Did you know that the most popular non-chocolate candy is Skittles?
Yeah
Because I buy so many
Makes sense I think we're talking about candy. I think it's candy or candy bar, you know what your favorite candy or candy bar is
Okay, Matthew, we're ready. Yeah. Yeah, I'll go into it. Um, so there's this Australian
this Australian calling it a candy bar is a little iffy because
There's nothing else to it, but chocolate and caramel, but it's called a curly whirley. They're amazing. I
Highly recommend you try them
My partner gets them for me every Christmas as a pack of ten
Just that I have some and they last me maybe three days. So
Quick Google search says you can buy them on Amazon, but you also be advertised for hair product
Yeah, you can't it like I thought that you to begin with and this is a bit of a tangent
But I thought that she was doing this whole like she'd found like an international shipper that was getting them from Australia
And then I found out that were just on Amazon, but it's still a really nice gift and I really appreciate it
And it's made by Cadbury who knew yeah, oh
Who's next?
I'll go I don't really eat candy bars
So I'm gonna go with the craziest one that I can come up with and I'm gonna tell you the curly whirley is a way better name
But it was what you recall it
That's it, it's all I got
Information don't actually sell those very it was gonna ask like are they making those anymore?
But I didn't want to call you out
I got a report from a friend that there was a quick trip near Green Bay that actually had watching McCulloch's
And she bought eight because that's all they had
And she put them in there her freezer to try to pace herself
You can buy a whole
What does this say it there's one on Amazon that's 44 bucks for a pack of 36
That's a yes, they started the yeah, sorry make go
The discovery is part of the fun. Oh, sorry
There's a who's it what's it as well?
I've never heard of that one
All right, I'm one of oh
I was gonna say I'm one of them that's like in the plane plane Jane category and
Snickers, it's just good. It's just you know just hey
I'm gonna have one of them quick and easy
Good to go. Oh, that's me. What about you Kelsey?
That's a great question as I'm like, yeah, I'm boring and I have food intolerances
But if historically if I was gonna risk having stomach pains my great-grandma used to have a Hershey's chocolate bar every single night
Before bed and then my grandma did the same thing and then my mother did the same thing
So I'm trying really hard to not follow the trends, but if I did just a plain chocolate bar every night would be
I'm here for it
What about you and
There I think there's ones I don't care for but I like I like coconut so I like mound or was it
No, I'm a joyous. Yeah
I'm singing the song to the thing in my head. I
Love take five because I like the salty
Caramel
But I'm like Tara too. I give me a sticker. It's great. These are reasons. I don't keep these things in my house
I've been liking
Twix as I get older like I like the crunch. I never liked it as a kid, you know, but
Yeah, or Snickers. I'm in the Snickers family too. I love it
So today on our tech for business podcast, we started off talking about chocolate because we're talking about healthcare
Kelsey Tara and myself are joined by Todd our COO and CISO
Matthew our GRC analyst and our GRC specialist
If you've lifted listen to the podcast before I'm sure you've heard us talk about healthcare and cybersecurity
So today we decided to dive right into best practices for healthcare
and I'd like to start off
just about a
Little bit about maybe why we're talking about this and why we're focusing on healthcare and we're not focusing on
Other industries why this is so important here in today
someone wants to
dive into the weeds of that one
I think the reason it's come so high
to the top of how we manage it and how we help our customers manage it is
Everything is digitized now and being able to protect it in all forms. It's not just about having a
File cabinet in the back of a clinic somewhere it is who has access. How can you transport?
How can you transmit? How how can you effectively protect people's data and
And that's that's not anything new but for a lot of especially for long established
Entities that have healthcare or even new where it hasn't always been a requirement to manage it that way. It really is is
Becoming much more significant
So what's what's happening in the healthcare industry, I mean
You know you think about they have access to personal information and all the the HIPAA laws
So I would assume that they they have all of their stuff together and that
They're doing a great job about being protected, but here we are today talking about it. So that's clearly not the case
so what is
What is sort of
Putting these healthcare centers at risk
Yeah, I mean the one things that I'll add to it is
Everybody's at risk. I to your point how you opened it up is why are we talking about healthcare itself is a great question
And there is really a good important reasons for it, but everybody is at risk health care is important because they do have very specific data
And it's very specific to individual. So it's very identifiable and no surprising
They have two acronyms for it PHI and PII once healthcare information or health information
The other ones identifiable information both persons of themselves and they have a lot of it and I
I think we've done this before on previous podcasts, but just for clarity's sakes when you're talking healthcare
It's not just a hospital. It's not just a clinic. You're talking about eye care
That can be your LASIK teams or it can be the clinic. That's taking a look at your eye and helping you with glasses
It's a chiropractor your living senior living is a fantastic example of
And so it crosses a lot more than most people would tend to think and yet every one of them still has the PII the PHI and so that's why it's a very important thing
And it's also the reason why they're heavily under attack. I was looking for the statistic and I couldn't find it off the top of my head
So I'll take a look when Matthew starts talking here, but
They are one of the most heavily attacked industries out there and the reason is just that right?
There's a lot of information that they have exactly um pod they they've they can go back and listen to our podcast on the
On the other reports that we've done this year if they want to suppose but um
You just spot on that
Healthcare data is worth a lot because while we think of it as the appointments that we go to and things like that
It includes so much personal data that it sells for a lot
And so higher profit for the people who are committing this crime is going to result in more attacks
It's everyone who has patient data whether they're storing it for someone else whatever it is
It's also going to impact people who sign business associate agreements with these places. So if you're storing this data at all
You're impacted so while there is a lot of it that is they are a high risk high value of the data
Are a high risk high value client
Or a high risk high value target
There's also the fact that the scope of who is considered the healthcare industry is really large
So there's more attack surface more likely to get pulled into it
As for
Why they're at risk as well
There's a number of things to go with that
But it's best to remember that not everyone is at the same point in their compliance journey
Which is a phrasing that I've heard and use a lot and I've very much tried to take on board as helpful for me
Because I started out with helping new doctors who are going into private practice with the software that we're using
So because of that that kind of guideline of there isn't anything in place where can we start there
Is a really nice place to begin in let you really focus on making sure you're meeting the guidelines you have to
Most organizations are not in that place. They've already got a ton of things in place. They've already got software they're using hardware they're using
Sometimes it's hardware that they've had to reuse because of certain situations that mean it's maybe not as up to date as they would like it to be
All of these things increase the risk, but they also increase where you are in your HIPAA journey
So personally I think the number one thing is just it's becoming a focus as we go into in some of the other podcasts you can listen to
Finds are increasing. They're also seemingly on the rise in general for not meeting HIPAA guidelines
So there's there's a real incentive to make sure you are meeting them. There's a real incentive to make sure that they're being met within the scope of how you can meet them and without jumping too much into the next topic I want to go to
Thinking about where your risks are
That I mean that kind of seems where we're going is you know
It's going to telegraph my play
So
I believe we've spoken about risk assessments previously on the podcast
Even if we haven't I'll try not to go into it if there is any desire for them I can and we'll talk about them at length at the drop of a hat
Risk assessments are a great place to start and probably what I'd call the first best practice to dig into
It's about knowing your environment top to bottom and knowing the environment of knowing the current risk scenarios. So what is most affecting healthcare industry at the moment?
Is it ransomware? Is it people falling for phishing scams? Is it credit gift card scams? What is it that's impacting the business the most?
How could your organization fall for that? What systems do you have in place that would stop that? And at what point do you worry about
Your system not being secure enough versus the potential loss you would have if someone were able to get in through that system
Very roundabout explanation, but a risk assessment is definitely the first place I would start
And the main reason for that is that it will give you the best overview with a security mindset of your environment
Yeah, I think you make an excellent point. As you were talking through in the previous statement before we had the pause
You were getting into how everybody's at a different spot in their journey and as you were going through it it kind of triggered a memory for me
Which is one of my neighbors, he lives a couple of houses away from me, recently opened up an oral surgery clinic and so as he was doing that
He's now the sole proprietor. He's responsible for everything and so he's at the very beginning of this journey
And the question for him is where do I start? Well, Matthew just laid it out. It is a risk assessment. There is another thing that you can kind of do too
For him it was a little bit less concerning just due to the fact that he's such a small organization
But what is very very important is when it comes to all security practices as you start to get into the actual implementation of them is you can't protect what you don't help
So you need to find out another assessment is what assets do you have. Is it your computers? Is it your applications?
Etc. Etc. If you can't figure out what all those are you stand no chance in protecting them. Well, but the downside of course is that the bad guys can figure it out and they can figure it out very very quickly
Exactly
Just quick tangent there. It is far easier to scout a network you're already inside than it is to try and figure out what you have
Because when you're looking for vulnerabilities versus looking for an explanation of what's in place those two things are very different
And if someone hasn't gone through and documented what they were doing to begin with if someone hasn't been very clear about the purpose of each server you have on site
It's very easy to get lost as to what they're doing especially as a conversation that happened previously goes
Sometimes people are using joke names for their servers. Sometimes they're using the planets the the moons of Jupiter. Sometimes they're using Disney characters
These are fun and definitely when you're connecting to them every day it's a nice little
It's just a sense of joy every night again when the names pop up but it doesn't help from a security standpoint to know what that service doing
So risk assessments really help you get everything back together especially if you've had multiple people build it out whether you're contracting or you've had multiple internal IT stuff
That risk assessment gives you not just a technical overview but a business overview of what your attack vectors look like
Where are you most vulnerable?
And then we move on to being able to talk about acceptable risk. So at what point are you saying it is okay for us to not resolve this issue right now because we have protected it by doing x, y, z
I would add to that risk assessments are not only the best start but they are so important that so many of the industries have built them into requirements annually for their
Their auditing and controls. There is a requirement to have a HIPAA security assessment risk assessment annually as you mature through your and that's really impressing upon everyone
Not the severity but the importance of what you need to have and how you need to be aware of where your requirements are
Exactly. I like to think of it as well from the, because I tend to come to things from the technical side of things so knowing where the network is and what it all looks like and what everything is doing is huge
But when you come from the business side as well, what's the potential loss if something goes wrong here?
And as such, are you spending enough money on your IT at the moment?
Remembering that when you're putting this risk assessment together, the person who's putting it together may have the mindset I used to have which is just I'm putting together a technical analysis of the network and where I think the damage could be done the most
Well, that's great, but unless you can define what those potential damages are from a business perspective, it just looks like a wish list
By monetizing it and you can find those numbers online. You can find them in the reports that we've gone over on these podcasts. We cover a lot of those numbers, but the I triple C has information Verizon puts out a yearly cybersecurity report which has a lot in there as well
And reviewing those and getting those numbers is part of that review, part of that risk assessment.
It should be anyway.
It should be definitely because this isn't just like I said, a technical review. It is a business review that you should be taking to leadership of the organization to the board if there is one.
You want buy-in from the whole team. There's so much that goes into it and it is a big undertaking, but it's a big undertaking because it is a business evaluation and a technical evaluation of your current environment.
So right out the gate, just a huge first best practice.
Yeah, well, I think I got a little one in there too, but one of the things I was going to do is you're kind of trying to pivot off of that a little bit.
When I said in specifically you should include that the reason why I said that is because we're going to have people all over the map when it comes to maturity.
And if you get stuck or you're overly concerned of, well, how am I going to figure out what that assessment of value is?
It shouldn't be the last step that you take and you stop and go, okay, that's it. I can't go any further because I don't know the answer to this question.
The reason why I bring that up is because we do a lot of assessments for a lot of companies, a lot of industries, etc. And as you're going through that, I'll use the FFIC, which is not healthcare specific.
It's finance specific, but that particular assessment actually considers the monetary assessment as part of a middle area and intermediate.
So you actually have to take a while to get there.
So the reason why I'm mentioning that is because I think the things that we were talking about at the beginning are the information.
And this is really where the risk for healthcare comes into play specifically is not only do you need to know what assets you have on the network, the data itself is the specific asset that we're talking about.
In that scenario, you need to know what your data is. Where do you save it? Is it in your location? Is it physical files?
If so, what do you do? Do you lock the doors? Do you lock it in a file cabinet? Do you have people sign in when they come in? Do you have video cameras up?
Physical, right? Is it something that you outsource to a cloud? This is a little bit more of mitigating how do you mitigate the risk?
If it's in a cloud, somebody else is theoretically protecting it, but then how do you protect it, which we'll get into in a little bit.
But then the next step is once I understand what kind of data I have, it's paper, it's data on a logless storage, it's in the cloud, then you get to decide how important it is.
And this is where Matthew is getting at. What is the value of that? If I lost it, this would be the assessment you could easily do no matter your maturity is, if I lost that information, how much does that hurt?
And you could probably put a pretty quick number to that most organizations and go, and not so much, I could probably get away with probably not even needing that.
So then the risk is very, very small or that would put me out of business that and that value is, we'll say my business is worth a million dollars. That's a million dollar risk.
Okay, we can now move forward on the rest of the risk assessment.
I'm going to stay on data just real briefly before I be quiet for a little while again is as you figured out what it is and how valuable it is. One of the other things you absolutely have to do, and this is Cora HIPAA, is you need to define how long you're going to retain that data.
And once you've gotten to the point that you're not going to, and I'll let it end and Matthew tell you what that number is, what are you going to do with it?
