Source: https://andersontech.com/category/managed-services/
Timestamp: 2019-04-24 18:14:49+00:00

Document:
In part 4 of our HIPAA series, we dug deep into the Security Risk Analysis (SRA) and how to perform one. This time, we’re going to look at what to do with the SRA once it’s completed. The SRA serves as a starting point for fulfilling many of the standards of the Security Rule, but its most important function is to help you create a risk management plan to mitigate and monitor the risks you identified. The risk management plan will determine what actual changes you make to ensure your electronic protected health information (ePHI) and your business are safe from all reasonably anticipated threats.
In the SRA, risk is identified, current security measures are evaluated, and the potential impact of a vulnerability being exploited/triggered is determined. A risk management plan takes all that information and turns it into a plan of action. It prioritizes the risks with the greatest impact, puts plans in place to mitigate the danger, implements those plans, then evaluates whether the risk is brought down to reasonable and appropriate levels.
The SRA and the risk management plan together serve as the foundation for compliance with the Security Rule. If you’ve performed a thorough SRA and created a comprehensive risk management plan, many later standards may be fulfilled in the process of implementing the plan and mitigating the identified risks.
A comprehensive risk management plan also serves to satisfy several HIPAA standards.
164.308(a)(1)(ii)(B) – Risk Management: Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a).
164.308(a)(8) – Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operations changes affecting the security of [ePHI], that establishes the extent to which an entity’s security policies and procedures meet the requirements of [the Security Rule].
The first step of analyzing the data produced in the SRA is to prioritize which risks need to be addressed immediately and which can be addressed in the future. All risk eventually needs to be dealt with, but budgets, manpower, and immediate threats will all factor into how and when.
It’s vital that senior management is involved in the risk management planning process. Mitigating risk to a reasonable and appropriate level may require considerable investment of both time and money. New hardware infrastructure or outside help from IT professionals may be necessary, and employees’ time may be needed to create new policies and procedures and train staff. Even if the budget-makers aren’t involved in the SRA, having them involved in the risk management plan will help to prioritize what needs to be handled first, and allow them to see why the investment is necessary.
Once the risks are prioritized, the next step is to decide how to mitigate the possible danger. Just as with the rest of HIPAA, how this happens is determined differently by each company depending on the level of risk posed and the resources available.
What’s important to remember is that the goal is not to eliminate risk all together. If it’s possible to do so and still have a functioning and sustainable business, all the better, but for most businesses, the complete elimination of risk may be either too expensive or too prohibitive to actually continue fulfilling their core mission. The goal of mitigation is to reduce risk to a reasonable and appropriate level. Do all you can within your means to protect ePHI.
We cannot stress enough that while cost is one factor to consider in your mitigation strategy, it alone cannot be used to justify not mitigating risk if the likelihood of a threat and the potential impact are severe enough.
A comprehensive risk management plan is useless if it’s not implemented. Failure to put the new policies and procedures to safeguard ePHI into action throughout your company can result in the vulnerabilities you identified being exploited: exposing ePHI, your company losing trust, and incurring serious fines.
The objective is to institutionalize risk management into the day-to-day operations as a priority and an integral part of how organizations conduct operations . . . recognizing that this is essential in order to successfully carry out [business] missions in threat-laden operational environments.
NIST is talking about IT operations, but the same is true to all threats to ePHI. A culture of avoiding or mitigating risk at every level can produce a working environment that protects ePHI and strives to maintain security measures. Remember, the risk management plan is essentially a plan of action that must be put into practice to be successful.
Implementing your risk management plan won’t protect ePHI if, ultimately, the mitigation strategy you chose doesn’t work as expected. That’s why evaluating the success of your risk management plan after implementation is important. Once in place, you may find that what you thought would mitigate the risk hasn’t done so, or hasn’t done it as well as necessary to bring the danger down to reasonable and appropriate levels. Or you may find that while it does mitigate risk, it also causes severe difficulties in the day-to-day operations of your business. In these cases, another strategy may be more successful for your business in the long run.
§164.308(a)(8) also requires covered entities to “perform a periodic technical and nontechnical evaluation . . . in response to environmental or operations changes . . . that establishes the extent to which an entity’s security policies and procedures meet the requirements of [the Security Rule].” This means that subsequent SRAs need to be performed and your risk management plan re-evaluated whenever there are major changes to your business or IT infrastructure that could affect ePHI.
Like we mentioned in Part 3 of our HIPAA series, documentation is a constant part of compliance with the Security Rule, and the risk management plan is no different. Having a clear record of what you planned, when and how you implemented the plan, and the success or failure of those actions are necessary not only for your own future use but also in case you’re audited.
The most important thing to remember about risk is that it never ends and is always finding new ways to threaten your business. You have to keep moving right along with it. Risk management is a continuous cycle of analyzing risk, implementing a plan to fix it, determining if that plan worked, and repeating.
For some businesses, performing an SRA and updating a risk management plan might be an annual activity as part of their HIPAA compliance. Other businesses that have fewer risks and fewer changes to the business may decide to wait two or three years between SRAs. It all depends on what is reasonable and appropriate for your organization.
Just don’t stop moving through the cycle of risk management. Danger doesn’t stop changing, and neither should you.
If you need help implementing the IT requirements of your risk management plan, contact Anderson Technologies today at 314.394.3001 or email us at info@andersontech.com.
