ZenGRC

Simply Powerful GRC

Blog

Benefits of Big Data in the Healthcare System

· ·

Big data offers the potential for huge advances in corporate performance, customer service, and economic growth across a host of industries—but big data also delivers different benefits across a host of industries. So what, specifically, does big data mean for the healthcare industry? 

Healthcare certainly generates huge amounts of data: electronic health records (EHRs), clinical data, patient records, billing records, prescription data, medical devices, and more. The volume of data is enormous. 

At the same time, however, the security risks of that data are sky high. 
The issue with big data in healthcare is that almost all that data is subject to Health Insurance Portability and Accountability Act (HIPAA), which protects the privacy and security of personal healthcare information. Businesses handling protected healthcare information (PHI) must comply with HIPAA, or face potentially severe monetary fines and other consequences if they don’t. 

There is no question that big data can improve the healthcare sector. According to an article in the January 2018 journal of NEJM Catalyst, “Using big data analysis to deliver information that is evidence-based will, over time, increase efficiencies and help sharpen our understanding of the best practices associated with any disease, injury, or illness.”

The more difficult question is how to employ big data to improve healthcare, given the thicket of privacy and security compliance obligations imposed by HIPAA (and other statutes and regulations we haven’t even mentioned here). Those big data benefits will ultimately be worth pursuing, but they won’t necessarily be easy. 

Healthcare Big Data Can Lower Costs

First big data can drive better healthcare analytics in real-time, which would give hospitals and other healthcare organizations a better sense of where and how they could cut costs. That would be possible not only for equipment costs, but also staffing and personnel resources—who could be deployed more efficiently, which would help to mitigate expenses. 

Modern healthcare is going to be expensive. Better data analytics, however, can both deliver better healthcare results and make healthcare more affordable. 

Big Data Can Improve Telemedicine

The use of telemedicine has soared since the start of the pandemic. With the real-time benefits of big data, telemedicine can become more accessible to more people (for example, those who are immobile), since doctors and other healthcare providers can access a patient’s healthcare information with a few keystrokes and conduct a consultation over video-conferencing. That means many health conditions can be addressed in the privacy of your home. 

Done properly, telemedicine saves time and money, and makes healthcare services more available to the public. It also limits the risk of transmitting disease when visiting a crowded medical practice. Telehealth has become one of the most significant benefits of big data in healthcare systems. 

Big Data in Healthcare Saves Lives

Because big data can bring more medical information to the fingertips of medical professionals, more quickly and easily, that also means big data can lead to better patient outcomes—the most powerful argument for big data of all. 

For example, medical imaging technology is indispensable to diagnosis and better patient care. Big data can bring those images directly to a doctor’s mobile device, saving time and money on data storage and retrieval. Those images can also be combined with the patient’s medical history and data on probable causes of illness, which all leads to better decision-making and better patient care. 

So it’s fair to say that big data can be extraordinarily beneficial to healthcare, even as it raises many difficult questions. 

Why Are People Wary of Big Data in Healthcare?

People worry that as more and more personal health information is stored and used electronically, that data will be vulnerable to theft or exploitation unless healthcare organizations keep the data properly secured and restricted to certain uses that respect a patient’s privacy.

Compliance with those regulations (HIPAA above all, but other regulations as well) can take time and money to implement. Even full HIPAA compliance, however, can’t guarantee that personal health information will always be safe. The risk of a breach will always exist, so the question is whether the precautions we implement to reduce that risk are worth the benefits that big data would then create. 

What Does This Mean for the Future of Big Data Analytics in Healthcare?

The reality is big data in the healthcare industry is only going to grow; the benefits are too enormous not to use big data in healthcare. The security risks and regulatory compliance obligations, however, are daunting. Healthcare businesses will need to implement a structured program to manage compliance, privacy, and increased security. 

Automation is the wisest course to meet those compliance needs. With ZenGRC, stakeholders, employees, and your compliance team have access to a single source of truth that covers all of your current and future risk areas. The ability to gather documents rapidly and to monitor compliance saves man-hours and reduces the possibility for human error. 

