Healthcare

What Compliance Lessons Can We Learn From Past Pandemics?

ZenGRC Team · April 29, 2020 ·

COVID-19 has us reeling from health, social, and economic shocks, but this isn’t our first global crisis. It is, however, the first in which cybercrime plays a starring role.

The world has faced several pandemics in the past 100 years—several influenza pandemics including swine flu (H1N1) and Avian, or bird, flu, and HIV/AIDS—as well as economic depression and a number of recessions. Life and business tend to suffer disruptions during crises, but at least one thing holds true: the need to comply with laws, regulations, and industry standards.

This time, though, compliance is different. Regulations addressing cybersecurity and data privacy are now in the mix, and the rapid shift to work-at-home, telemedicine, and digitization of operational and consumer services have made security and compliance particularly challenging.

Suddenly, the boundary that surrounded on-premises technology and cybersecurity, protected by firewalls, has exploded. As data and networks move to the cloud at an unprecedented pace, malicious actors are probing for weaknesses, challenging security teams to work overtime to safeguard their systems, networks, data, and devices as well as their workers.

Failure is not an option. Falling out of compliance with critical cybersecurity and privacy frameworks might mean facing penalties your enterprise can ill afford during the global economic slump the COVID-19 pandemic has caused.

And yet, this crisis shares similar traits with those of the past. Business leaders can learn key lessons from those experiences, and use them not only to bolster their compliance efforts today but also to plan for future crises.

What businesses are saying about compliance right now

Respondents to a Compliance Week survey in late March 2020 said they remember well businesses’ emergency response to the Sept. 11, 2001, terrorist attacks and to the swine flu pandemic of 2009-2010.

Some said those experiences had positioned them to prepare for COVID-19’s effects proactively: they had disaster response and business continuity plans already in place to guide them.

Nevertheless, 67 percent of respondents agreed or strongly agreed that managing and monitoring compliance became more challenging in the weeks after the pandemic began.

Those challenges include:

Disorganization caused by a remote workforce (37 percent)
Keeping tabs on coronavirus-related regulatory guidance (31 percent)
Supply chain disruptions (23 percent)
Employee absenteeism (23 percent).

All these problems can affect compliance. For information on how, see our special report, COVID-19: Compliance Considerations for Remote Employees.

Remember the past—and learn from it

As organizations broaden their technology bandwidth; modify their policies and procedures to accommodate a remote workforce, and take other actions to prevent or limit business disruptions, some are using lessons learned from past crises to help them make better decisions now.

Looking ahead, these and other lessons could serve your enterprise well now and later—should a second or third wave of the virus strike, as typically happens with pandemics, or to help you cope with future pandemics—which Microsoft CEO Bill Gates predicts could occur every 20 years.

These lessons include:

Test your business continuity plan (BCP)

The last thing your enterprise needs in a crisis is a failure of its disaster response/business continuity plan—which could result in disruptions in your business and controls. Fine-tune yours for response to risks you can’t even imagine, and test it in advance so you know it works as it should before you need it.

Assess your supply chain and establish workarounds and backups

Where are the weak links in your supply chain? Foresight will help you avoid falling out of compliance because of them. Risk Management Software can help you track and analyze third-party compliance.

Update your risk assessment

COVID-19-related risks such as the new work-from-home normal, increases in online interactions and transactions, and a surge in cyberattacks require new assessments of your organization’s risk and compliance posture organization-wide. Now is the time to prioritize risks and hone in on those posing the most immediate threats to your enterprise.

Think globally

Technology and travel have shrunk our world, increasing the likelihood that the effects of a pandemic or other crisis will have a global impact. When revising your risk models, act locally, but think globally.

Communicate, communicate, communicate

Provide information in a steady stream to your workers, leadership, shareholders, business partners, clients, customers, and other business stakeholders. Proactive communications can reassure them and ensure that everyone knows their roles and responsibilities to help keep the business running as smoothly and securely as possible and in compliance with regulatory and industry mandates.