If you’re a regular reader of our blog, you might recall that we’ve written about Anderson Technologies’ avoidance of canned, one-size-fits-all solutions for IT. As a small business that specializes in serving other small businesses, we know that different clients have different needs. What works best for a small local nonprofit organization might cause more problems than it fixes for a bustling assisted-living facility.
The Kohn Partnership experienced this firsthand when they were looking for a new IT services provider.
We can put ourselves in their shoes and say, ‘This is what I would do for my business if I were you.’ I think that’s a value that you don’t get everywhere.
Chollet recalls that when she first started at Kohn Partnership, the firm only had a server without backups to the cloud. If something went awry, their one-man, paid-by-the-hour IT provider would come and perform a quick patch job. Though this was a solution for any immediate emergencies, Chollet knew that they could benefit from investment in a new server backup system or better IT services altogether.
“Like any business owners, we don’t have time to deal with anything unnecessary in our day and we certainly don’t want to deal with technology that we don’t understand causing us issues,” Chollet says. “It’s crucial to have somebody who will always be available to answer those questions for you, because they do come up, even if you try to be proactive about it.” For Chollet, moving to managed services seemed like the right option.
After transitioning to a different IT company who advertised remote service capabilities and made empty promises of new hardware, The Kohn Partnership decided to reevaluate their needs and priorities concerning tech. “Maybe we should look at that relationship,” Chollet remembers thinking of Kohn Partnership’s previous IT partner.
The final straw happened when they moved The Kohn Partnership to Office 365 and OneDrive. This enterprise-grade business software has numerous benefits, but to The Kohn Partnership, without guidance from a managed services provider, it was more of a hindrance than an upgrade. “No one was telling us proactively ‘don’t put your computer to sleep’ or ‘don’t turn them off when you leave the office,’” Chollet says. This led to broken processes and incomplete data syncing that, even though The Kohn Partnership had all new computers, were working less effectively than before.
I’m just going to get out a typewriter and write letters that way because it would be faster than having to deal with my computer.
The red flags that came up in The Kohn Partnership’s 2018 assessment were things that small businesses usually don’t realize they should be looking for, such as the lack of an enterprise-grade firewall and wireless internet routers—which their previous managed services provider should have immediately remedied. Since The Kohn Partnership deals with sensitive client data, ensuring they had a secure infrastructure was a top priority. And the issue with 365 had to be resolved in order to ensure their data was being replicated and shared internally properly.
They’re going to actually do what they say they’re going to do.
Anderson Technologies continues to assist The Kohn Partnership with onboarding new employees and installing hardware, including a high-speed scanner. Tax season is a very busy time for the firm, so it’s especially important that their computer infrastructure is now stable, ideally configured, reliable, and secure.
If your business IT needs some TLC (or even just a second opinion) contact Anderson Technologies today for a free consultation or call 314.394.3001.
Ring, Ring! It’s Voice Over IP!
Is it time to modernize your phone systems?
VoIP, or Voice over Internet Protocol, uses your internet connection for phone services. Rather than transmitting a voice signal over separate analog telephone lines, a VoIP user takes advantage of your computer network and the internet already in place to make a voice or video call. You may have heard of your network having an IP address. That’s the same Internet Protocol being used here.
While VoIP has existed for years, previous iterations proved expensive and unreliable, requiring a large investment for an often poor quality service. Businesses hesitate to invest in technology that had a rocky start. So what draws businesses to VoIP today?
In the era of high-speed internet, VoIP is cost-effective, high quality, and enables advantageous features like the continuity of using the same work number while out of the office on your mobile phone. Voicemail transcription to text, mobile apps, enhanced security, and the overhead savings involved in making the switch to VoIP now convince most businesses to drop traditional phone plans.
Is VoIP The Right Solution for My Business?
The answer to this question depends on the needs of, and willingness to change within, your individual business. While VoIP is an efficient solution for most small businesses, it doesn’t meet everyone’s needs.
Jeremy Richardson, an account executive from VoIP provider Vonage, explains, “Some businesses must have direct paging between phones, or actual ‘line’ numbers on the phones. Some of these are not available on VoIP.” If this service is integral to your business operation, there could be problems switching to VoIP.
However, for a business in which the traditional model isn’t working or is too expensive, VoIP could be the answer.
What Can VoIP Offer My Business?
Investment in VoIP can establish portability, convenience, and professionalism a modest upfront investment.
Richardson, who Anderson Technologies has worked with on past VoIP installations, says one of the biggest factors preventing businesses from making the switch is overthinking the setup and maintenance of a VoIP system and believing onsite support is necessary: “Many people associate using VoIP technology with having to be very tech savvy.” However, this is not necessarily the case.
VoIP phones often come pre-programmed or are easy to program on-site. “Once plugged into Ethernet,” Richardson says, “the phones and features can be easily adjusted and controlled from a user-friendly online dashboard.” After the initial set-up, the learning curve for these phone systems is far from steep. This is doable for any business, and with a managed services team, this process becomes a breeze.
Using a VoIP app, your cell phone can become a switchboard for any incoming calls to your work lines. In the event of power or internet outage, VoIP keeps your business online. VoIP providers offer “business call continuity and mobile apps to combat this issue,” Richardson says. Depending on your provider, you also have the options of three-way calls, call forwarding, video, and call waiting.
