The Practical Side of Meaningful Use: What we learned from a Security Perspective Presented to: HIPAA Privacy and Security Summit 2018 Raymond Ribble Founder & President SPHER Inc. CONFIDENTIAL This document may not be reproduced, transmitted, or distributed without the prior permission of SPHER Inc.

SoCal RECs – Certified Service Partner 1500 Providers 800 Providers From Paper to Digital 2100 + Attestations 91% Success Rate

The Early Stages: How Meaningful was it? 2011-2012 Data Capture & Sharing STAGE 2 2014 Adv. Clinical Processes STAGE 3 2016 Improved Outcomes Meaningful Use Security Focused On: Meaningful Use Security Focused On: Meaningful Use Security Focused On: Electronic capture of patient PHI in standard format More rigorous Health Information Exchange (HIE) Technology solutions tied to improved health outcomes for patients Conduct Initial Security Risk Assessment to address ePHI safety Regular & Appropriate Updates to SRAs and Review Processes TeleHealth solutions start to expand Knowing who is logging in and looking at the data System Audit Controls Monitoring application audit logs 164.312 (b) Electronic transmission of patient ePHI across multiple settings, increased exposure to data breach risk More patient access to Self-management tools Increased monitoring obligations Information System Activity Review Reviewing all records in the application 164.308(a)(1)(ii)(D) Patient-controlled data portals Access to ePHI through patient-centered HIE. Monitoring access to the HIE 2100 Provider engagements over 5.5 years

Core Security Problems Observed Lack of understanding of what PHI Security involved. No Encryption, Weak Password Policies, Shared Kiosks No System Back-ups in place No Phishing or Ransomware monitoring No Network Monitoring No User Access Monitoring Again, No Security Risk Assessment awareness Security was NOT a priority

Major Problems & Concerns 2011 - Now Strong network Monitoring 75% Some network Monitoring 50% No network Monitoring 0% No network Monitoring 0% Enterprise Hospital Regional Health Clinic Clinic Private Practice Yes-SRA, User Activity Monitoring Low Some-SRA, User Activity Monitoring None No-SRA, User Activity Monitoring None No-SRA, User Activity Monitoring None *ePHI Security was not and continues to be a Low Priority

Security Rule - Risk Assessment Policies & Procedures People Information Assets Workforce Training & Evaluation Security Management Process Administrative Safeguards Assigned Security Personnel Information Access Management Measures, Policies, and Procedures to protect ePHI CE & BA Facility Access and Control Physical Safeguards CE & BA Workstation Security Device and Media control ePHI Transmission Security Access Controls Technical Safeguards Audit Controls Integrity Controls *MIPS requirements and heightened awareness are driving adherence

The Cyber-Security Landscape Cybersecurity awareness and audit processes are lacking Continuing convergence of EMR/EHR solutions Unsecured health systems - remain vulnerable Influx of personal/device IoT solutions Insider threats are increasing Phishing attacks increasingly sophisticated Healthcare reform impacting change/upgrades Breaches are accelerating: 171 million records in ‘17 © Copyright 2018 SPHER Inc.

Find the PHI here Desktops Laptops Tablets Paperwork/Files Printer Copier Physician’s BYOD Medical Devices

Or here as well…

Layers of Security: Required Policies & Procedures Physical Perimeter Hosting Application ePHI © Copyright 2018 SPHER Inc.

Artificial Intelligence detectors analyze the behaviors of end-users within information systems to identify unauthorized access. Machine Learning is then applied towards remediation, without human intervention, when activity deviates from the norm.