One idea: Establish an email address that employees can use to ask questions or raise red flags.

Be flexible

During a crisis, continually assess your response and be willing to pivot, if need be. Software with alerts and dashboards can monitor, send alerts, and track workflows to help manage your response.

Have a contingency plan

If something isn’t working as it should, have another plan ready to activate. While you’re in crisis mode is not the time to scramble for solutions.

Prepare for absenteeism

During the swine flu pandemic, employee absenteeism posed a risk to business operations and finances, according to Risk Management. To track illness and possible contagion, and plan for the staffing of services and functions deemed essential to the business, the publication recommended categorizing workers in four groups:

Essential to the worksite
Essential, but can work remotely
Non-essential, and can work remotely
Non-essential, and not necessary to work remotely.

Keep a sharp eye out for fraud

While your organization is in upheaval and attention is distracted by the exigencies of the pandemic is precisely the time when fraud, waste, and other financial misconduct is likely to occur. Lessons learned from the 2008 financial crisis include being vigilant about compliance with the framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in response to a number of fraud scandals that occurred in the 1980s.

Don’t repeat past mistakes

“Those who cannot remember the past are condemned to repeat it,” the poet and philosopher George Santayana famously said. The bad news is that human memory is fallible. Also, as personnel come and go in your organization, you may lack the institutional memory to recall the enterprise’s response to the swine flu pandemic, for instance.

But that’s one of the many reasons why we have software. ZenGRC, our governance, risk management, and compliance solution, is like the proverbial elephant that never forgets.

ZenGRC remembers everything, tracking and monitoring your risk management and compliance efforts, assigning tasks and managing workflows, assessing your risks and those of your third-party vendors, and helping you assess what’s going well and what’s not, and why.

And when it’s time to look back and prepare for the next crisis, ZenGRC will still be there with the data and details you need. That’s good news—and who doesn’t need a bit of that during this crisis?

Worry-free compliance management is the ZenGRC way. Contact us today for your free consultation.

COVID-19: Response and Preparedness through the lens of Risk Management

ZenGRC Team · March 23, 2020 ·

Coronavirus pandemic featured image for blog

Responding to a New, Global Threat

The old adage warns “An ounce of prevention is worth a pound of cure.” The saying becomes even more pointed for threats that, unfortunately, do not yet have a cure. But the lessons of risk management offer a path forward, where prevention takes the form of avoiding, mitigating or reducing risks.
As people and organizations confront COVID-19, the novel threat has inspired an array of new strategies to combat the pandemic. Social distancing, self-isolation, sheltering in place—efforts to stop the COVID-19’s spread leverage risk management principles to fight a public health threat.

Applying Risk Management Principles During the COVID-19 Pandemic

Some businesses have mature risk management programs and apply its principles to any new threat. Others may be less accustomed to approaching problems with that toolset; they worry that, if they do not already have robust preparedness or disaster recovery structures in place, they cannot start now.
But, even for businesses without a solid risk management platform – even for businesses in crisis mode – risk management practices can help people navigate uncertain times. Consider how the risk management cycle can organize thinking and lead you to more a more effective response:

1. Threat Identification

As COVID-19 affects people around the world, the impacts it causes can threaten businesses. Supply chain disruptions may affect inventories and shipment times; travel restrictions may hinder productivity; quarantines may slow consumer demand and constrict cash flow.
While it’s a best practice to have official business continuity plans, many organizations do not and even those that do may not have planned for the extensive threats COVID-19 is likely to involve. The first step in addressing the crisis is understanding the threat landscape.

2. Assessing Vulnerabilities to Specific Threats

Next, organizations must explore how specific threats are likely to affect their businesses. A good practice is to start your assessment with critical assets. Although disruption can stem from other assets, too, prioritizing critical infrastructure focuses on the major building blocks of your business.
When assessing vulnerabilities, be sure to consider vulnerabilities from vendors and business partners, including their cybersecurity preparedness. Wherever a third-party or their systems interact with your business’s ecosystem, it is a potential vulnerability.