Additionally, ZenGRC’s user-friendly dashboards show you at a glance which risks need mitigation; track workflows; collect and store the documents you’ll need at audit time; and more. 

Worry-free GRC is the way to be! Contact us now for your free consultation and demo of ZenGRC.

What Is Good Governance in the Public Sector?

· ·

The public sector faces expectations for good governance, regulatory compliance, and risk management just like any other industry. Indeed, given the heightened attention, public agencies get because they serve the public and spend taxpayer dollars, in many ways the public sector faces higher expectations for governance, risk, and compliance than private industry. 

Today, we’re going to cover frequently asked questions around governance in the public sector and what best practices indicate good governance.

What do we mean by the public sector?

When we say “the public sector,” we mean government agencies that deliver services to the public directly; other businesses paid by the government to deliver services to the public; and the elected officials throughout various levels of government that manage these services. 

In practice, these services can include the military, basic infrastructure (roads, highways, sewers, electrical grids, telecommunications), public transit, public education, healthcare, the legislative bodies that adopt laws and the courts that adjudicate disputes, and much more. 

How can corporate governance be applied to the public sector?

In the public sector, good governance consists of policies, procedures, and internal controls to assure that the agency in question delivers its intended outcomes from citizens. That also means the agency clearly identifies those objectives it’s supposed to achieve, and achieves them while obeying relevant laws and regulations at all times.  

Corporate governance technically refers to businesses in the private sector, but many principles of corporate governance apply equally to both public and private sectors. These include accountability, transparency, ethical business operations, and use of performance measures so stakeholders can evaluate performance.

Are there specific ‘good governance’ considerations for the United States versus other countries?

Yes. Most developed nations have governance codes for their public and private sectors, such as Britain, New Zealand, Australia, and members of the European Union. The United States is no exception. 

For example, the federal government has extensive ethics rules for employees of public agencies, and requirements such as anonymous internal reporting hotlines so that employees can raise allegations of improper spending or an abusive work environment. The federal government also has voluminous rules about bidding on government contracts, including requirements that contractors can provide assurance over the effectiveness of their cybersecurity programs. 

State and local governments also have their own ethics and compliance requirements, so the total amount of good governance requirements is considerable.

How is risk related to governance?

As previously mentioned, good governance is about providing goods and services to the public, while conforming to ethics and compliance obligations. Risks to that goal abound. Agency leaders might fail to perform their duties well, employees might commit misconduct, or business operations might not happen according to legal and regulatory requirements. 

A public agency’s compliance program aims to mitigate those potential risks. That, in turn, allows the agency to be managed in accordance with good governance principles. 

Broadly speaking, the compliance program should help the agency to:

  1. Achieve the agency’s objectives;
  2. Meet regulatory requirements from any applicable laws, regulations, and other rules; and
  3. Prevent officials from abusing their roles at the agency to serve their own interests. 

What are the principles of good governance?

1. Leaders should act with integrity, a commitment to ethics, and high regard for the rule of law. 

Not only are local government and other public sector entities accountable for their budgets; they must also display good stewardship through their financial performance. 

This means being held to accountability standards dictated by legislative bodies, and being subject to audits of financial and operational performance at any time. 

2. Keep stakeholders informed and engaged. 

Good governance means being transparent with all stakeholders, consumers of government services, taxpayers funding public agencies, and lawmakers enacting objectives that agencies must fulfill. Communicating clearly, promptly, and in good faith is critical.

3. Define all objectives, including financial, social, economic, and sustainability goals.

Public agencies serve many constituencies, and they often have missions with no fixed conclusion. (For example, public schools and the armed forces are never “finished” with their work.) Given those fundamentals, it’s important for a public agency to define its objectives, so that all stakeholders understand why the agency is taking whatever specific steps it’s taking. 

Moreover, clearly defined objectives help to assure that any public procurement process (that is, the agency spending taxpayer money to do things) stays within the confines of ethical standards and serves the agency’s mission and goals. 

