Well, this morning I got my groceries delivered because why not?
I'm lazy and I can have them delivered to my door, which then made me think about the
question of what's everybody's favorite currently favorite at home meal.
As I thought of that question, I then went, hmm, that's a great question, but I did make
a very good sweet potato and wild rice kind of salad mixture that I said I was going to
keep for three meals and then eat all in one day.
So there's that.
What about you, Todd?
I would say in case anybody's curious at the timeline, we're coming into spring here at
the time of this recording and I am all about summer.
So my current go-to is chicken piccata from Aina Garten.
Do you drink that with a little bit of wine and wear your scarf while you cook?
Of course.
No other way to do it.
I love it.
What about you, Ann?
As Todd mentioned, the spring into summer, anything that comes off the grill right now,
that's just, it was broccoli cauliflower and chicken thighs this weekend and on repeat.
It tastes so good and so, like, it should be way warmer than it is.
But that just sounds delicious.
I had the exact same thought that I was like, I get a grill out because, yep, got cauliflower
in the grocery.
Love it.
Going to steal that.
What about you, Matthew?
So mine's not, like, related to the season because I will eat this whenever and request
it whenever, but my partner is a wonderful cook and makes a lasagna that changes my day
every time I know what's going to come up.
So the lasagna every time, but there's so many to think of, like, this wonderful, like,
sun-dried tomato pasta that they make as well that is, yeah.
But I'm going to go lasagna as the top.
Because it's almost always on my mind.
Like, even when I'm just thinking about other things, I'll get distracted thinking about
that lasagna.
It's the life-changing lasagna.
And now, even though I'm dairy-free, I kind of really want lasagna, so thank you for that.
What about you, Ariel?
Oh, when you said grill out, I was like, that's got to be it.
You know, like, traditional brats, burgers, mostly because I don't grill, so my husband
does that.
And so I get to sit back.
I can enjoy someone else making food for me.
That's the best.
I love it.
That's the life.
Yeah.
You're going, food always tastes better when somebody else makes it for you.
That would be, like, the overarching.
Everything coming from the grill I did not make, so it tastes all the better.
I love that.
Which in a completely unrelated topic of what are we talking about today, we're talking
about HIPAA.
And can you afford a $10,000 HIPAA?
Fine.
So we're sitting down today with myself, Kelsey and Ariel, as part of the marketing team here
to moderate.
And then we have Todd, our COO and CISO, Matthew and Anne, who are both GRC analysts over in
our security department.
And we're putting it off to them to start it off with, what is HIPAA?
What is it?
We may never know.
It is an acronym.
It is yet another acronym, which is why I'm here.
Because if we weren't talking about acronyms, then I wouldn't have a job.
We wouldn't have a job.
So HIPAA is all about the healthcare information.
I've forgotten it's not protection, is it?
It's a Portability Act.
Portability and Accessibility Act.
Accountability Act.
Accountability.
Oh, look at that.
This is what I get for not memorizing it and just memorizing the acronym.
You guys have heard it about it a lot, everyone has heard it.
The spelling of it sometimes gets a little bit confused.
It is HIPAA as our, or my, messing up of the acronym just then worked.
The short version is it's about protecting and securing healthcare records, physical
and digital, and ensuring that that information is stored and accessible at the same time.
You can't just look it away in a vault and never look at it again if someone requested
it needs to be available and you need to secure it the whole way through that chain
from start to finish.
That's the short version, I suppose.
Did I miss anything?
Apart from the acronym?
I mean, I think you nailed it pretty well.
It does largely impact the healthcare industry specifically.
You will see it in some other cases too.
I mean, if you look at any kind of, it's specific for health information is really what it's
designed to help with, but most organizations do have some sort of compliance with it because
most most organizations will do HR.
And if you're handling the HR, you're going to have identifiable information that is going
to be very, very heavily protected.
So it is something that you're going to see across the board as Matthew said, when you
get to the acronym, most people I think spell it HIPPA instead of AA.
Why don't know.
We'll dig into this a little bit.
Like hippo.
That's what I was thinking.
That's probably it, right?
As you're typing it, you might as well just go with hippo and replace it.
We can probably dig into this a little bit deeper as to what that compliance looks like.
I'll let Ann chime in briefly before we dig into the weeds.
Oh, really, it's for covered entities and their business associates primarily.
That doesn't mean or excuse everybody else from taking protection measures, but a covered
entity is one that would have process generate a record.
And a business associate is someone like CIT where we have collateral access to the records,
maybe not direct and managing those relationships and how that information is accessed or transmitted
appropriately.
Yeah.
And there's a lot of ways to do it.
If you are storing electronic health data, if you're storing PII and you're unsure, it's
a great basis for ensuring the safety of that data.
Even if it's not even related to healthcare information, if you just want to ensure your
data, the data you're storing about customers, anything is safe, it's a great baseline for
it.
Awesome.
So, we kind of covered what is HIPPA.
What does it look like?
Right, we have the lovely clickbait title of, Can you afford $10,000 in HIPPA funds?
What is a violation of HIPPA then?
So violations of HIPPA are ways in which it's being knowingly or with malicious intent or
not, broken or ignored.
The federal government made it very clear that health information is protected.
That's where the HIPPA idea comes from.
And so to ensure the safety of that data, I think it was back in 1996, they, realizing
that computers want a fad that were going away, created this to ensure as much of that
data is stored safely as possible.
Back then, we obviously didn't have as much power or as much of the things that we can
do with them now, but they were still aware of what was happening and how much of it was
being digitized.
So, the goal was to create a system and ensure everyone and healthcare providers, hospitals,
et cetera, were following a pattern that kept that data safe, no matter what type of computer
they were using, no matter how often they were using it, what they were using it for.
The computerization of that information was what was being protected.
Now, they included a lot of stuff about physical information.
They did expand it, but that was the basis of it.
So violations come from intentional or malicious, as well as unintentional or non-malicious,
yeah, violations of that act, whether they are from not getting to something in time,
something wasn't prioritized, and that was the thing that happened, that went wrong.
It's about, was that data inaccessible?
Was it stolen?
Was it impacted by a ransomware event?
These are the types of things that can occur.
Violations come from knowingly, for the most part, knowingly, choosing not to do something
about a fault that you know exists, or choosing to try and be ignorant of those faults in the
first place, which is the big one.
Yeah, I smiled when Matthew said that.
There is a little bit of a phrase out there that says, ignorance is no excuse when it
comes to compliance, and that's, it's 100% true.
You can't go into a situation where you say, well, I didn't know.
It doesn't matter.
If you are in a compliance industry, you are required to know.
Somebody within your organization does need to know the rules, the guidelines, the compliance,
etc.
I'll try not to tension into that too far, just because I naturally do.
There's always help out there, right?
There's always help.
If you need help, find the help.
But if you don't know what those are, you're going to either have to get yourself up to
speed or find somebody that can help you get there.
Even at a basic level, right?
It's not, there's no expectation that you would be the person applying permissions,
or you're regulating keys if it's in the physical set, something like that, but knowing what
and how is always key to add on.
Ignorance is not bliss at all.
You can't put your head in the sand and be like, oh my gosh, look at this.
Look what I found.
Let's put this here.
I say that with all the just intended, but it really is pretty serious.
I'm not quite to the, there's a lot of different variables associated with the fines of willful
or unintentional negligence, I guess.
But they are significant.
In no way do they look at, well, I really didn't try, but you didn't try not to either.
Yeah.
It's like parenting.
Things come back full circle to parenting in my station in life right now.
So, well, you didn't try not to hit your brother either.
It's kind of, did you try to protect it?
No, I didn't know I had to, but you didn't try not to.
Yeah.
Exactly.
There's a, those of you who've listened to our FTC podcast know about the qualified individual
that's really pushed through heavily in that.
And that comes through with HIPAA as well, because there's a HIPAA privacy officer.
And that person is, they're in charge or they're the data owner effectively for those
EPA child locations.
So the electronic personal health information, knowing where that information is, knowing
what it looks like, making sure they're aware of what the HIPAA rules are, that's what it
comes down to.
You should have one, you should define one.
And that person should be making sure at all times that they're thinking about this and
keeping track of it like I am with lasagna.
Can you expand on the difference between data owner and data custodian for those that don't
know?
No.
No?
Okay.
Yeah, I can.
I just thought it was kind of pertinent.
You used it, so I thought it just to make sure that it kind of expanded on it, whatever
it is.
So typically the way it looks like in most organizations is an oversimplification is
the people that are in charge of it, they essentially become the owner.
So in a lot of organizations, if you're looking at HIPAA data specifically, most people are
going to turn their heads and look at HR and they're going to go, you're the ones that
are in charge of that kind of information from a benefits perspective.
The custodian would be the person or persons that are in charge of making sure that they
do the right stuff with the data.
So for example, it was mentioned that the data needs to be encrypted.
So there would be somebody in a security team potentially that would go, all right, we're
going to review all of the sensitive records and we're going to make sure the appropriate
security controls are in place.
So we're going to review and make sure that the drives are encrypted.
We're going to make sure that the access is correct.
And again, kind of differentiating between the two, the owner is the one that defines
what that access looks like.
They're the ones that say, Matthew can have access to that and cannot.
And then the custodian applies those security controls to it.
Sorry, I didn't mean to derail you too much, but I did kind of want to ask if you could
kind of expand on that individual that you kind of highlighted to and kind of go, who
is that and what additional responsibilities do they have?
To add on to that, I think that data owner, if you will, is not necessarily a lot of people
think that's the individual whose information it is.
While that might be part of it, it is not entirely the scope of what that definition
hits.
Yeah.
And to tie in with what Todd said, at a previous organization I worked as the data custodian,
we had our HR was the data owner, our head of HR.
And so basically as part of the custodian pulling the admin information to confirm who
had access, check all that information, then refer that back.
And again, this is a lot of technical information sometimes converting that into language that
it's not just here's a read, write, read, edit output from a NTFS record for you to read
through and explaining what it actually means, who actually is in there, what they can and
cannot do.
That's kind of that custodian's job in this case to ensure that it's fully understood
by that privacy officer or the data owner what is happening and what it looks like contextually
within the organization.
If it is a smaller organization and you do have someone who is technical, they may be
the same person.
You know, it's contextualized around the size of your organization, but do keep that in
mind that there is segmenting that gives you two people who are reviewing things.
Less things are going to be missed.
More things may be caught that otherwise wouldn't be.
Do try and segment those roles when possible.
Yeah.
One thing I want to mention on this as well is that it's not just cybersecurity issues
that get violations and fines.
A lot of the times when people hear about it, they hear about, you know, such and such
got hit with ransomware and didn't report it.
Not reporting a breach when you've had one within 30 days is a big deal with HIPAA.
And it will get you fines, but that's not the only thing that'll get you fines.
Employees reading healthcare records that they don't have any right to view that aren't
related to patients they see is a big one.
Failure to encrypt your data, which Todd mentioned previously.
Not disposing of data correctly, physical or digital data.
Organizations have been fined for going out of business, not destroying their data correctly,
and therefore having patient data that hasn't been destroyed, they've been fined additionally
after they've gone out of business for that.
This also includes civil and criminal fines and types of violations.
So it's not just being fined by the government, it can be by the individuals who are impacted,
because requesting access to their data and you not being out of provided within a timely
manner, timely manner in quotes here, because I believe that's their actual language, is
a violation of HIPAA and you can and will be fined for it if a patient is requesting
this information and you can't provide it.
Why can't you provide it?
Was it lost?
How was it lost?
What were you failing to do to that data to keep a copy safe?
There's a lot of options.
Anything coming to mind for anyone else?
Yeah, I mean, I think you're on the right track.
There's a lot of stuff that goes in with it.
One of the things that you mentioned too is this isn't always a security or a technical
thing that goes into it.
When it comes to data retention, there are policies that are required for organizations
that are compliant with HIPAA and it specifies what data you need to have and how long you
need to keep records of it.
So when you get into destroying the data correctly as well, that also is part of that life cycle
and it includes making sure that you don't hang on to it too long.
Most people tend to err on the side of well, just keep it.
Well the downside of keeping it is that you've increased your exposure.
So if you have a policy that says you need to destroy it within 12 years, you better
get rid of it.
But I think more often than not, what we typically see is a lot of people don't retain the data
as long as they're supposed to and that can be problematic as well.
Earlier somebody had mentioned that there are a variety of different penalties and a
minor correction.
Kelsey had mentioned $10,000 fines for HIPAA and HIPAA actually has a variety of different
tiers and it can scale up dramatically and it's up to about $100,000 per month and somebody
could be fine with it.
And while there are ranges within the tier and I'll let Ann and Matthew expand on this,
you can have multiple tiers impact you simultaneously so you may not just get hit with a singular
fine.
But can either one of you or would either one of you kind of run through the tiers so
everybody has an understanding of what that looks like?
Well I would say not even the tiers but it is very often on a per record basis and keep
in mind that while HHS does want to know about all breaches, they don't typically get
involved unless it's over $250 or $500 and then if they are and that is exponential, that's
500 records times that fine until remediation or resolution has occurred.
Exactly.
So it's $100,000 on our other title is a nice gateway line in the sand.
It can just go so wrong so fast and I guess this would be the conclusion part of this
is if you were to be in the middle of this, you want to find resolution to this as quickly
as humanly possible because it will be costly to you.
Not just monetarily in fines.
But also reputationally that might be an unrecoverable business incident to your reputation.
Most definitely.
Completely agree.
We've seen it.
There's definitely places I haven't gone because I follow this list and I've seen maybe multiple
complaints come up or something like that.
From the tier list and breaking down what Anne was talking about with where they come
from, I'm not a lawyer.
So there's some things in here I want to cover really quickly because this is the only way
I can think about this and it's called men's rare and basically it's the intent behind
the action.
So was someone aware mentally of what they were doing and with intent?
We discussed this right at the very start about whether ignorance has done an excuse.
So if you said I'm not going to worry about HIPAA as a medical practice, we're just going
to do what we do, that would put you the system is based and the tiers are based on how much
of your intent was based around HIPAA.
And so if you're saying right out the gate as a leader of a company, I'm not going to
worry about HIPAA, I just want to start getting everyone working and making money.
That is you ignoring HIPAA and that has malicious intent for the fine system here.
So the four tiers are based around that.
So were you making reasonable efforts and just hadn't gotten to something yet?
Do you have a full team in place?
Maybe you've done a full risk assessment and you're getting through your list of items,
your plan of action and you get hit with ransomware that got in through something that was lower
on your list than you're already at.
That would count as you guys doing a reasonable action, doing everything you can and just
you won't, you've misprioritized, right?
It was you put in as much effort as you could.
The second tier is a lack of oversight in which you're basically not doing all of those
items you could.
Maybe you didn't do a risk assessment, you were just kind of getting to things as they
came up and that one's the fine numbers increase exponentially there.
In tier one, the minimum violation cost is $127.
When you get to lack of oversight or that tier two, it's $1280.
So about 10 times what the one before is.
And tier three and tier four tie in with what Anne said.
So tier three and tier four, malicious non-compliance.
So you've intentionally said that doesn't matter.
You've ignored some part of it, whether it's encryption at rest because you don't have
a system that can do it and you decided you didn't want to upgrade the hardware or you're
intentionally sending patient information in an unencrypted way.
Those are examples we, I have seen.
And the difference between tier three and tier four is how quickly you rectified the
issue.
Were you able to resolve it like Anne said within 30 days or did you keep it going for
more than 30 days?
And this is where the fines really start to rack up because there are people on the wall
of shame, which we will be posting in the podcast links, which is a link to all the
organizations who have been fined and have had violations that are paying millions of
dollars in fines because it took them two, three plus years to resolve an issue.
So the minimum penalty for a tier four violation is $63,000.
The minimum for a tier three is $12,000.
What was that in?
For one.
Yeah, for one, exactly.
For one record that is impacted by this.
And so those fines grow exponentially.
My favorite part about tier four is that the minimum and maximum violation is the same
penalty.
They basically said we will be charging you $63,000 per violation after that 30 day mark.
There was a cap on that though.
The bright side is there is a cap.
You get capped out at about two million per year.
Exactly.
So anytime it is more than two million, you know that this organization has had this issue
going for more than one year, which in its own right on the wall of shame is great to
see because you can see how long it took someone to resolve something past that initial 30
days.
So again, those tier systems are based on intentional and active awareness of HIPAA and
whether or not you're intentionally doing anything to try and work on your system to
better where you currently stand and choosing not to do anything because it's quote unquote
too much is going to give you fines, big fines.
Don't do that.
Yeah, there's a couple things I wanted to throw on that real briefly is I think the
wall of shame is a really important thing.
And I know it could potentially have this negative connotation that makes it seem like
it's a fear inducing thing.
But and hit on it, right?
There are things that sometimes can be more than just monetary there.
That is a reputational hit.
That is a major problem.
You're not only being hit with a fine, but somebody's pulsing it and that somebody is
the US government is saying how bad you screwed up.
And so it's completely available.
All you have to do is Google HIPAA wall of shame and it'll be the top hit on there.
So it's incredibly easy to find.
And then it's got all the information that Matthew mentioned on it.
And when he mentioned the risk assessment piece, there used to be I want to back up
briefly.
There used to be the same that HIPAA had no teeth.
HIPAA really wasn't something that was heavily enforced.
Go look at the wall of shame.
There's a lot of people that will tell you that is absolutely incorrect.
HIPAA has teeth, HIPAA hurts.
And it can put the people out of business.
So it's a big deal.
That risk assessment that Matthew had mentioned is important, right?
So what you're looking at is what is the risk to the business and easily we can quantify
this by the amount that it would cost to.
So as you're looking at it, you're saying, well, that potentially is a high risk.
What is the impact on it?
And we can look at impact in this particular scenario on the cost, right?
And if I can say that the risk of not encrypting data that I'm going to send across the wire
is potentially up to $2 million per year, I know what I can put in place to mitigate
that and still save myself hundreds of thousands of dollars and do the right thing, if you
will.
So that's kind of what you should be thinking about as you go on.
What is the risk to me?