And the answer is you better get rid of it because if your policy says I'm not going to stick it around, you better not have it.
Yeah.
Have a policy and follow it to the letter.
Exactly. There's a quick thing you mentioned there with the length of time data should be kept for.
The specifics of this I won't go into, but suffice it to say that the HIPAA documentation doesn't explicitly give a number.
But the consequences of the HIPAA documentation does give a number. So that number is seven years.
Which is a lot.
Okay, so to get curious, that's a lot.
It is. I think it's for a full six years, I think is the exact language. So we just say seven as a way of having that cut off.
And specifically, it's about how, when was that information last shared?
So it's not about when did the last patient visit occur, it's when was that information last shared, and that's what you've got to track.
So keeping everything to do with that, which most EHR softwares will do, they'll track this is when it was last accessed, this is when it was last, an email was last sent out from it, etc.
Keeping the whole patient file includes that information in a lot of cases.
If you're sending email, if you're sending HIPAA data via email, you better be tracking those emails for seven years.
And if an individual who sends HIPAA data via email leaves, you've got to keep those emails for those full seven years so that you can track what was sent out.
So I'll stop there because we can dig into this so deeply. It's one of my favorite topics on here.
But seven years, try and keep all your, don't try, keep all your data that includes patient information for seven years.
Yeah, one other thing that I'll throw on there, and I'm sorry if I interrupted you, Ann, is not only do you need to make sure that you're doing that, to me, there's kind of like the subset of that.
And it's actually more important that I'm making it when I call it a subset is you need to monitor those files too, right?
So you'd actually enable the say, when was the last time I shared it? You actually have to know what that is.
So you need to monitor the access of the file, the sharing of the file, etc.
But even on a deeper level on that is hypothetically, if you're doing that and a bad actor was actually trying to mine your data, you would see that that potentially could be right this very minute.
And if you weren't expecting that, you should have the monitoring tools be able to alert your team, whether it's you specifically your security team or a partner, that would be also incredibly important.
And I'm sorry if I interrupted, but go ahead, Ann.
So having the, this goes back to the policy part, having the ability to you get to make your own rules within the confines of the requirement.
Things I would almost recommend is moving the data to a specific spot with that control to, I say a C drive on a computer that is absolutely not true.
But if this is a record that was accessed now, but it is likely they will not need it anymore, move it to that pile or controlled area.
Just little things that work for you and your operations in general to make it easier for yourself long term.
That may not look like the example I described, but just trying to not have to revisit things in six full years, not seven.
And you make a really good point about something that we saw recently that I want to touch on here as briefly as I can.
It's very easy to think of these things as static, right? We have to keep this for seven years. Okay, that's cool.
But as Ann said, it's not, we have to keep a full active backup of this for seven years.
You can archive things, backup the archive and keep that.
It doesn't have to be, you obviously need to make it accessible, right?
So don't just do one backup that you then put in a lockbox and hope it survives.
Have a couple backups, be thorough.
But the goal here is to ensure that data is accessible if necessary.
It's not that it has to be part of your full active system all the time.
Otherwise, things start ballooning and I'm sure we've all seen, especially patient data balloon in size significantly.
You can pivot with what you're doing with something.
If you, just as a quick example that came to mind, if you are a PCI customer who does take credit card information but doesn't need a credit card reader and the credit card reader is sent to you,
you can send that back and not have to follow all of the PCI requirements that would be included if you did have a PCI reader on site.
Those pivots can save you a lot of time and money and make things easier.
So work within the confines of what those rules are to give yourself the ability to pivot as well.
I'm going to transition back a little bit.
I know we were talking about what is it, why is it important, etc.
And then we started to get into what we're doing about it.
And we did talk very heavily about figuring out what you're going to protect, how important that is with our risk assessments and whatnot.
And now what are you actually going to do about it?
And I want to bring this up now specifically because there are two things that I tell companies if you do nothing else do this, and I think should we probably even have a podcast on it.
If you do nothing else do this, and those two things are, you absolutely need to multi-factor pretty much every damn thing on the face of the planet.
And you should also have endpoint detection and response.
And I know I have podcasts on both of those topics too.
If you do absolutely nothing else, and again, one, two, three of those podcasts exist, if you want to go get them, go get them.
You should be looking at MFA, you should look at EDR.
The other stuff is fantastic too, but you do need to do these things in every healthcare.
I don't care if you're senior living in, you think that this is a burden of entry that I cannot achieve.
That is incorrect. You absolutely can achieve it.