A fully-integrated VoIP system allows the flexibility of communicating any time and any place that has an internet connection—ensuring your customers and employees will always be able to get in touch with you. Some VoIP options include voicemail transcriptions to email or text for when phone calls aren’t convenient. When a caller dials your office number, you’re reachable from that number even if you’re travelling. If you have multiple base camps, like offices in multiple locations, your VoIP phone system can be configured to ring all office lines simultaneously.
In the past, companies purchasing phone systems used to pay $10-25k up front for 20+ users for a PBX (Private Branch Exchange) system, then pay separately for line service. VoIP operates on a different model, eliminating the need to acquire a PBX and instead uses resources in the cloud. VoIP lines may only cost about $20 each, and the price tag usually includes long distance at a better rate than most competitors. Per-line cost often includes each headset, so there are no big, up-front investments for equipment.
Price isn’t the only quality that’s improved over time. VoIP used to be known for dropped or poor quality calls, but as the internet becomes faster and more stable, with better network configurations, VoIP is proving itself with clearer calls than even landlines.
Quality of phone calls hinge on internet bandwidth, and setting up your network for Quality of Service (QOS), so it is important to partner with an IT services provider that can ensure your business has the optimal bandwidth for a VoIP network.
While security should be a concern, especially for work on the go, VoIP shouldn’t be considered a significant risk. “Knowing that there’s risk involved with both landlines and VoIP is important,” says Luke Bragg, Senior Systems Administrator at Anderson Technologies. “Neither is ever going to be completely secure, but there isn’t any more risk with VoIP than a landline.” When choosing a VoIP provider on your own or with the help of a managed services partner, look for encryption, redundant network infrastructure, and HITRUST security compliance. These tools allow technicians to quickly identify and resolve issues if any attempted security threats arise.
That’s something every business wants to hear.
Does Your Business Have the Proper Tools?
Internet network speed and setup is vital to the success of a VoIP system. Richardson often asks, “Do they have enough speed to support their phones and computers? Is the internet hardwired to the building?” Richardson notes that hot spots, satellite, and microwave internet have proven too unreliable for VoIP, and asks, “Does the business have hard-lined Ethernet to each phone?” While VoIP can potentially work on a WiFi network, this is not a configuration we would recommend.
For instance, if your network isn’t configured correctly, your VoIP call quality will suffer dramatically. You’ll probably need to add bandwidth to support the extra traffic, and VoIP traffic must be prioritized. Cost for this bandwidth shouldn’t be a prohibiting factor, either. Most VoIP systems can function using-100 kbps (kilobits per second) per user, however Anderson recommends 500 kpbs to 1 Mbps (Megabits per second) per user for optimal performance. Internet bandwidth has to be sufficient for not only the phone system, but email, web usage, and streaming. A managed services team can make these adjustments to ensure that VoIP is successful for your business.
Upgrading your internet is vital for quality of service. Your firewall must be set to prioritize phone traffic to ensure that phone conversations aren’t broken up or disconnected when another user begins a major data transfer. VoIP of ten or five years ago often had a reputation for broken or disconnected calls, but with the right bandwidth and configuration, that doesn’t have to be the story for you today!
The best setup, says Anderson, involves establishing a separate subnet from the main network so the phone traffic is isolated and not interspersed with other traffic. The solution for this is a Virtual Local Area Network.
With an upgraded network, VoIP is quickly changing the standards for call quality, flexibility, mobility, and organization.
Would you like to fully utilize the potential of your network? Anderson Technologies can help ensure that you have the proper tools to not only get a VoIP system up and running, but keep it running smoothly and efficiently. Contact us today on our website or by phone at 314.394.3001!
HIPAA Part 3: Document! Document! Document!
As you read through the Privacy and Security Rules for HIPAA, you’ll see a pattern that shouldn’t be taken for granted. Nearly all the implementation specifications require some form of policy and procedure documentation. This involves more than the reasoning and justification for how you choose to implement the specifications (though that must be documented as well). These are the policies and procedures that HIPAA expects your business to follow every day.
This article focuses on the last two standards: Policies and Procedures and Documentation, both of which lay the groundwork for HIPAA compliance. The other two standards shouldn’t be ignored, but they concern only those who: a) are or need a business associate or, b) are a sponsor to a group health plan that provides data beyond enrollment and summary information.
Note: If you work with or are a business associate that works with ePHI and your contract has not been updated since the HITECH Act in 2009 or the Final Omnibus HIPAA Rule in 2013, you will want to review and update all contracts to ensure they meet the current standards regarding business associates.
Why have an entire standard dedicated to something addressed in nearly every single implementation standard? This standard explains what HIPAA expects from the policies and procedures that a business creates. Specifically, it references the Security Standards’ General Rule of Flexibility of Approach, which is discussed in Part 2 of this series. It also allows for policies and procedures to be changed at any time to adjust to new demands or technologies, as long as all changes are documented and implemented accordingly.
must be recorded (physically or electronically) and retained for a minimum of six years from the date of creation or when it was last in use, whichever date is later. All documentation must be available to anyone who uses those procedures, and documentation should be consistently reviewed and updated as necessary.
Note: The six-year retention rule only satisfies HIPAA standards. State law may require some documentation to be retained for longer. Always verify what state laws apply to your business, as HIPAA does not supersede many state requirements.
