1. The Practical Side of Meaningful Use:
What we learned from a Security Perspective
Presented to:
HIPAA Privacy and Security Summit 2018
Raymond Ribble
Founder & President
SPHER Inc.
CONFIDENTIAL
This document may not be reproduced, transmitted, or distributed without the prior permission of SPHER Inc.

2. SoCal RECs – Certified Service Partner
1500 Providers
800 Providers
From Paper
to Digital
Attestations
91% Success Rate

3. The Early Stages: How Meaningful was it?
Data Capture & Sharing
STAGE 2
2014
Adv. Clinical Processes
STAGE 3
2016
Improved Outcomes
Meaningful Use
Security Focused On:
Meaningful Use
Security Focused On:
Meaningful Use
Security Focused On:
Electronic capture of
patient PHI in standard format
More rigorous
Health Information Exchange (HIE)
Technology solutions tied to improved
health outcomes for patients
Conduct Initial Security Risk
Assessment to address ePHI
safety
Regular & Appropriate
Updates to SRAs and Review
Processes
TeleHealth solutions start to expand
Knowing who is logging in and looking at the data
System Audit Controls
Monitoring application audit logs
(b)
Electronic transmission of patient
ePHI across multiple settings,
increased exposure to data breach risk
More patient access to
Self-management tools
Increased monitoring obligations
Information System Activity Review
Reviewing all records in the application
(a)(1)(ii)(D)
Patient-controlled data portals
Access to ePHI through patient-centered
HIE. Monitoring access to the HIE
2100 Provider engagements over 5.5 years

4. Core Security Problems Observed
Lack of understanding of what PHI Security involved.
No Encryption, Weak Password Policies, Shared Kiosks
No System Back-ups in place
No Phishing or Ransomware monitoring
No Network Monitoring
No User Access Monitoring
Again, No Security Risk Assessment awareness
Security was NOT a priority

5. Major Problems & Concerns 2011 - Now
Strong network
Monitoring
75%
Some network
Monitoring
50%
No network
Monitoring 0%
No network
Monitoring 0%
Enterprise Hospital
Regional Health Clinic
Clinic
Private Practice
Yes-SRA,
User Activity Monitoring
Low
Some-SRA,
User Activity Monitoring
None
No-SRA,
User Activity Monitoring
None
No-SRA,
User Activity Monitoring
None
*ePHI Security was not and continues to be a Low Priority

6. Security Rule - Risk Assessment
Policies & Procedures
People
Information
Assets
Workforce Training
&
Evaluation
Security Management Process
Administrative
Safeguards
Assigned Security Personnel
Information Access Management
Measures, Policies, and Procedures to protect ePHI
CE & BA Facility Access and Control
Physical
Safeguards
CE & BA Workstation Security
Device and Media control
ePHI Transmission Security
Access Controls
Technical
Safeguards
Audit Controls
Integrity Controls
*MIPS requirements and heightened awareness are driving adherence

7. The Cyber-Security Landscape
Cybersecurity awareness and audit processes are lacking
Continuing convergence of EMR/EHR solutions
Unsecured health systems - remain vulnerable
Influx of personal/device IoT solutions
Insider threats are increasing
Phishing attacks increasingly sophisticated
Healthcare reform impacting change/upgrades
Breaches are accelerating: 171 million records in ‘17
© Copyright 2018 SPHER Inc.

8. Find the PHI here Desktops Laptops Tablets Paperwork/Files Printer
Copier
Physician’s BYOD
Medical Devices

9. Or here as well…

10. Layers of Security: Required
Policies & Procedures
Physical
Perimeter
Hosting
Application
ePHI
© Copyright 2018 SPHER Inc.

11. Artificial Intelligence detectors analyze the behaviors of
end-users within information systems to identify unauthorized access.
Machine Learning is then applied towards remediation, without
human intervention, when activity deviates from the norm.