We can get into the profitability of senior living or something along those lines later.
But if you look at it, the typical resistance we see is that the nurses have to dispense medicines and so on and so forth, and therefore it's inconvenient.
Great, I understand it's inconvenient, but there are tools that allow you to overcome that.
If you go into the clinic, you go into the hospital, those doctors are extremely expensive and they don't want to type in their 15 character password.
And you know what, they don't, but they still have multi-factor on their devices. You can get there from here.
It does exist and it's incredibly frictionless.
So I will not accept your answer.
Oh, sorry, I'll get off my soapbox.
I would say that the most important thing to do right now is be aware and educated on your requirements.
That doesn't mean that you have to read, I mean, I love to do stuff like that and read thick manuals looking for all the detail.
But in every requirement, whether that's HIPAA, FDIC, financial, there is always a summary document of what's important, what to protect.
And obviously that moves right back into the risk assessment.
But ignorance is neither bliss nor an acceptable answer to not following.
And it is difficult to say, well, I just didn't know, but those days are kind of going the wayside.
It's not acceptable to say you've had a clinic for 10 years or even two days and you don't know that you have HIPAA requirements.
We find an easy way to do that and communicate to all those affected, which would be all of your staff, what is specific and measurable to them and why to Todd's point.
Do you think a doctor will type in a 15 character password?
No, but there is a way, but stressing the importance and the implications of not is just as important.
Yeah. Two things briefly as brief as I can be.
I know I keep saying that today, but it's how I'm feeling.
Firstly, I think we'll try and have the summary of the security rule, the HIPAA security rule in the brief.
So if you're listening now, it should be there for you.
And two, there is so much that goes into what the best practices are and we've really touched on, I would say, probably two of them in this, the main one being that risk assessment followed by the MFA.
And the reason we focused on the risk assessment is that as you start doing it, as you get through it, you'll see all of the rest of these items come up because a risk assessment is exactly the reason the rest of these items exist.
Some of them may not be relevant to you.
So reading through that security rule and trying to implement everything without knowing what you have is basically blindly running around the house, seeing if all the doors and windows are locked and then forgetting you have a spare room.
It's very likely you're going to miss something significant.
So start with that risk assessment. If you aren't thinking about MFA already, you 100% need to be and speak into someone about getting it implemented in whatever way can be done to streamline the business.
But a risk assessment leads to everything else.
And as you do the risk assessment, as you read the summary, you'll see how you can implement and update what's in place to make it more secure and to give yourself a better chance of not being breached or impacted by some of these events you're hearing about in the news.
Yeah, now as I think we're probably closing out the podcast at this point too. So I had a couple of things that I'd add to that is as Matthew's talking about that ultimately what that leads to from my perspective is this also tallies off of what Anne was saying is you can't say I didn't know therefore I'm fine.
That is not okay. That will not work for you. So you do your assessment, you start to figure out all the things that you knew you potentially have risks around.
You need to build a plan. That's a long term process, right? And then after you've started to build that out, we refer to this as a security or a cybersecurity incident response plan.
You should have a process that tests the plan. The only way to get better is to test it, right? You build the plan. Now you need to test it.
And then the last item that I'll throw on here is we threw a lot at you in 30 minutes. I know that happens. If it doesn't make sense, there's people out there to help. If it's us, if it's others, go find the help that you need or read through the documentation.
If you're like Anne, you love that anyway. So go do that too. That's always an option.
I want to back Anne up here. I love reading that documentation as well. It's such a fun time. And I'm not joking.
Well, it sounds like a lot of reading. So not for me. I'd probably reach out to CIT or like you said, anybody, there are people out there who could help you. Any last closing thoughts? This topic is so big and it might be something we need to come back to in the future.
Anything else you want to share?
Yeah, just yes, it's a big undertaking. It is not expected you'll get this done in a week. It's not expected you'll get it done in 12 hours. Give yourself time. Come up with a plan. Cut it up into bite sized chunks. Work with other people on your team.
If you need someone to guide, we can help with that. Others can help with that. But don't think of it as a big thing that needs to be done. Break it down into small chunks that are possible. It is possible to get through it in six months to a year. It really is.
But don't give yourself a timeline until you've read through it all. You've started to break it down like that. Take a breath. You can get that.
I love it. That's kind of a beautiful way to end. Thank you, Todd, Matthew and Anne for joining us today. If you have questions, you need help. You want to know more about risk assessments or you need help testing, please reach out to CIT at info at CIT-net.com or head out to our website CIT-net.com slash podcast and join us next week with an all new episode.
.