It’s possible your business already has clear policies and procedures in place, but that doesn’t immediately make you HIPAA compliant. You still need to go through each one to ensure it satisfies the implementation specifications it pertains to. If not, policies may need to be updated or new ones added. HIPAA gives businesses a great deal of leeway in how policies and procedures are written, so both updating existing documentation and creating all new materials is acceptable.
What should the policies and procedures say?
At the end of an employee’s last day of employment with [company name], security and/or IT staff will remove that employee’s access to company systems and restricted locations and document the change of access. The employee’s supervisor will verify that all access has been revoked within twenty-four hours.
This offers clear guidance about what the company intends to do to remove access from someone who no longer is allowed to work with PHI. It also provides an implementation timeline, who should implement the policy, and how the company will ensure it gets implemented properly.
Go to [directory] and locate the list of all programs and devices employee had access to according to job title. Check this list against their user account to ensure no programs are missed.
Starting at the top of the list, go through each program and device and remove employee access. For procedures regarding specific programs, see [directory of procedures].
Go to Active Directory and find employee information.
Backup emails and save them to [directory] to be stored for a period of one year before deletion.
Backup any information relating to patient care in appropriate directories. See [directory list] for proper placement.
Disable user’s Active Directory account and change their password.
Document time, date, and your name in the Employee Termination log to indicate all access it removed.
Inform former employee’s supervisor when access removal is completed for verification.
Procedures should be as detailed as possible so that there is no ambiguity or confusion in what needs to be done. It allows newer employees to accomplish tasks they may not have performed before. There may also be multiple procedures related to the same policy depending on the duties of each person. Margret Amatayakul wrote an excellent guide to creating policies and procedures for the Journal of AHIMA (American Health Information Management Association).
Note: Both the Security Rule and the Privacy Rule require policies and procedures to be created. A company can combine relevant Security and Privacy standards into a single policy or create entirely separate policies for the Security and Privacy Rules. Each business should determine what is best for its employees.
Once you have your policies and procedures written and accessible, the next vital step is to train employees on them. HIPAA requires all employees to be trained in the policies and procedures related to their job. This training includes everyone from the maintenance staff to the CEO. Each time a policy or procedure is updated, retired, or replaced, the affected staff must be informed and, if needed, new training should occur.
Of course, maintenance personnel and CEOs won’t need the same kind of HIPAA training, just as IT support doesn’t need the same training as a nurse. HIPAA doesn’t dictate the way training happens, only that it happens. This means big companies that can afford professional training materials can do so, but smaller companies may hold informational meetings, allowing each to train the way that is most effective and makes the most sense for them.
Go through your employees’ job descriptions and separate employees by the level of access they have to PHI.
Create training programs for each level of access and/or the duties required in the job description so each employee gets the training suited to their job.
Don’t overload employees with policies and procedures that don’t relate to their job.
Ensure all training includes how to access the company’s policies and procedures in case employees need to revisit or reference them.
Ensure all employees know who to contact if they have any questions.
Along with training employees, HIPAA also requires you have clear consequences for not following the written policies and procedures. The types of offenses should be clearly defined and the disciplinary action enacted for every infraction.
One way a company might dictate levels of disciplinary action would be to clarify whether a break in policy or HIPAA standard was accidental, made through negligence, or of malicious intent. This allows various consequences for the same infraction without being inconsistent. An example would be: a) an employee leaving a workstation unlocked because an emergency situation demanded they respond immediately, b) they consistently forget to lock their workstation even after being warned about it, or c) they intentionally leave a workstation unlocked to allow someone without access to view ePHI. While the problem is technically the same, they don’t all deserve the same consequences. As with everything else, all infractions and disciplinary actions need to be documented and retained for six years.
In 2018, the Health and Human Services Office of Civil Rights reported 279 breaches of PHI, each resulting in at least 500 individuals affected, though often the number was much higher. Policies and procedures may feel tedious to write, but they provide employees with the information necessary to do their job in a HIPAA compliant manner and could prevent a breach of PHI.
For help with developing clear and secure policies for your company’s software and devices, contact Anderson Technologies at 314.394.3001 or by email at info@andersontech.com.
This is how Megan Branham, Executive Assistant at Plumbers & Pipefitters Local Union 562, describes the Union’s partnership with Anderson Technologies. The organization was in the process of planning a company-wide move to upgraded facilities and wanted to upgrade their IT at the same time.
Local 562 is split into two distinct halves: Union and Welfare Educational Fund (WEF). Branham’s focus was on the Union side of the organization, but the technology on the WEF side needed to improve as well. The two halves work hand-in-hand, so upgrading technology on both sides was a must. And since Local 562 is growing, they needed more than the one-man IT team that previously managed its systems.
An organization as large as Local 562 requires substantial deliberation when choosing a new vendor to partner with. They gathered quotes from many different managed services providers before making a decision. Many IT vendors had been recommended to various high-level employees, and narrowing down candidates wasn’t an easy process.
Branham knew from her experience troubleshooting Local 562’s day-to-day IT problems that they were looking for a partner that could tackle both the network overhaul required by the move and the everyday “What is XYZ?” questions.
One of the biggest factors was how the new IT vendor would mesh with her team. “You could say we have a lot of strong personalities,” Branham says with a laugh. Many organizations, both large and small, encounter resistance to change at some level; Local 562 was no different.