3. Determining Risk Exposure

When connecting threats to organizational risks, consider how likely the threat is to occur, and what consequences would arise within your business if it did. Remember: both the threats themselves and the measures taken in response to threats can manifest differently for different organizations.
Areas that historically have been low risk may be significantly affected by changed circumstances. For example, shutting facilities down may affect a business’s security risks and associated controls. Such organizations should ask themselves: are there temporary controls that might be more suitable? If they have been introduced, have employees been trained on those temporary controls? Have you audited for factors like training completion rates, employee compliance, and effectiveness of the temporary controls?

4. Identifying Ways to Reduce Risks

After risks are identified, the question becomes how to treat them. The specifics will vary depending on your organization and what your assessment found. The Cybersecurity and Infrastructure Security Agency shared suggestions of actions organizations can take to respond to physical, supply chain, and cybersecurity issues in light of the COVID-19 pandemic.
ZenGRC dashboard feature to communicate about risks, formulate plans, and monitor performance. It has the advantage of being customizable, mapping tasks to the organization’s policies. With easy information sharing, an organization can do what is necessary to make people safer.
A more secure process can be a strategic advantage during uncertain times, and organizations should communicate that strength to their customers. At Reciprocity, we know that first-hand. With the COVID-19 crisis expanding, we have taken steps to protect our own employees while also ensuring continuity of services. We were pleased to be able to assure our customers that our SLA is rock solid, and ZenGRC is facilitating customers’ own COVID-19 related adjustments.

5. Prioritizing Risk Reduction Measures

As people around the world are now experiencing, reducing risk exposure can be the best – or the only – strategy for avoiding negative outcomes. Just as hand-washing is the first and most effective step for preventing COVID-19 transmission, basic IT hygiene is at the core of information security.
The Center for Internet Security (CIS) has developed a prioritized list of cybersecurity actions, called the CIS 20, designed to maximize security while minimizing costs. They estimate that the top five controls prevent about 85% of cyberattacks—the digital equivalent of hand-washing.

ZenGRC is Here to Help

At ZenGRC, we understand that these are uncertain times, and we are here to help your organization meet its priorities. As your business adjusts in response to Coronavirus, we can assist with the transition to a digitally-distributed workforce, and guide you through the considerations integral to maintaining information security risk and compliance.
To help you build on your current program, or to help get you started on your journey, please contact us at engage@zengrc.com. As always, our team of information security risk and compliance experts are standing by to help you tailor your organizational risk management program to your specific needs.

HIPAA and Social Media: What You Need to Know

ZenGRC Team · December 17, 2019 ·

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was signed into law before the rollout of major social media sites such as Facebook, Twitter, and Instagram. And as such, there are no specific HIPAA rules for social media.

However, some HIPAA laws and standards apply to the use of social media by health care organizations and their workers. Because of that, each health care organization must implement a HIPAA social media policy to decrease the risk of HIPAA violations.

The HIPAA Privacy Rule forbids the use of protected health information on social media networks. Protected health information includes text, videos, and images about specific patients that can enable others to identify them.

Health care providers can only use patients’ protected health information in social media posts if their patients have given written consent. And the health care organizations can only use the patients’ protected health information for the purposes specifically mentioned in their consent forms.

Still, health care organizations can realize a number of benefits of using social media. For example, social media platforms enable health care providers to interact with their patients, involving them in their own health care. Additionally, health care providers can use social media to attract new patients.

They can also use social media to more easily and quickly offer patients information about new services, as well as post health tips, details of events, staff bios, and new medical research, as long as they don’t include any patient protected health information (PHI) in their social media posts.

Despite the benefits, health care organizations that use social media platforms can still run the risk of violating HIPAA rules and patient privacy.

