful holder” for Part 2 information as well as new additions and changes in definitions within the rule. Disaster preparedness and business continuity is a topic of interest due to cybercrimes, but is also a particularly timely topic due to the many recent natural, weather, and fire occurrences. The General Data Protection Regulation (GDPR), the European Union privacy and security law, is a fairly new topic and one many in the United States have questions on. While this is a regulation of the EU, it does have an impact on organizations outside of the EU that exchange data with organizations within the EU.[caption id="attachment_15261" align="alignleft" width="431"]
The Sunday portion of the institute kicked off with a speaker from the United States Security Service Miami Electronic Crimes Task Force, who provided a national perspective of multiple current cyber crimes including spear phishing attacks, delivery of malware via distribution lists, and the importance of maintaining different passwords for both personal and work-related accounts to avoid “credential stuffing” and “password cracking.” The Miami Electronic Crimes Task Force work is focused on not just healthcare efforts but also electronic crimes associated with all regulated businesses. The speaker detailed threat factors to businesses and individuals in the US, such as point of sale breaches, which can impact a majority of Americans since the breaches are conducted through online sales and/or any credit card purchase.