Once the partnership with Anderson Technologies was approved, planning for the move could proceed. The opportunity to take a fresh look at Local 562’s current technological status couldn’t be missed. Anderson Technologies and Local 562 together examined what could be improved – or completely restructured.
A study of Local 562’s dynamics helped Anderson Technologies determine the organization’s greatest needs, even when they were difficult to quantify. While each half of the Union performs some functions in conjunction, separate responsibilities needed to be divided. Branham describes it as “spreading everything apart but still making it easy to work together.” Previous IT solutions had muddled that line. Local 562’s sole business manager delegates operations to directors in the two departments. All of Local 562’s digital infrastructure was housed on one network.
The “separate-but-together” end goal split Union and WEF into their own individual server environments but consolidated all employees under one email domain—uniting the two departments. “I knew that there was a way for us to streamline all these things,” Branham says.
The physical move itself was a source of colossal stress for every employee of Local 562. “The Anderson [Technologies] team was very calm, and that’s really what we needed ,” Branham says, “because there was a lot of anxiety on the side of everyone here.” During the week-long move from a property in North St. Louis County to one that’s twenty miles west, Anderson Technologies was on-site through the weekend to create new separate domains, install new firewalls, configure the new servers, migrate user profiles, transfer server data, and put out any fires that happened to arise.
Coping with the technical logistics of the move was an anticipated challenge. Branham and the rest of Local 562’s employees expected to be unable to use their computers for an extended period of time during the ten-day move. Operations were planned to resume fully the following week. “I expected we would be back up running on Monday [a week into the move] for sure, hopefully it would get done over the weekend,” Branham recalls, “and I was using my computer on Friday morning. . . . I was floored.” Reducing Local 562’s planned downtime by several days allowed them to adjust to the move and return to work faster than expected.
If your business is ready to move from outdated headquarters, technology, or methodology, contact Anderson Technologies today for a free consultation.
In our first HIPAA article, we offered a little history on the Health Insurance Portability and Accountability Act and a general overview of how the Privacy and Security Rules evolved from it. In this post, we’re going deep into the murky depths of the Security Rule from a business standpoint.
HIPAA’s Security Rule may seem daunting at first, especially if you’re not an IT expert, but you don’t need a degree in computer science to understand the standards it establishes. At its core, the HIPAA Security Rule is about knowing what data you have, assessing the people and technology handling it, and finding where problems could arise. Survey, assess, plan, implement, and—most importantly—repeat. This is an easy way to think about and manage the requirements laid out in the Security Rule.
What Is the Security Rule?
The Security Rule sets the standards that entities creating, using, or transmitting electronic protected health information (ePHI) must implement in order to “ensure the confidentiality, integrity, and availability of ePHI . . . protect against any reasonably anticipated threats and hazards . . . [and] protect against reasonably anticipated uses or disclosures of such information not permitted by the Privacy Rule” (NIST). If you can imagine it happening to you, then you have to protect against it.
The Security Rule uses this phrase throughout. It’s a key tenet of its purpose, but what exactly does it mean to ePHI?
Confidentiality: Don’t allow anyone without proper permission to access ePHI, as described in the Privacy Rule, to see it.
Integrity: Ensure that the ePHI created, maintained, or transmitted isn’t altered in any way.
Availability: Ensure those with permission are able to access ePHI when they need it.
A quick way to think of these are “Don’t Show. Don’t Change. Can Use.” Keep these goals in mind when implementing the standards set forth in the Security Rule.
The Security Rule consists of 18 security standards divided into three sections: Administrative Safeguards, Physical Safeguards, and Technical Safeguards. Some of those security standards contain implementation specifications (36 in total), which provide more detailed instructions on what needs to happen to fulfill the security standard. The Security Rule designates these implementation specifications as either required or addressable.
Is the specification reasonable and appropriate? Implement.
Is the specification not reasonable or appropriate? Implement an alternate solution that would be.
Are there no reasonable and appropriate ways to implement the specification? Do not implement.
All assessments and justifications for not implementing a specification as stated in the security standard must be fully documented.
This is another phrase that appears throughout the Security Rule. Since the Security Rule affects a wide variety of businesses, it was designed with flexibility of approach in mind. Many of its standards and implementation specifications explain what needs to be done but not how to do it. How is left up to the individual business to determine based on its use of ePHI and its environment.
The size, complexity, and capabilities of the covered entity.
The covered entity’s technical infrastructure, hardware, and software security capabilities.
The costs of security measures.
Flexibility, scalability, and technology neutrality are key features of the Security Rule that allow businesses of any size or function to use the same standards and adjust accordingly to the evolution of technology. It’s important to note that cost alone is not enough of a justification to not implement a security standard. All factors need to be considered together when dealing with addressable specifications.
Before diving into the nitty-gritty of each security standard and the implementation specifications, evaluate what your business already has in place. Some of the requirements may be satisfied by the current security infrastructure. Read all the security standards once to get a feel for what you need to be assessing, then take the time to determine what measures, policies, and hardware already protect your ePHI. Knowing where you stand can save you time and stress while working toward HIPAA compliance.
Below we’ll address each section in a high-level overview and mention some of the important standards you should be aware of. This won’t be a step-by-step breakdown of all the standards and implementation specifications. For that, the Department of Health and Human Services (HHS) produced the HIPAA Security Series papers, which are extremely helpful, as is National Institute of Standards and Technology’s (NIST) An Introductory Resource Guide for Implementing the HIPAA Security Rule.
Administrative Safeguards make up more than half of all the standards in the Security Rule; however, this is also where many of your current systems might already be established to satisfy the requirements with little to no alterations.
The standards and implementations categorized under Administrative Safeguards involve the process of planning, selecting, and managing a business’s protection of ePHI. This includes, but is not limited to, emergency preparedness plans, policies and procedures, contracts, and employee management and training.
This category is all about knowing what you have, planning for the future, and making sure everyone in the company knows how to enforce the confidentiality, integrity, and availability of ePHI. It’s not enough to simply implement these systems, though. Everything must be documented, accessible to all who need it, tested and reviewed periodically.
Security Management Process §164.308(a)(1): This is the very first standard, and for good reason. Its implementation specifications require a risk analysis and continuous risk management. The information gathered in these steps will help with many of the other standards. The risk analysis can highlight areas of deficiency in your security that might otherwise appear only when a malicious actor finds and exploits it.
There is no single correct way to perform a risk analysis because all businesses have differing needs. If you are looking for where to start, there are many useful guides outlining the risk assessment process. The HHS’s HIPAA Series includes Basics of Risk Analysis and Risk Management, and Appendix E in NIST’s Introduction provides risk assessment guidelines. For a more comprehensive look at risk assessments, NIST also produced a Guide for Conducting Risk Assessments.
Workforce Security §164.308(a)(3) & Security Awareness and Training §164.308(a)(5): These two standards have seven addressable implementation specifications between them. These deal with verifying that employees have the correct access to ePHI according to the duties they perform, and that they are informed on how to protect themselves and ePHI from cybersecurity threats. It also deals with how management handles adding new employees and removing employee access as job duties change or if the employee leaves the company. Both management and employees are responsible in protecting ePHI, but they must be given the knowledge, tools, and policies to do so.
Contingency Plan §164.308(a)(7): This standard includes the creation or revision of several different emergency preparedness plans, including a Data Backup Plan, Disaster Recovery Plan, and Emergency Mode Operation Plan. Besides preparing both management and employees in what to do, who needs to do it, and where resources are in the event of an emergency, this standard also helps assess what hardware or software is critical to the confidentiality, integrity, and availability of ePHI. This allows better prioritization and distribution of limited resources. Such precise knowledge is especially important in facilities that provide direct patient care.
Physical Safeguards deal with the facility, hardware, and other physical mechanisms necessary to protect ePHI, as well as the policies and procedures that regulate them. These can range from locks on doors or security guards in times of disaster to employees logging off before leaving a workstation. If a person could walk into your office and access ePHI, the Physical Safeguards handle how to appropriately plan your security measures according to your needs.
Device and Media Controls §164.310(d)(1): Given the portability of data in the daily functions of modern business, it’s vital that any movable media containing ePHI be strictly logged, tracked, and disposed of when no longer needed. Even one lost USB drive containing ePHI is a breach of the Security Rule. This standard relates to all types of removable media, including laptops, flash drives, CD/DVDs, hard drives, and portable backups. It also deals with the re-use of these materials within the office, which first requires the proper removal and destruction of all ePHI.
Technical Safeguards deal with the technology used to create, access, transmit, and protect ePHI, as well as the policies and procedures that govern it. The Security Rule remains intentionally vague on the specific technology used to fulfill these standards to allow for advances in technology and the changes in security needs against new cyber security threats. This flexibility is also what allows a variety of businesses to handle ePHI and still comply with HIPAA’s Security Rule.
Technical Safeguards address aspects such as user access, hardware and software use, transmitting ePHI digitally, and encryption for various purposes. The Risk Analysis and Risk Management specifications from Administration Safeguards are especially useful in determining the technological needs and policies to enforce.
Integrity §164.312(c)(1): This standard refers directly back to the key phrase confidentiality, integrity, and availability discussed earlier. It’s not enough to protect ePHI from being accessed or transmitted improperly; ePHI must also be protected from improper tampering or destruction of data. Wrong or incomplete information can have drastic effects on patient lives and care, so the ability to authenticate the validity of ePHI is a vital part of its security.
A vital part of the Security Rule is not only assessments and creating policies but implementing them so all employees are aware of and following the rules. Systems should be in place to verify that employees receive the necessary training in ePHI security procedures and understand the consequences of not following the policy. Reassessment of policies and re-training of employees should occur periodically so outdated procedures can be re-written for the current threat environment. Cyber threats are ever evolving, so too should ePHI cyber protections.
While the Security Rule may feel a bit daunting, many of its requirements are best practices for any business. Knowing exactly what data you handle, how it’s processed, and who needs access to it provides you with an informed view of your business’s operations. Having a written and tested Disaster Recovery Policy, Contingency Policy, and Continuity of Operations Plan will save you time, money, and stress should an emergency occur.
If you have any HIPAA related questions or need help implementing the Security Rule’s technical standards, contact Anderson Technologies at 314.394.3001 or info@andersontech.com.
Are You Ready to Go Phishing?
Phishing and spear-phishing emails are an ever-present problem to businesses, and the criminals are only getting better at fooling people. Understanding and being able to spot phishing and spear-phishing emails is a vital part of employee training at Anderson Technologies. But reading about how to spot them and actually spotting emails are different things.
Worse yet, the phishing websites those email links go to often appear legitimate, right down to having the secure lock icon in the browser. In their 2018 1st Quarter Report, the Anti-Phishing Working Group notes that “more than a third of phishing attacks [reported to them] were hosted on web sites that had HTTPS and SSL certificates.” They attribute this in part to the fact that consumers believe they can trust all HTTPS sites, or they at least recognize a site without encryption asking for personal or financial information is not secure.
It’s vital to know whether your email is a legitimate business interest or a scam hoping to trap you, but how confident are you to do so? Take our quiz to see if you can tell the difference between a legitimate email and a fake one.
Are you an expert phisherman or just the phish taking the bait?
Hopefully you were an expert phisherman, but if not, it’s not too late to brush up on some basics.
Know what you’ve ordered and who your vendors are. If you didn’t order anything from the person, don’t trust their emails.
Always check the sender’s address before clicking on links or attachments, even if it looks like a company you trust.
Read the email completely before clicking links. Poor grammar or obvious spelling/branding mistakes are key signs of phishing emails.
If you’re unsure if an email is really from a company you trust, go to their website manually, not through a link provided in the email. If it’s real, you can look up the information through your account, and if not, you’ve just protected yourself.
Don’t panic! Urgent calls for action to avoid loss of service or legal action are meant to upset you. Don’t let them. Read everything carefully and verify there’s a problem by using the service mentioned or calling the company using the number on their website, not in the email.
If all else fails, Google it. These emails are widespread and a quick Google search will most likely bring up a hundred different people receiving the same fraudulent email.
If you’d like a refresher course on e-mail safety, contact Anderson Technologies to schedule an employee cyber security training seminar. Reach us by email at info@andersontech.com or by phone at 314.394.3001.
We strive to be the best in every area of our niche, and that includes our company’s values. Just as your company’s values are important to us, we know that ours are important to you.
Foundationally, these seven core values express the heart of our company, and they guide our team members both in the office and out working with our clients.
Be truthful and demonstrate strong moral principles. Act honestly, lawfully, and honorably. Hold yourself to the highest ethical standards. Accept responsibility for your decisions and actions.
Exhibit compassion for others by recognizing each person’s views and values in all communication. Be mindful of your interactions and treat everyone as you wish to be treated. Endeavor to provide honest feedback; share opportunities for improvement and give praise when deserved.
Show commitment to your work and persistence to see all tasks to the highest standard of completion. Strive for excellence. Apply due diligence and resolve to deliver results that clients appreciate and value. Move quickly past failures and learn from mistakes. Take pride in and ownership for all you create.
Work together with colleagues to produce unsurpassed results. Assist in helping everyone engage to the best of their ability. Communicate openly and seek to contribute your value in a way that benefits the entire solution. Foster a collaborative environment with a shared sense of purpose.
Strive to be trustworthy and reliable. Demonstrate you can be counted on when needed – whether internally or externally – to assist in achieving goals and delivering solutions.
Assess and initiate tasks when opportunities arise. Adapt to spontaneous situations with an eagerness to rise to the occasion and master new challenges. Look for ways to improve processes and develop skills.
Identify each client’s needs, principles, and insights – not just for the work at hand but also for the ways these elements help achieve overall business goals. Appreciate each client’s nuances and apply your knowledge to enable a rewarding partnership. Strive to meet clients’ needs with service and solutions that exceed their expectations.
Core values are the building blocks of Anderson Technologies, and they help us provide you with unparalleled service. For more information about how our core values can make a positive impact on your small business, call 314.394.3001 or email us info@andersontech.com.
Everyday reliability keeps your business running smoothly. But sometimes situations arise that require an extra layer of dependability. When an important client is visiting or you’re preparing for a major event, the last thing you want to see is the “No Internet Connection” notification at the bottom of your computer. A downed server, network, or website can bring your entire operation to a standstill.
Such was the case with The St. Louis Children’s Choirs (SLCC), a nonprofit organization serving around 500 students in the metropolitan area. “We have six different ensembles for students grades one through twelve,” explains Choir Director Dan Mayo. “Based on a combination of age and where a student might be in terms of their musical development, we’ll place them in the best fit ensemble.” SLCC presents four major concerts each year, giving aspiring choral students the opportunity to sing for their communities in settings both small and large, including Powell Hall, the home of the St. Louis Symphony Orchestra.
2018 is an important anniversary year for the organization, so extra fundraising pushes, coordination with alumni, additional concerts, and the milestone 40th-anniversary gala meant more promotion and web traffic than ever. “It’s been a crazy year,” Mayo says. But juggling all the duties associated with a significant anniversary becomes much more difficult if your tools keep breaking.
“We were having issues with server and internet downtime, a lot of phone downtime as well,” Mayo explains. Acting Chief Operating Officer Pam Jones knew Mark and Amy Anderson through a relative and was subscribed to the IT TechWatch newsletter. When SLCC decided to upgrade their IT vendor, Anderson Technologies was a clear contender.
“I was grateful that Mark didn’t come in and just try to sell us on the hype,” Mayo says. “Mark was just an honest guy who came in and told us what he thought we needed to address, and we just got a great vibe from him.” The team’s knowledge and reliability spoke for itself as well. Our managed services experts have tackled all of SLCC’s problem areas with other clients, leaving a track record of success and innovation.
“We felt really confident in the level of work that [Anderson Technologies does],” Mayo recalls. “We just had a feeling that we were going to be in very good hands.” SLCC officially signed on for managed IT services in February 2018.
The most important project Anderson Technologies completed with SLCC was a situation no one expected. When SLCC’s website was hacked in early 2018, Anderson stepped in to mitigate the damage.
SLCC’s previous IT vendor was unable to recover the site from a malware attack, leaving our team to migrate the site to our own hosting servers and restore a backup copy. Anderson Technologies Director, Farica Chang, who has years of experience implementing website security and mitigating malware problems, addressed the attack immediately. Several plugins, pages, and custom icons had been deleted, requiring a piecemeal approach to return the site to its original state.
What kind of music do you expect to make when your instruments are out of sync and out of tune? SLCC knew it was time for hardware upgrades, but they weren’t sure where to start.
“We needed some new equipment, and we needed some people to think outside of the box a little bit,” Mayo says. “It just didn’t seem to be a priority for the group we worked with previously.” When seeking a new managed services provider, SLCC made hardware innovation a priority.
One aspect in particular SLCC needed updated was their storage methods. “At the time we were keeping large physical hard drives here on site and not really backing them up,” Mayo says. SLCC required a way to store massive media server files and student information in a failsafe, secure way.
Network reliability is another area of improvement SLCC wanted to focus on. Mayo in particular struggled with the wireless connection in the rehearsal room, an area that also houses his daily office. Spotty internet service and wireless coverage led to big problems like losing valuable work time or dropping calls over their VoIP phone system.
For more information about how Anderson Technologies can tune your IT to make sure every note is perfect, contact us here or call 314.394.3001.
Over the past 20-plus years, Anderson Technologies has seen what works really well in the IT industry and what should be avoided. Simply completing a project is the bare minimum needed from your IT partner and shouldn’t be where managed services ends. Along with technical knowledge and skill, three key traits improve the relationship between client and IT team more than any other – excellent communication, logical systemization, and earned trust.
One of the primary reasons you hire a managed services team is for their technical expertise and they should be capable of handling most any technical challenge you face. This really isn’t a secret! Additionally, dedication to maintaining a high level of technological skill should be key for any IT firm.
It can be difficult to determine if a managed services provider prioritizes technical skills, especially for a small business owner who isn’t familiar with the technology industry, but there are a few clues for the layperson. In addition to checking their history and references, information like certifications, education, and satisfied customers can reveal much about a managed services provider, even before they’re hired.
Fixing what’s broken is the fundamental requirement for any managed services team but when building the Anderson Technologies team, technical knowledge and skill is only the first ingredient we look for, and just the beginning of the “secret sauce” of IT services.
A huge part of managed services is acting as an interpreter.
Every industry has its own language, whether it’s attorneys, dentists, nonprofits, finance, manufacturing, engineering, etc. It’s probably easy to remember an incident when communication was a barrier rather than a bridge. The best managed services providers can explain a problem and its solution in laymen’s terms as well as industry-specific vernacular, and easily translate between the two for clients. Poor communication between system administrator and client makes gathering accurate information and completing a project successfully unnecessarily difficult.
Clear communication is vital to not only providing clients the best service but helping them understand what needs to be done and why it is important.
Hand-in-hand with excellent communication are the systems and processes a managed services provider follows to deliver truly excellent service.
A huge part of systemization is establishing ideal methodologies and creating processes and specialized documentation designed to produce consistent, repeatable results. Taking the time to develop these best practices and build a structure around them can be easily overlooked by busy entrepreneurs. Members of an effective managed services team should be enthusiastic about combining technical and communication skills into this vital process documentation. Keeping accurate and detailed records not only helps you, the client, but maintains a consistent level of service throughout the team and ensures requests are resolved quickly and correctly.
Systemization and record keeping aren’t incidental to the best managed IT services teams – it should be built into their approach from the beginning. Included in Anderson Technologies’ managed services plans are an extensive client onboarding process, regularly scheduled proactive maintenance designed to prevent breakdown, periodic audits of client infrastructure, systems for tracking project progress and responding to user support calls.
Process documentation and customized methodologies enhance the performance of managed services providers, and, even more important, the performance of the client.
For some IT firms, an individual’s technical ability trumps everything else. But the system and network administrators hired to interact with your most confidential data and technological vulnerabilities should be a team you can implicitly trust.
When building our managed services team, Anderson Technologies seeks those who align with our core values: Integrity, Respect, Dedication, Team-Oriented, Dependability, Initiative, and Client Focused.
These qualities are the most important ingredients in our “secret sauce.” They define our organization’s character, which has been developing over two decades. It is who we are as a team and what we represent and strive for every day as a company.
The best managed services firm goes beyond that skill to provide service on another level. Excellent communication, logical systemization, and earned trust combine to make the secret sauce that comprises an IT managed service that truly shines.
Anderson Technologies looks forward to sharing our “secret sauce” of managed IT services with you. If you need assistance, call 314.394.3001 or email info@andersontech.com.

References: §164

§164
 §164
 §164
 §164
 §164
 §164
 §164