According to the U.S. Department of Health and Human Services (HHS), most HIPAA violations in recent years have been caused by employees mishandling patients’ PHI, including by inappropriately sharing the information on social media sites.

Violations under the HIPAA Privacy Rule include civil monetary penalties ranging from $100 per violation to $50,000 per violation based on a tiered structure. The annual maximum penalty is $1.5 million. Criminal penalties could result in fines of up to $250,000 and up to 10 years in prison. Other consequences of violating the HIPAA Privacy Rule include the loss of medical licenses, termination of employee(s), and lawsuits.

However, by following HIPAA social media guidelines, health care organizations and their employees can use social media sites while maintaining HIPAA compliance and safeguarding patient privacy and patient information.

HIPAA Social Media Guidelines

To avoid violating the HIPAA Privacy Rule, your health care organization should follow these basic HIPAA social media guidelines:

Establish clear policies to cover the use of social media and make sure that all your staff members understand how HIPAA relates to social media platforms.
Educate all your employees on the acceptable use of social media as part of HIPAA training. Conduct annual refresher courses.
Offer employees examples of the acceptable use of social media and the unacceptable use of social media to improve their understanding of the issue.
Explain the possible penalties for HIPAA social media violations to all your employees.
Ensure your compliance department approves all new uses of social media sites.
Create policies and procedures on the proper use of social media for your marketing department, which should include standardizing how marketing takes place on social media platforms.
Review and update your social media policies annually.
Establish a policy requiring that your staff members keep their personal and corporate accounts totally separate.
Develop a policy mandating that your legal department or your compliance department approve all social media posts before they’re posted.
Monitor your company’s social media accounts and social media communications.
Implement controls to flag potential HIPAA violations.
Keep a record of social media posts using your company’s official accounts that save posts, edits to the posts, and the format of social media messages.
Don’t conduct conversations over social media with patients who have disclosed their protected health information on social media sites.
Require your employees to report any potential HIPAA violations.
Include your social media accounts in your company’s risk assessments.
Implement appropriate access controls to prevent the unauthorized use of your organization’s social media accounts.
Moderate all comments on social media platforms.

HIPAA compliance should be an ongoing part of your total compliance program. In addition, if you continually train your employees about potential HIPAA violations that can happen when they use social media, your organization will reap the benefits of social media tools.

California Confidentiality of Medical Information Act vs. HIPAA

ZenGRC Team · November 20, 2019 ·

A HIPAA Physical Safeguards Risk Assessment Checklist

Patient health information is governed by robust rules that determine how this data is handled, stored, and accessed. Federal laws, such as the Health Insurance Portability and Accountability Act (HIPAA) and various state laws strengthen patient rights. HIPAA set a baseline for regulatory compliance with patient health information. Under the “preemption” language in the rule, no state may create less effective or weaker medical privacy protection for individuals.
However, states can exceed HIPAA regulations and institute more stringent requirements. One example of this is the California Confidentiality of Medical Information Act (CMIA), which has greater standards of protection of privacy than HIPAA.

Typically, in conflicts between federal and state rules, the federal rule is the governing requirement. But there is an exception—state laws prevail over federal privacy laws when they are more stringent than federal rules. In this case, CMIA is generally the governing standard for entities that fall under its jurisdiction.

Understanding how HIPAA and CMIA impact your organization improves the data security at your business and helps maintain a necessary regulatory and ethical standard for your clientele and patients.

What is HIPAA?
Established in 1996, HIPAA incorporates a multifaceted approach to protect personal health information and medical records. The HIPAA Privacy Rule (Standards for Privacy of Individually Identifiable Information) defines and creates a national consensus for the protection of patient health data. The HIPAA Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) addresses requirements and safeguards related to covered entities. The rule secures electronic protected health information (e-PHI).
Both non-technical and technical safeguards are covered under the HIPAA Security Rule. Administration of these provisions falls under the jurisdiction of the U.S. Department of Health and Human Services (HHS), who has the authority to assess and enforce compliance and levy monetary penalties.