4. Define organizational structure and leadership to enforce accountability.

Public sector entities should have a hierarchy in leadership to assure that the organization can meet its objectives, and to enforce policies and procedures meant to check unethical behavior by appointed individuals. The leadership structure should include personnel who know how to audit governance.

5. Define the risk management strategies necessary to avoid straying from intended outcomes.

Risk management strategies for the public sector include implementing the right level of supervision and accountability so that all decisions are made according to ethical standards and in pursuit of  defined objectives. 

Risk management should also include monitoring and oversight by relevant governing bodies (say, a legislative committee or a board of trustees); and a system of internal control over financial reporting to enforce financial discipline, proper allocation of resources, effective service delivery, and accountability.

6.  Support transparency and accountability through reporting and auditing.  

Public sector governance should include regular reporting of the agency’s activities; and audits of financial and operational performance. Such steps help to assure that an agency’s leaders are held to high standards of accountability. Public sector entities should always be prepared and ready to answer to an audit committee or auditor general on their activities.

Frequent internal audits and effective record-keeping and documentation are the only way to ensure that a public sector entity is always prepared for an audit request.

How ZenGRC Can Help With Your Public Sector Governance Strategy

Security and compliance risks within the public sector are significant. Public sector agencies face numerous compliance obligations, such as the Health Insurance Portability and Accountability Act (HIPAA) for personal health information or the Gramm-Leach-Bliley Act for financial information. Agencies must also meet significant regulatory requirements such as the Federal Risk and Authorization Management Program (FedRAMP) for cybersecurity risk management, and state laws on consumer privacy and breach disclosure. 

With ZenGRC, you can leverage one platform for all your compliance, audit, risk, governance, and policy management applications. ZenGRC provides your compliance teams with a single, integrated experience that reveals all risk across your business.

ZenGRC simplifies audit and compliance management with complete views of control environments, easy access to information necessary for program evaluation, and continual compliance monitoring to address critical tasks at any time.  

Worry-free public sector governance is the Zen way! Learn more by scheduling a free demo today.

How to Perform a HIPAA Risk Assessment

· ·

Healthcare is among the most highly regulated industries in the United States. Hospital systems, medical practices, and related healthcare organizations accumulate huge troves of sensitive information about their patients—medications, procedures, testing results, and more—which all qualify as protected health information (PHI) that must be secured from unauthorized use. 

The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, first defined how PHI must be handled. The law was further updated in 2003 with the HIPAA Privacy Rules, followed by the HIPAA Security Rules in 2005. 

Those two sets of rules address different aspects of keeping patient information secure. The HIPAA Privacy Rules focus on protecting data and establishing rules for what and how patient information may be shared; the HIPAA Security Rules focus on the technical aspects of how to keep patient data secure and confidential (for example, by imposing stringent cybersecurity requirements and other data protection measures).

Alas, things still go wrong, and HIPAA data breaches still happen. As hackers become more proficient and clever with their attack strategies, the potential harm of a breach keeps increasing. 

In this post, we’ll review how to perform a HIPAA risk assessment and provide some guidelines for how to get started. 

What are the 4 elements of a risk assessment?

Regardless of your industry, the four basic elements of risk assessment are the same. Let’s break them down in terms of how they relate to HIPAA and the healthcare industry:

  • Identify the assets at risk. This would be any type of protected health information, such as patient data, personal information, date of birth, addresses, and insurance information.
  • Perform the risk analysis. it’s important to identify the specific types of potential risks you face. Healthcare providers are prime targets because the electronically protected health information they possess is so richly detailed; that makes the information quite useful for people seeking unauthorized access. The goal here is to identify different risk levels. For example, data on protected servers inside your office are probably at lowest risk, while third-party vendors or other business associates with access to your systems are probably the highest. 
  • Determine the probability of the specific risk and its likely impact. What’s more likely: a cyber attack, or your building will get hit by a tsunami? Actuarial models can help you figure out the probability of specific risks, and a review of your technical safeguards, cybersecurity system, and data handling procedures should give you a good sense of which risks are most likely and most harmful. The impact of a potential risk should be measured not only in the financial damage it could inflict, but also the cost of remediation (see below) and the significant cost to your company’s image if you suffer a major data breach. 
  • Determine the cost of an appropriate solution. Your risk management plan should help you identify the appropriate level of security you should implement. For example, what is the worst-case scenario, and what is the associated cost of remediation? Clearly the company shouldn’t invest in expensive solutions for risks that pose little harm or are extremely rare; risk assessment should help you determine which solutions are worth the investment, given the probability and potential harm. 

