Privacy & Security Policy Meets Technology at the Crossroads: Best Practice Methods & Approaches to Developing Organizational Frameworks to Avoid Collision HIPAA Collaborative of Wisconsin Fall 2010 Conference

 Survey Results  Why Data Protection is More Important Today  Challenges to Maintain Security & Compliance  Why Should You Have Business Process Management Controls  Review of Common Process Frameworks  Keys to Successful Business Process Management  Recommended Next Steps  Open Discussion

 Top Challenges  Current Frameworks in Use (by department or enterprise wide)

 Security has become a fundamental need and mandate  The risk and exposure to data and security breaches carries an increased cost ◦ Recovering from a security breach could cost thousands of dollars ◦ You may lose patient confidence and trust, whereby your reputation damages may not be recoverable  Medical Identity Theft is a Major Problem: onomy/health_care_fraud/index.htm onomy/health_care_fraud/index.htm

 Limited budget dollars for adequate security controls  Limited formal written policies, standards and procedures  Risk and Security Assessments not conducted on a regular basis, or have never been conducted

 Limited: ◦ Audit mechanisms to identify and report on security breaches ◦ Malware protection controls ◦ Written Incident Response Procedures  Unfinished or outdated Disaster Recovery & Business Continuance Plans  Inadequate Workforce Security Awareness Training

 Actual practices do not match formal policies, standards and procedures. For example: ◦ Mis-configured systems that do not match configuration and change management standards ◦ Weak passwords ◦ Shared accounts and passwords ◦ Unencrypted ePHI when sent through Internet ( & FTP) ◦ Audit controls do not detect modifications or deletes to medical records

 End Goal = Improved Process  Focus on: ◦ Efficiency ◦ Effectiveness ◦ Governance ◦ Reasonable & Manageable Budgets  Control Processes ◦ Leadership Involvement ◦ Configuration ◦ Change ◦ Problems & Incidents ◦ Security – CIA Triad Elements

Access, Authorization and Authentication ControlsEncryption and Digital Signature Practices Anti-Malware PracticesIncident Handling Practices Application Development PracticesLogging and Auditing Practices Asset Classification and Sensitivity PracticesOrganizational Security Policy Asset Management PracticesPassword Protection Practices Acquisition of New Company PracticesPatch Management Practices Change Management PracticesPersonnel Security Controls Configuration Management PracticesPhysical and Environmental Controls Communications and Operations ManagementRemote Access and VPN Practices Computer System Acceptable Use PracticesRisk Assessment Practices Data Backup PracticesSecurity Awareness Practices Data Retention PracticesSoftware Licensing Practices Disaster Recovery & Business Continuity PracticesWireless Security Practices

ServersWorkstations Intrusion Detection/Prevention SystemsSecurity Information & Event Management Systems Two-Factor Authentication SystemsData Leakage Protection Systems Database Access Monitoring SystemsIntegrated Security Appliances Firewalls / VPNVulnerability Management Systems Secure Cloud Computing InitiativesNetwork Admission Control Systems Encryption and Digital Control SystemsVirtualization Configuration Management Database SystemsHost Based Malware Controls

 Conduct a gap analysis to identify obvious processes that are not effective or efficient  Implement a process improvement project for these obvious process weaknesses ◦ Identify Key Leadership Stakeholders and Sponsors ◦ Budget for and Prioritize Project ◦ Identify Resources  Map workflow for each process  Define KPIs

 Create strategic and tactical documents for each process (Business Plans, Policies, Standards, Procedures, etc)  Monitor Progress  Add more processes until all key processes are included in the Process Improvement Program  Continually optimize

 ITIL Official Site -  Six Sigma -  COBIT - Center/COBIT/Pages/Overview.aspxhttp:// Center/COBIT/Pages/Overview.aspx  CMMI -  Center for Medicare & Medicaid Services: (  Center for Internet Security for IT Component Best Practices: (  National Institute of Standard and Technologies (NIST) for Best Practices Guides: (  U.S. Department of Health & Family Services HIPAA Page: (  Health Information Trust Alliance (HITRUST) site dedicated to HIPAA: (  Site for more HIPAA information: (

Thank you Larry Boettger Director, InfoSec Security & Compliance Group adtec Services, Inc International Lane, Ste. 101 Madison, WI Office: (608) ext. 306 Cell: (608) Fax: (608) LinkedIn Profile: