Category: Uncategorized

As of 22 February 2018, the Notifiable Data Breach (NDB) scheme went into effect and included in its requirements is a mandatory data breach notification.  Failure to correctly notify those affected by an eligible data breach can result in fines of up to $2.1 million, besides potential compensation for affected individuals.  There are certain things that every Australian organisation needs to be aware of when it comes to mandatory breach notification.

To Whom Does It Apply?

The NDB scheme applies to organisations and agencies that have personal security information obligations under the Australian Privacy Act 1988.  Such organisations and agencies include businesses, health service providers, credit reporting agencies, Australian government agencies, TFN recipients, and not-for-profits with an annual turnover of $3 million or more.

If an organisation …

• Collects personal information,
• Receives personal information on behalf of clients,
• Processes personal information on behalf of clients,
• Or holds personal information

Then they can be impacted by the NDB scheme.

If a breach occurs, the organisation and everyone involved in the chain can be affected, including marketers, data providers, brands, agencies, and similar partners.  In addition, if an organisation has clients, those clients may impose notification requirements to make sure they are in compliance with their own NDB obligations.

What Is an Eligible Data Breach?

Data breaches refer to unauthorised access of, the disclosure of, or loss of an individual’s information. If a data breach involves an individual’s personal information and this breach is likely to result in serious harm to said individual, then that breach must to be reported. This type of data breach is referred to as an eligible data breach.  Note that there are, however, some exceptions to the notification obligations.

What Constitutes Serious Harm?

While no hard and fast definition of “serious harm” has been provided, it is reasonable to assume that any type of harm – be it physical, psychological, or financial – would likely fall under the category of serious.  This is especially true of information of a sensitive nature or involving an individual’s health.  For example, loss of information involving medical allergies could result in life-threatening circumstances for an individual in a serious accident, or unauthorised access to financial information could result in identity theft and financial loss.

What Should Be Done When a Data Breach Is Suspected?

If a data breach is suspected, there are four key steps to be followed: contain, assess, notify, and review.  Of course, as soon as a data breach is suspected it should be contained to prevent any additional compromise of information.  Next, it should be thoroughly assessed by determining who was affected and what data was compromised, followed by risk assessment and, if possible, remediation.  The third step is notification. The final step is a review of the incident and developing a plan of action to prevent a similar breach from occurring again.

Who Needs to be Notified?

According to the Office of the Australian Information Commissioner,

“The NDB scheme introduced an obligation to notify individuals whose personal information is involved in a data breach that is likely to result in serious harm.”

In addition, the Australian Information Commissioner must also be notified of the breach, and this information can be submitted via an online form.

When Must Notification Take Place?

Notification must take place as soon as the organisation can determine what information was compromised and who was affected.

What Information Must Needs to be Included?

The following information must be included as part of the notification:

• The identity and contact information for the organisation
• A description of the data breach that took place
• The type of information that was involved in the breach
• Recommendations as to what steps the affected individual should take as a result of the breach

In terms of notifying individuals, there are two basic options available as to how the notification should take place: either notify all individuals or notify only the individuals who are at risk of serious harm.

If it is not practicable to notify individuals, then a statement about the breach can be published on the organisation’s website and then publicised.

What Happens When an Organisation Fails to Notify?

If an organisation fails to notify the affected individuals and the Australian Information commissioner of an eligible breach, fines of up to $2.1 million are possible.  However, there is also the possibility of compensation for affected individuals if there is a privacy compliance failure.  Compensation averages between $10,000 and $15,000 per individual if their complaint is successful.

Conclusion

Mandatory data breach notification is a critical part of the Notifiable Data Breach scheme, and failure to comply with notification requirements can result in hefty fines and compensation for those affected.  If you are an organisation in Australia that deals with any type of personal information, then you need to know what your responsibilities are and how to respond should an eligible data breach occur under your watch.

As providers are all too well aware, their payments from Medicare are affected by their score in the Merit-based Incentive Payment System (MIPS). MIPS imposes a number of requirements; if these are not met, payments may be reduced or denied.

The MIPS requirements apply to all Medicare claims, even those whose performance is not necessarily affected by a MIPS constraint. Among these universal requirements is the meaningful use of electronic health records (EHRs). Within the EHR requirements, we have the promotion of interoperability with other EHR systems, and within that, we have the security requirements. Among the security requirements is an annual security risk assessment.

What Has Changed?

In the Federal Register of July 27, 2018, the Centers for Medicare and Medicaid Services (CMS) proposes that the current security risk assessment requirement in MIPS be replaced. The suggested replacement will be an attestation to the activities included in the security risk assessment standard that has been performed in the past MIPS year.

This essentially switches the scoring of the security risk requirement from the equivalent of a numeric grade to a pass/fail scoring system. A practice or institution passes if it has done the assessment; how well it has done on the assessment falls by the wayside. The requirements are stated in a bare-bones fashion in the Code of Federal Regulations at 45 CFR 164.308.

CMS states that their rationale is, in part, a result of the realization that a risk assessment is done well, or not at all.

What A Serious Risk Assessment Entails

The thinking behind this can be found in the Office of Civil Rights (OCR) newsletter for April 2018.  This newsletter distinguishes a gap analysis (“find the holes”) from a security risk assessment (“make sure there are no holes”). It is a highly useful guide to discerning the scope and the level of effort required for a serious risk assessment.

An article on the HHS website goes into greater detail explaining what is subject to the security rules and why:

All e-PHI created, received, maintained or transmitted by an organization is subject to the Security Rule. The Security Rule requires entities to evaluate risks and vulnerabilities in their environments and to implement reasonable and appropriate security measures to protect against reasonably anticipated threats or hazards to the security or integrity of e-PHI. Risk analysis is the first step in that process.

The guidance issues from OCR noted that the CFR requirements are divided into two categories: required and addressable.

The addressable requirements are not optional. Rather, if the approach specified in an addressable requirement is not feasible, the provider organization must develop an effective alternative to approach to achieve the same end and document this. The tendency to document-but-not-implement should be firmly resisted.

Did You Really Do A Risk Assessment?

Experts suggest that OCR has significantly underestimated the time required to do a serious risk assessment. Obviously, you have to look at hardware-associated risks. Are the BIOS files in your desktops and laptops updated? Has router firmware been updated?

You must take a hard look at software-associated risks as well. Are operating systems patched? You must strategically assess administrative risks: are you enforcing complex password requirements? Are you using biometric identifiers? Is data access truly on a need-to-know basis?

A Helicopter-Level View Is Not Adequate

The reader may protest that those concerns are nowhere to be found in the guidance. True. The point is that an adequate risk assessment will have revealed these as questions that need to be asked on a day-to-day operational basis. A risk assessment that is not dynamic misses all the critical points of vulnerability.

A risk assessment should point out any unnecessary risks and then offer a solid plan to eliminate them. It’s good to remember that the whole point of the endeavor is to make sure that the government (and all organizations) move toward the better Internet and network security. With cyber breaches occurring on almost a daily basis, there’s every need to be more cautious about how we handle, store, and transmit Big Data.

The current cost of a data breach has reached between $1.3 million and $3.5 million. The number one most sought-after data that hackers are vying for is healthcare information. On the Dark Web, 30,000 up-to-date healthcare records will fetch a pretty price.

Conclusion

Under this proposed rule change, you will no longer be given a percent of compliance score on your risk assessment. You will simply be in or out of compliance. The upside is less administrative hassle; all you have to do is carry out the activities and attest that you did this. The downside is that this may lead to a relaxation of vigilance at a time when threats are constantly increasing.

Of course, you will be living in a kicked anthill for days. The trick is to make sure that all the scurrying around is not just mindless motion, but actually protects the organization by:

• Meeting legal responsibilities,
• Protecting the organization’s reputation to the extent possible,
• Immediately stopping intrusions and mitigating the damages,
• Finding out how the breach occurred,
• Repairing the vulnerabilities, and,
• Making sure your risk assessment, security plans, and operating procedures reflect any necessary changes.

Meeting Legal Responsibilities

The Health Insurance Portability and Accountability Act (HIPAA) breach notification rule essentially requires entities that have had a breach to inform the Department of Health and Human Services (HHS), the affected individuals, and in some cases, the media, within 60 days. There are exceptions, but these are best handled by lawyers. Since there are stiff penalties for not reporting security breaches that should have been reported, but no penalties for reporting security breaches that did not need to be reported, it’s best to err on the side of caution.

Protecting the Organization’s Reputation To The Extent Possible

It is unfortunately not true that there is no such thing as bad publicity. Your organization’s reputation is going to take at least a small hit. Perhaps the worst example possible is the behavior of Experian, a credit reporting service, in response to its massive data breach. They failed to report it, they did not notify affected individuals, they dribbled out information, repeatedly contradicted the information they dribbled out, and immediately tried to monetize the breach by selling protective services to those affected. Everything that could have been done wrong in the early phase was done wrong. Apply the Golden Rule here. Look at things from the perspective of those whose data has been exposed. What would they want to be done? Figure that out, and at least pledge to do that much.

Immediately Stopping Intrusions and Mitigating the Damages

The first step is to get the affected devices off the network and isolated, so they can no longer serve as points of entry. The next step is to check the system and audit logs to identify the source of the penetration. Thirdly, it’s important to force an immediate password change for everyone, if passwords are still being used. Of course, if the source of the breach is the medical director’s smartphone, which was left in an Uber, the only way this data can be remotely deleted is for companies using a Mobile Device Management plan.

Finding Out How The Breach Occurred

In some cases (see above), the source of the data breach will be glaringly obvious. In others, it may be very hard to find. Your own IT staff may be too close to the problem to see it. In those cases, bringing in a computer forensics firm may be useful or even essential. Determining the root cause of the breach, once the details are known, requires thinking through policies and procedures. You’ll need the skills of a good detective, combined with those of an excellent IT specialist.

As illustrated above, there is always a tradeoff between ease of access and security of access. Does everyone really need remote access to patient records at all times, using devices that can be lost or stolen? Depending on the organization and how it delivers services, the answer may be yes or no. But if it is “no,” serious consideration should be given to limiting remote access. Of course, if you’re working with a managed IT services provider, they can set you up with a Mobile Device Management plan so that any lost or stolen devices can be remotely wiped of all data.

Repairing The Vulnerabilities

Once the source of the breach and the root cause have been identified, the vulnerabilities need to be repaired. The issue of 24/7 remote access from stealable devices is one example. Use of cloud services is another. Having data in the cloud is wonderful. Having unprotected data in the cloud is not. Several recent breaches have occurred because, even though access to the cloud from an organization’s network was protected, the server in the cloud itself was totally open – no password in place. Granted, this defies imagination, but it has happened more than once.

If something like this has occurred, every policy and procedure that relates to the root cause needs to be looked at. This has to be done slowly and carefully; it is not an exercise to be carried out in panic mode. In most cases, this type of error will not occur if you’re working with a managed IT services provider. They have too many checks and balances in place to allow such a glaring mistake.

It most often happens to companies who employ poorly trained in-house IT staff who spend all day playing games and talking with friends on social media. Again, though this scenario is shocking, it is occurring across the nation with more frequency. Don’t let your CEO find out the hard way that his in-house IT people actually don’t have much network and computer experience. Their last job was serving up hamburgers at a local fast-food chain.

Making Sure Your Risk Assessment, Security Plans, And Operating Procedures Reflect Any Necessary Changes

Having a credible, annually updated risk assessment is part of the HIPAA Security Rule. A breach presents an opportunity here. If it occurred, your risk assessment either did not identify it or did not prioritize it; your security plan did not encompass it; your operating procedures ignored it, or some combination of the above occurred. The breach gives you a chance to rethink the security assessment, the security plan, and your operating procedures. Take advantage of it.

Conclusion

A data breach is painful, but it is also an opportunity for health care organizations to assess their security approaches and make improvements. Never waste a crisis. If you have onsite IT staff members, they may need more thorough training in security protocols. In fact, this is probably a good time to ask a local managed IT services provider to come out and hold security awareness classes for your entire workforce.

EdTech has a long history of being misunderstood, underutilized, and of lacking support in every way. It is one of those bugaboos in education that seems like such a wonderful idea, but often falls apart in execution as money fears cause administrators to scale back. Lacking proper follow-through lessens the efficacy of even the best in educational technology – and that’s just a plain old waste of money.

Educators need support, but it’s nearly impossible – and very expensive – to put together an in-house ed-tech support team. And with 80% of schools now using cloud-based data storage, adequate tech support is crucial. Districts are limited by their budgets and the size of their staff. Any large-scale upgrades or maintenance can take forever and tie up literally every member of the IT support team. When there isn’t anything big going on, layoffs have to come down. Otherwise, there are too many people drawing salary and benefits for almost no work. That’s obviously untenable, so the default is to simply under-staff and makes do (which never works out optimally).

It’s an unenviable position to be in as an educational administrator. The solution is third-party tech support services.

Schools Are Already Doing It, And It Works!

Transportation, software support, substitute teaching, accounting…the list of third-party contractors in education keeps growing. Utilizing a third-party support contractor makes even more sense than some of the other contracts your district may have. IT gets highly technical and specialized. The skill set necessary to cater to a school or district’s needs is worth more than most schools can afford – especially in the public school system.

Plus, districts usually have SaaS applications – “software as a service.” These are applications licensed by schools that have native help sections. SaaS as part of licensing contracts gives districts the ability to call for tech support via phone, email, chatbox, or scheduled in-person service calls. Contracting out for IT services in general works in much the same way.

Scalability

Imagine having extra staff available when needed who just disappear when the need is gone. Contracting with a firm gives the school access to additional staff in emergencies or planned maintenance. Jobs with a large scope can be planned ahead with the IT contractor, with funds set aside for the additional hours and workers needed for projects. Having a contractor already on the books makes it easier to plan and bring in more people. It makes communication stress-free because the third-party will already be familiar with the school.

Using a third party allows administrators to:

• Order staffing as needed.
• Expect efficient, effective response to emergencies like outages, virus threats, and data breaches.
• Ensure smooth, quick execution of planned upgrades with minimal disruption.
• Support staff by offering assistance to individual faculty members.
• Give faculty and staff immediate remote or in-person assistance.

Cost-Effective Expertise On Speed-Dial, Not On Staff

Even if a district is fortunate enough to have more than a skeleton crew of knowledgeable IT support staff, they likely won’t keep them long enough to become well-acquainted with the ins and outs of the district itself due to the comparatively low pay in school systems.

In Ron Schacter’s “Building An Ed Tech Dream Team” (District Administration March 2012), now six years old, school IT staff might expect to start at about $55,000 for basic support, but staff such as network architects will earn somewhere around $75,000-$80,000. Those IT workers could make a lot more if they went into the private sector, so they’re not going to stay long.

Thus, the supposed benefit of having someone in-house (i.e., their familiarity with the district’s needs) disappears. High turnover rates make for poor planning, disruption of services, and yearly retraining of a person or team upon whom everyone relies. It is poor planning that costs too much.

Moreover, with demands on educational technology growing, having a fully functional team able to respond to small and large-scale emergencies quickly grows too expensive for even larger districts. How can smaller districts or private, parochial, and charter schools possibly keep up? The reality is that many tried-and-true methods and educational tools simply won’t cut it anymore. The world is changing, including the field of education. Districts must find cost-effective ways to keep up.

Third-Party Support Supports Teachers

Teachers are not IT specialists. They are educators and must have the resources to teach. Put the power in their hands to use Ed Tech tools the way they were meant to be used. Stop using tech experts to restart computers and advise teachers to use Internet Explorer rather than Mozilla for their new application. Don’t make a teacher ask a kid from 4^th hour to fix a problem with the desktop. Being reactionary rather than planning ahead always costs more. Sound planning that includes using third-party tech support offers flexibility and cost savings that maximize the educational benefits of rapidly evolving educational technology.

Conclusion

Reluctance to change leads to wasted time and money. By hiring less than the bare minimum IT staff and paying professionals well below their value, schools open themselves up to larger scale losses in the long-run, including:

• High turnover requiring extensive, repeated searches for competent staff
• Purchasing the wrong tech for a school’s needs
• Purchasing something that is technically correct, but then cannot be fully utilized because the IT support is not there
• Inefficient research carried out by non-tech staff
• Network outages and unreliability cost time and money as well as loss of teaching time
• Loss of staff and faculty due to frustrations over a poorly maintained infrastructure

When it comes to schools, you simply don’t have the resources to waste.

Every day, it seems, another security threat is in the news. The latest one involves some flaws in Intel chips that actually introduce a new vulnerability. The patches are out to address this, and hopefully, someone in your IT organization is tracking and applying them. But this is only one of the many ways your company can be vulnerable to cyber-criminals.

Good Security Is Proactive

Patches have to be applied. That’s good. But it’s also reactive. Doing whatever the news of the day tells you to do in regards to security is not a security plan. So, what is? And what does a good plan look like? Proactive security measures address every potential threat.

Human Factors

The biggest risk to security, by far, is human actors. These include your own employees and bad actors outside the organization. Humans, as the story of former White House Chief of Staff, John Podesta’s hacked email shows, make mistakes. To review, Podesta got an email he found suspicious, asking him to change his Gmail password. He sent a memo to his IT department. The IT staffer involved meant to tell him it was suspicious but made a typo in his reply email and told him it was okay. So, Podesta went ahead and click on the link exposing his database to Russian hackers. What went wrong here?

Facepalm Moment!

There are lots of things, but the most fundamental of them is that if security is a real concern, one does not use a free, public email service for email. Whatever else was in place, this episode shows that the DNC’s approach to security was flawed at the most fundamental level. People working at the White House should not use free, public services for sensitive email. It is a safe bet that, if you examine your organization’s security posture closely, there is at least one such facepalm moment lurking somewhere.

People do stupid things. One of the jobs of IT security professionals is to anticipate those things and make sure they don’t happen. Moving from passwords, which can be insecurely stored, to biometric identifiers, is one way to do this. People can’t easily steal your fingerprints or iris.

Portable devices are another issue. Having 24/7 access to a business device is great. But is it necessary? Laptops and smartphones are eminently losable. Ask whether every employee who has remote access needs it. Make sure you can remotely erase your company data from their device if it is lost or stolen.

The boundaries between work and non-work life grow ever thinner. There is no need to deny employees access to personal email. But on the company email server? Have them take personal mail to a browser-based service. Keep work and personal accounts firmly separated. This is a basic step that every company could and should be doing.

Auditing (Gently) The Vendors

There are good reasons to outsource many IT functions. Day-to-day operations rarely require high level IT expertise. It can easily be obtained from IT consultants and managed outsource providers and used as needed. Moreover, using outsourced IT providers who have many clients allows your organization to take advantage of the mistakes that their other customers have made. Most IT professionals have seen and heard it all. Use of consultants is a very inexpensive means of knowledge transfer, far cheaper than developing the same experience with in-house techs.

Make sure the IT provider knows their stuff. You may find a few whose security is really no better than yours. This is where it’s so important to check the company out before hiring them. Check their feedback online. See what their customers are saying about them. Do they really know how to secure your data and records so that you don’t get hit with a ransomware virus? Will, they set up both onsite and offsite backups so you’re never without your data even if disaster strikes?

Needing To Know

Transparency is, in general, good. But when dealing with health information that is protected by regulations like HIPAA, less is more. That is, less access is better insurance against risk. No one should be deprived of the data they need to do their job. But with protected health information, no one without a need to know should have access. Coders may need to see the physician’s notes in order to properly bill for services rendered. Billers do not. All they have to do is charge for the codes that are given to them. They do not need access to clinical data.

Conclusion

These considerations are very basic. They require no esoteric knowledge. But thinking through them will help you arrive at your own conclusions about whether your data is really safe. Remember these basics:

• Be proactive about security.
• Never take lightly the human factor.
• Ensure third-party vendor security.
• Apply the “need to know” concept.
• Get help from a professional IT managed services provider if you still feel uneasy about your data’s security.