Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential Fourth and Goal: Score with Meaningful Use Incentives and Security Risk Assessments Jose Martinez, CCNP, CCVP, MCSA Network Engineer October 7 th, 2014

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential Objectives Explain security risk assessments and discuss why they are beneficial Discuss the five most common reasons for security breaches in the healthcare field Discuss the five most common security risks we’ve encounter at Texas Community Health Centers and learn how to mitigate them

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What is a security risk assessment? Helps your organization ensure it is compliant with HIPAA’s administrative, physical, and technical safeguards Helps reveal areas where your organization’s protected health information (PHI) could be at risk Covered entities are required by HIPAA security rules to conduct a risk assessment of their healthcare organization

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What are the benefits? Spurs discussion about current policies, procedures, and security practices Boosts communication Security risk assessments are also part of incentive programs such as Meaningful Use

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What is a security breach? A breach is defined as “an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual.” Source:

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential The 5 Most Common Security Breaches 1.Lost/stolen equipment or printed material 2.Compromised password 3.Out-of-date software / Software vulnerabilities 4.Poor employee security practices 5.Malware/virus infections

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential The 5 most common security risks found in Texas CHCs 1.Unencrypted portable devices 2.Weak password policies or enforcement 3.Outdated software 4.Missing a centralized anti-virus solution 5.Poor user permissions on file shares or desktops

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What can I do?: Unencrypted portable devices Implement BitLocker or other disk encryption tool Implement a policy prohibiting PHI on any portable devices Use encrypted USB devices Why? Unencrypted devices are the number one reason for security breaches Whether or not the data on the device is used, it is still considered a security breach

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What can I do?: Weak Passwords Revisit your password policy Consider increasing minimum password length to at least 8 characters with complexity Enforce your existing policies Why? Hackers have complied password files with billions of real passwords that have been exposed through security breaches As of 2011, available commercial products claim the ability to test up to 2,800,000,000 passwords a second on a standard desktop computer using a high-end graphics processor.

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What can I do?: Outdated software Implement WSUS for Windows Updates Consider systems management software for other updates such as Adobe Flash, Adobe Reader, Sun Java, etc. Create a list of software used by the organization Why? Most hackers exploit vulnerabilities found in old software Victims are sometimes targeted but most attackers are opportunistic

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What can I do?: No Centralized AV Solution Implement a centralized anti-virus solution Assign someone to keep track of anti-virus definition updates (small environments) Why? No insight to the status of clients without checking each computer individually Greater control over virus definition updates and outbreaks

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential What can I do?: Poor user permissions Implement Active Directory Lock down the permissions on folders with sensitive data Document the location of all PHI in your environment Why? Improperly set permissions can lead to unauthorized access Remove administrator rights to user desktops

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential Questions? ?

Company Proprietary and Confidential Texas Association of Community Health Centers - Proprietary and Confidential Contact JJ Martinez CCNP CCVP MSCA Network Engineer x2100