What is the impact?
What is the likelihoodness and what is the cost that it's going to be if something like
that does happen?
And then you can figure out whether you should start to put in a tool, a policy, a procedure,
whatever the case may be.
I know I jumped ahead a little bit there on one of the next steps, but I just kind of
really wanted to emphasize that this is no joke.
This is incredibly important for organizations that fall under this compliancy.
I may have been misremembering this, but I think the title of this podcast is something
that I actually said in either a different podcast or in a conversation with Ann.
In relation to an organization saying, and this was a hypothetical saying, they didn't
want to pay for a new employee.
You don't want to have a new employee.
You think you've got the team you need.
You know IT people internally are expensive and outsourcing can be expensive as well.
Okay, well $100,000 in fines a month, up to $2 million a year.
Is that less than the cost of hiring the staff you need to complete the work and get your
HIPAA compliance on track?
Is that what you have?
And that ties in with what Todd was talking about because, well, now that we know what
these fines are and what the violations look like, what can we do?
Well, firstly, you need a HIPAA booklet.
And as soon as you start putting that together, you're going to see that right at the top
of that list is a risk assessment.
Having a risk assessment, finding the things that are high risk, ensuring you have the
right team in place to begin working on it, and then getting that HIPAA booklet together
and training your team on what the system...
Education, education, education.
Exactly.
If you've listened to one of our most recent podcasts, you'll know that probably going
to get this number wrong because it's off the top of my head.
80% of all security incidents are still caused by individuals, whether it's malicious or
non-malicious, doing something that they think is fine.
If we go with the non-malicious, they're clicking on a link in an email, they're falling for
fishing, they're doing things unintentionally that cause a problem.
Now that is a training issue.
And the HIPAA compliance booklet and the risk assessments let you find out where these
flaws are and do their testing.
It is a knowledge base.
So me talking about policy and documentation again, surprise.
It's what it comes down to.
If you have that documentation, if the team is trained on it, if the leadership is trained
on it, you will mitigate your risk significantly and therefore mitigate those fines because
having them in place, being aware of them and working on them can drop you from a tier
three to a tier two.
Being so aware of what you plan to do and just as an example, a medical clinic I know
who was working on moving to a new service system had an outage because of it.
We'd already purchased, and this is a previous employee, we'd already purchased the hardware,
they had their outage.
We pushed that migration up, replaced their old servers with the new servers, got everything
spun up.
They were down for about seven to eight hours I think in the end rather than the close to
three or four days it probably would have been for us to get the replacement hardware
in for their old systems.
That alone resolves an issue for them quicker than it would have been because they were
prepared for something even if we had to push that timeline up.
Those are the things that can keep you under a 30 day neglect tier.
Being prepared is going to make it that you're ready for this.
Maybe you've quoted out how much it's going to be.
Maybe you've got it in your budget and it's just pushing it up earlier.
The less surprises there are in your regular working week, the less there's going to be
when something breaks that as well.
I kind of sprang through that last part.
Sorry.
I was going to say, I'm just watching Todd and Anne you're going, anything else to add
to it because I was like, I understood it.
I think it's better that anything else Todd or Anne before we wrap up.
The one thing that I would add is rehashing some of the stuff we already said.
In case it wasn't clear, the HIPAA guidelines are for everybody.
You can be a Fortune 5 company or you can be a chiropractor down the street.
You're still under the same regulation.
When we talked about that aspect of ignorance is not an excuse.
This is what it's getting into.
When you don't have the expertise and you open up that HIPAA booklet and you're working
through it and you go, I don't have the slightest idea what that means, that's too bad.
You're still held by that compliance.
You're going to have to find somebody that can help you through that.
There are, as I mentioned at the very beginning, there are people out there that do it.
Obviously we do, but there are plenty of people out there.
Find the help when you need it because it is really important and there are things to
do.
It's risk that's easily mitigated at a pretty inexpensive cost.
I just wanted to wrap the entire conversation around that with that little bit of information.
I was going to say for those people listening, there's a lot of smiling and nodding going
on in the background.
Yes, but 100% as Todd mentioned, we're here to help even if you're not listening somewhere
near us, you're in Minnesota, if you're somewhere else and you're going, hey, I still want to
get connected with somebody, you can still reach out to us at info at cit-net.com.
Even if we can't help you, you can certainly get you connected to somebody else who can
or if you just want to talk with one of these people, as you can tell, we love to talk.
We will talk anytime.
Or you can of course put a question into our website at cit-net.com backslash podcast.
But as always, thank you Todd, thank you Matthew, thank you Anne, and thank you Ariel for sitting
with us and we'll be back next week with yet another episode.