How do you develop a HIPAA risk assessment in healthcare and what should its scope be? 

It may help to think of a HIPAA risk analysis as a HIPAA compliance audit. In that case, the first step is to take an in-depth look at your current system. Who handles protected health information (PHI)? Which systems does HIPAA data flow through, and are those systems secure enough? If you have added remote workers due to the pandemic, do a separate security risk assessment of the remote access process, VPN connections, and any hardware located off premises. 

The scope of your HIPAA risk assessment is determined by the various phases of the “data lifecycle” as HIPAA data travels through your IT systems: 

  • How does your business receive PHI? It may come in many forms, such as faxes, text messages, emails, phone calls, and physical letters or files arriving via a delivery service or mail; it might also come directly from another provider’s database. (Make sure you have strong business associate agreements in place to govern such relationships.) 
  • How does PHI travel through your internal system? Once a piece of data is in your possession, determine exactly where it goes. This includes having a strictly monitored mail routine, protected servers and workstations, and clear policies around using electronic calendars or mobile devices. Make sure your information technology software is up to date. 
  • If you work with other business associates or third party contractors, how do you transfer PHI to them and how they receive it? For instance, do you have sufficient encryption to meet HIPAA standards, and have you appropriately enacted other security measures? 

Once you’ve examined these areas and determined the lifecycle of data in your system, you may discover weak areas where a tougher audit—such as a HIPAA security risk analysis—is required, to expose all the potential threats to your data. And you will have a good sense of where and how PHI may leak from your system. 

What should a HIPAA risk assessment template include, and what type of questions are required in a HIPAA risk assessment?

Guidance about how to construct a HIPAA risk assessment template is voluminous, and often confusing. One good place to start is with the HIPAA Security Risk Assessment (SRA) tool developed by the Office of the National Coordinator of Health and Information Technology (ONC) and the Office for Civil Rights. That tool is designed to help especially smaller and mid-size healthcare providers develop proper HIPAA compliant standards for securing electronic protected health information (ePHI).

According to the HIPAA SRA, your template should include questions such as, “Have you identified the e-PHI within your organization? What are external sources of e-PHI?” and “What are the human, natural, and environmental threats to the information system that contain the e-PHI?” 

It may be helpful to develop or download a specific template, but remember that the final documentation for your compliance with the HIPAA security rule doesn’t have to be submitted in a specific format.

How often is a HIPAA risk assessment required?

To comply with both the HIPAA Privacy Rules and the HIPAA Security Rules, you should conduct a HIPAA risk assessment and review the findings annually. A new risk assessment report may be necessary if the lifecycle of data in your system changes, or if a business associate or third-party vendor changes its own data handling procedures. A HIPAA-compliant business should be able (at any time) to show that a current risk assessment report and to demonstrate that all appropriate safety measures have been taken.

Cybersecurity and compliance management tools

As you steer your business through the pandemic and our highly interdependent world, many tools can help keep your business safe, in compliance and your information secure.

ZenGRC’s compliance management, risk and workflow management software is an intuitive, easy-to-understand platform that not only keeps track of your workflow, but also easily identifies areas of high risk before that risk has manifested as a real threat. 

Worry-free compliance management is the Zen way. For more information on how ZenGRC can enable your CMS, contact us for a demo.

Email Retention Policy

· ·

Businesses and other organizations must store employees’ email communications for several reasons. Some of those reasons are practical, such as for marketing initiatives, strategic planning, or other business needs. Other reasons, however, stem from regulatory compliance: federal guidelines that require email to be stored for record-keeping, law enforcement, or privacy purposes. 

The first example of a records retention rule dates back to the 1950s, where physical documents (letters, memos, and other files) had to be preserved for a specific period of time. As email came along and replaced written documents, those same rules were extended into the electronic era. 

E-discovery is the legal process of searching electronic records for specific pieces of information. For example, two parties in civil litigation might perform e-discovery on each others’ files; or a regulatory agency might perform e-discovery against a company as part of a pending enforcement action. 

E-discovery technology helps to keep the information in electronic records transparent and available for legal purposes. Email retention is the first step in that process: organizations save their electronic information for posterity, and if the need arises, e-discovery can find relevant pieces of information for the matter at hand. 

This is why it’s imperative to have an email archiving solution for your business, which should be in compliance with any records-retention obligations you have. 

How Long Should Emails Be Retained?

The answer to this question varies. Regulatory obligations impose certain retention periods for various types of records, email or otherwise. Tax returns, for example, should be retained for as long as seven years. Any data that’s part of a litigation dispute should be retained until the litigation is resolved. Those requirements are beyond a company’s control. 

When retaining email purely for the company’s own purposes, the answer is more of a cost-versus-benefit equation. Stored emails can help businesses compare information or data over time, to help make future decisions. These emails contain useful information to grow as a company. 

On the other hand, there are significant risks when holding data for too long. For example, if you suffer a privacy breach and personally identifiable information is exposed, you could be liable for damages to the affected persons—including those people whose information you didn’t need to keep, but you’d kept anyway. 

Why Have an Email Retention Period?

Records retention laws require archiving some documents for a specific period of time, and some also impose an expiration date to delete emails. Laws such as the Health Insurance Portability and Accountability Act (HIAA), protect private health data. Other industry standards, such as the Payment Card Industry Data Security Standard (PCI DSS) govern the personal data exchanged in credit card transactions. 

Preserving emails can be necessary for litigation or compliance purposes, or for a business’s own analytics. The more information you preserve, however, the greater the chance for a security breach that exposes private information in those emails.  

Are Companies Required to Keep Emails?

All companies will need to abide by federal, state, and industry regulations when archiving emails. Saving emails isn’t necessarily a company policy but a legal requirement. These regulations will determine how long you need to keep emails until deletion. 

ZenGRC Frameworks and Retention Periods

ZenGRC’s software helps a company to organize its data, and adjusts its parameters as regulations and standards change. 

Our software uses templates that accommodate common frameworks necessary for businesses. Data can easily be transferred and stored according to these frameworks, and be customized to your business needs. 

ZenGRC supports frameworks for all of the major laws and regulations that include record retention requirements. For example, publicly traded companies must comply with the Sarbanes-Oxley Act. As part of SOX compliance, companies are obligated to retain financial and audit data for seven years. 

Any healthcare data must abide by HIPAA, which protects the security of medical and patient documentation. HIPAA has a data retention period of at least six years. 

The California Consumer Privacy Act (CCPA) is a state data privacy law that protects California residents and monitors how businesses handle personal data. The CCPA retention period is 24 months.

The European Union’s General Data Protection Regulation (GDPR) and the Gramm-Leach-Bliley Act (for the banking industry) also have privacy restrictions and records retention requirements.

These are only a few frameworks supported by ZenGRC software. You can customize your retention periods based on your company’s specific needs and schedule, aligned with regulatory regulation. 

What is Microsoft 365 Mailbox Retention Policy?

The concept of a mailbox retention policy was developed under Microsoft 365. This policy allows you to create a prompt to delete emails after a specific expiration date automatically. All you need to do is use a “retention tag” that signals an action after a certain period to delete.

The automation of this mailbox retention policy simplified the process. Managing copious emails can be challenging, time-consuming, and costly for a business. Automation can be an excellent investment to manage email retention.

What are the Email Retention Policy Laws in the U.S.?

Almost all businesses in the United States are required to abide by email retention regulations. Those rules, however, differ depending on its industry regulations and specific state laws. 

Depending on the industry, a business can expect to archive its emails for three to seven years. It’s best to work with legal counsel to understand what guidelines apply to your business.

What are the Best Practices for Email Retention in Any Industry?

You first need to identify federal, state, and industry regulations for your business; and then develop email retention policies and procedures to meet those regulatory requirements. Using automation for email retention is the best way to prevent violations. 

Simply put: using ZenGRC reduces your risk of litigation. Email retention policies can change or alter at any given time. It’s better to rely on automation so you can focus on other business needs without keeping up with email retention parameters. 

Set up a demo today!

ZenGRC Named 2021 Governance, Risk and Compliance Emotional Footprint Award Champion

· ·

  • Reciprocity Scores 93% average in Vendor-Client Relationship
  • ZenGRC Scores 89% average in Product Effectiveness

SAN FRANCISCO – February 4, 2021 – Reciprocity announces today that ZenGRC, the industry-leading information security risk and compliance solution, was named 2021 Governance, Risk and Compliance Emotional Footprint Award Champion by Info-Tech Research Group’s SoftwareReviews. The Champion designation is awarded to the vendors that receive top user scores.

The Emotional Footprint Awards evaluate and rank products based on emotional response ratings from IT and business professionals providing a powerful indicator of overall user sentiment toward vendors and their products. The 2021 Emotional Footprint survey revealed that users rank ZenGRC very highly across all five categories measured, including:  

  • Service Experience: 95% of users said ZenGRC is “Efficient”, while 100% of users said Reciprocity is “Respectful”
  • Conflict Resolution: 93% of users said Reciprocity is “Trustworthy”, while 100% of users said Reciprocity is “Fair”
  • Negotiation and Contract: 93% of users said Reciprocity is “Generous”, while 100% of users said Reciprocity is “Transparent”
  • Strategy and Innovation: 94% of users said Reciprocity “Appreciates Incumbent Status” and is “Continually Improving”
  • Product Impact: 94% of users said ZenGRC “Enables Productivity” and is “Performance Enhancing”

“We are thrilled that our customers rank ZenGRC so highly, and we’re especially proud that every respondent said we are respectful, fair and transparent,” said Rob Schmeltzer, Vice President of Customer Success at Reciprocity. “We strive to build trusted relationships with our customers, and surpass expectations as their information security risk and compliance solution of choice. Being named Champion by SoftwareReviews confirms that ZenGRC is fulfilling a mission-critical need for CISOs and delighting our customers in the process.”

For more information on the 2021 Governance, Risk and Compliance Emotional Footprint Awards, go to https://www.softwarereviews.com/categories/governance-risk-and-compliance

To learn more about Reciprocity and the ZenGRC information security risk and compliance solution, please visit www.zengrc.com

Connect with us on Twitter, LinkedIn, and Facebook 

 

About SoftwareReviews

SoftwareReviews is a division of Info-Tech Research Group, a world-class IT research and analyst firm established in 1997. Backed by two decades of IT research and advisory experience, SoftwareReviews is a leading source of expertise and insight into the enterprise software landscape and client-vendor relationships. By collecting data from real IT and business professionals, the SoftwareReviews methodology produces the most detailed and authentic insights into the experience of evaluating and purchasing enterprise software.

About Reciprocity

Reciprocity’s mission is to turn corporate compliance from a cost center into a valuable strategic asset. Our ZenGRC platform simplifies the way organizations manage information security risk and compliance, and encourages transparency and trusted relationships with key stakeholders. Find out why the world’s leading companies trust ZenGRC at www.zengrc.com

Reciprocity, ZenGRC and ZenConnect are trademarks and registered trademarks of Reciprocity in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2021 Reciprocity. All rights reserved.

 

# # #

 

Media Contact:

Kari Curto

press@reciprocity.com

(650) 504-1076