Health care providers must comply with the HIPAA Security Rule. Providers include any entity that electronically transmits, creates, maintains or receives health information—inclusive of business associates, health plans, health care clearinghouses, and insurance providers.

Basic elements of HIPAA mandate that covered entities ensure confidentiality of all e-PHI, as well as identify and safeguard against security threats, prevent reasonably anticipated disclosure of the information and ensure compliance by the organizational workforce. Risk assessment, physical, technical and administrative safeguards and provisions for organizational breaches or violations are also covered under this law.

How does the CMIA differ from HIPAA?
Like HIPAA, the CMIA has similar goals to protect individuals’ health care information and prevent unauthorized disclosure of medical information. But the California law has additional and more extensive requirements and definitions.
Under the CMIA, medical information is defined as “individually identifiable health information about a patient’s medical history, mental or physical condition, or treatment.”

Information that identifies a person, inclusive of a name, email address, physical address, phone number or Social Security number, is considered “individually identifiable” under the CMIA. Additionally, if the information can be combined with publicly available information to reveal a person’s identity, it is also considered “individually identifiable.”

CMIA covers providers of health care, health care service plans, contractors, as well as “recipients” of that information.

Employers should note that “recipients” are not defined under the CMIA and may have a broad range of applications. Therefore, it is prudent that providers who fall under CMIA investigate methods by which health care information may be received. They must also manage all possible sources of intake with proper safeguards.

One significant way the two regulations differ is in violations. While HHS can issue fines under HIPAA, the CMIA allows patients to bring legal action for violations, inclusive of compensation, attorney fees, and damages.

Additionally, the CMIA’s definition of “provider of health care” is more extensive than HIPAA’s language. Under Cal. Civ. Code § 56.06., any business that offers software or hardware, “including a mobile application or related device,” that are designed to maintain medical information, is considered a provider.
Employers who receive employee medical information fall under the CMIA. Employers must assess and apply methods to secure such information, as well as integrate systems that prevent disclosure of employee health information without worker authorizations.

Conclusion
Organizations, health care providers and covered entities who fall under CMIA and HIPAA should train employees. Instruct them on the specific requirements to ensure end-to-end protection of data, and regularly survey the integrity of the risk management program and reassess systems and policies.
Because CMIA is more stringent than HIPAA, employers should ensure employee compliance, not only to protect the organization, but also to protect patient privacy and to operate ethically. Protecting patient privacy is essential to improving the quality of care and fostering access to care.

PCI Log Management Requirements For CISO’s

ZenGRC Team · September 4, 2018 ·

Whether you’re in the healthcare, retail, or hospitality industry, you’re going to need to protect your customer information if you collect payments. The Payment Card Industry Data Security Standard (PCI DSS) not only sets the standard for cardholder data (CD), but it also enforces the standard with penalties.

PCI DSS Logging and Log Monitoring Requirements

What is the Payment Card Industry Data Security Standard (PCI DSS)?

In the early 2000’s, the five major payment card companies, American Express, Discover Financial Services, JCB International, MasterCard, and Visa, Inc. banded together to create the Payment Card Industry Security Standards Council (PCI SSC). The organization wanted to create a series of information security standards processing payments that protected customers from identity theft and the card industry from paying for data breaches.

PCI SSC worked together to establish “best practices” for protecting information which became standardized as PCI DSS.

What Are The Penalties for Noncompliance?

While PCI DSS is considered a “standard” and not a regulation, many merchants incorrectly assume compliance is optional. Noncompliance leads to consequences that can cause business failure.

Card brands and acquiring banks can, at their discretion, fine noncompliant merchants anywhere from $5,000 to $100,000 per month for a violation. Depending on an organization’s size, these fines can be either crippling or devastating.

Who Needs to Be PCI DSS Compliant?

Regardless of your size or industry, any company accepting, transmitting, or storing cardholder data must maintain PCI DSS compliance.

What is PCI DSS Requirement 10?

PCI DSS Requirement 10 focuses on monitoring access to networks and data. In its most broad definition, Requirement 10 states:

Requirement 10: Track and monitor all access to network resources and cardholder data

Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. Determining the cause of a compromise is very difficult, if not impossible, without system activity logs.

Essentially, Requirement 10 requires you to continuously monitor the user access to your environment. Setting up user access controls is the first step to maintaining a secure cardholder data environment (CDE), but you also need to ensure that those controls work.

Embedded within Requirement 10, however, are 39 subparts. Since PCI DSS is a highly prescriptive standard, it sets out a clear list of the steps and documents needed to meet its requirements.

What records are necessary for Requirement 10 Compliance?

If you’re looking to be PCI DSS compliant, the standard not only lists the sections and subsections and parts of subsections, but it also incorporates Guidance to help understand effective control review. As such, the following steps can help you log data necessary to prove your compliance:

Create a system or process linking user access to the system components accessed and make sure you can trace suspicious user activity to a specific user.
Generate audit trails that prove the system administrator receives suspicious activity alerts and follows up on them.
Record all individual accesses to the CDE to show that new or unauthorized user accounts have not accessed the systems and networks.
Ensure you collect records of activities performed by “administrator” or “root” accounts that show potential misuse of these accounts and can trace the issue to a specific action and individual
Maintain file integrity of audit logs by having a way to identify changes, additions, and deletions to them.
Record invalid login attempts to trace “brute force” attacks or password guesses.
Maintain records that allow you to trace activities indicating manipulation of authentication controls by attempting to bypass them or impersonating a valid account, including but not limited to records that verify mechanisms, elevation of privileges, and any changes/additions/deletions to root or administrative accounts.
Document any pauses or restarts to your audit logging processes.
Maintain records to show that system-level object, such as databases or stored procedures, have not been created or deleted by unauthorized accounts.
For all system components, maintain an event log that records user identification, event type, date/time stamp, success/failure indication, event origination, and affected data, system component or resource identity/name.
Synchronize clocks across systems to maintain exact sequences of events for forensics teams.
Use “principle of least privilege” for audit log access to maintain security and integrity of the information.
Backup logs to a centralized server or media that maintains data integrity.
Write logs directly, or offload or copy from external systems to a secure internal system or media.
Use file-integrity monitoring or change-detection systems to ensure notification of audit log changes that may indicate a compromise.
Engage in regular log reviews either manually or by using a log harvesting, parsing, and alerting tool.
Engage in daily review of security daily for notifications or alerts indicating suspicious activity and critical system component logs.
Schedule periodic reviews for all system components that indicate potential issues or attempt to gain access to sensitive systems by using less sensitive systems.
Document investigations of exceptions and anomalies.
Retain all records for at least a year.
Ensure employees are trained and aware of security policies and monitoring.

Service providers are subject to the following additional requirements:

Establish formal procedures to detect and alert critical security control failures, such as a firewall erasing rules or going offline.
Document evidence supporting the response to a security failure, including the processes and procedures as well as the actions and responses.

How ZenGRC Eases Best Practices For PCI DSS Audit Log Management

ZenGRC’s system-of-record enables organizations to store all their information in a single location. Collecting all your audit log information in a single place allows you to manage audit information and document your compliance activities.

With a single source of information, your audit logging staff can communicate efficiently with one another. Our role-based authentications enable audit log security and integrity since only the people who need access can interact with the information.

Finally, our system-of-record enables your audit log review staff to trace outstanding tasks without emails. This capability not only makes communication easier but protects the data by keeping it within our protected platform rather than insecure emails.

Managing audit information in a single location helps you detect real-time risks and prove continuous monitoring by documenting all your ongoing compliance activities.
For more information about how ZenGRC eases the burden of audit log management and analysis, contact ZenGRC to schedule a demo.