{"id":10035,"date":"2020-12-21T15:22:00","date_gmt":"2020-12-21T20:22:00","guid":{"rendered":"https:\/\/www.sage.com\/en-us\/blog\/?p=10035"},"modified":"2023-03-30T05:56:33","modified_gmt":"2023-03-30T09:56:33","slug":"hipaa-and-security-at-home-is-someone-peeking-at-your-screen","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-us\/blog\/hipaa-and-security-at-home-is-someone-peeking-at-your-screen\/","title":{"rendered":"HIPAA and security at home \u2013 is someone peeking at your screen?"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tTechnology & Innovation<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tHIPAA and security at home \u2013 is someone peeking at your screen?\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\t
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"Brian\t\t\t\tBrian Bogie<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

I recently interviewed security expert Paul Johnson, who is a partner at Wipfli LLP’s Risk Advisory Services Practice, on HIPAA and information security during the November session of the Healthcare Hangout (insert link). Paul provided some interesting insight into HIPAA in the age of COVID-19, as well as some things to think about for your 2021 security planning. Of note, you may need to ask yourself, \u201cis someone peeking at your screen?\u201d. Read more to find out about this!<\/p>\n\n\n\n

HIPAA<\/strong><\/h2>\n\n\n\n

Unsurprisingly, much of our conversation centered on the security implications of working from home. According to a Stanford study1, 42% of US workers are now working from home. Many families have had to set up makeshift offices in their home. Doing this creates a need for security\/privacy safeguards for these work at home arrangements. According to Paul, \u201cThere are several security challenges that come with having a home office. Computers and other materials\/media containing Protected Health Information (PHI) may be accessible in paper form, or visible on computer screens by other family members or guests.\u201d You need to ask yourself who can also see your screen at home.<\/p>\n\n\n\n

Tip #1-Shore up your information.<\/strong> <\/h2>\n\n\n\n

Make sure that any confidential information or PHI is not accessible to others in the home. Lock away files, password protect your computer, and make sure to log out every time you leave your workspace. You don\u2019t want to end up on the HHS Breach Report2 often referred to as the wall of shame.<\/p>\n\n\n\n

Deadlines are fast approaching for the 21st Century Cures Act – Information Blocking Final Rule and Certification. The Final Rule supports seamless and secure access, exchange, and use of electronic health information. A recent article on the ONC website3 detailed that, \u201cPatients need more power in their health care, and access to information is key to making that happen.\u201d Among that information is transparency into the cost and outcomes of their care. <\/strong><\/p>\n\n\n\n

Tip #<\/strong>2-Understand and plan for the Information Blocking Final Rule and Certification.<\/strong><\/h2>\n\n\n\n

There will be a continuation into 2021 of the OCR enforcement discretions regarding HIPAA. According to Paul, \u201cHHS\u2019 Office of Civil rights issued a number of announcements related to COVID-19. Many were related to enforcement discretion regarding things like community testing, first responders, uses and disclosures by business associates, and telehealth. These actions are in effect until the health emergency is declared to be over and so will likely continue well into 2021. <\/strong><\/p>\n\n\n\n

Tip #3 \u2013 check out and understand your HIPAA obligations.<\/strong><\/h2>\n\n\n\n

Information Security<\/strong><\/h3>\n\n\n\n

Healthcare is the most targeted sector globally for phishing and malware attacks4. We are seeing phishing and malware attacks aimed at teleworkers. According to a recent ZDNet article5, \u201cWhile employees and their PCs were once safely behind the office firewall, now they’re perched at a makeshift workstation in their kitchen or bedrooms, using all manner of cobbled-together technologies to get the job done.\u201d When discussing this with Paul, he added, \u201cWe are seeing phishing and malware attacks aimed at teleworkers, as many organizations were not well set up to work from home, and so they had to rush to get their workforce set up-implementing remote access systems. Some have not set it up properly and created vulnerabilities into the organization\u2019s network. They may not be using multi-factor authentication, which can lead to account compromise.\u201d <\/p>\n\n\n\n

Tip #4-make sure you are using multi-factor authentication and test your remote access systems for vulnerabilities.<\/strong><\/h2>\n\n\n\n

Healthcare organizations should also be vigilant about protecting against ransomware. <\/p>\n\n\n\n

Tip #5-Review your cyber insurance coverage and make sure your systems are backed up<\/strong>. <\/h2>\n\n\n\n

Cyber-attacks are on the rise during COVID-19. Be sure to check your coverage to ensure it is adequate. A recent Security Magazine article6 found that, \u201c\u2026Newer strains of ransomware have been particularly malicious, with costly ransom demands and criminal actors threatening to expose an organization\u2019s data if they don\u2019t pay the ransom.\u201d <\/p>\n\n\n\n

You can learn more about HIPAA and Healthcare Security on Wipfli\u2019s Healthcare Risk Practice page<\/a>, including:<\/p>\n\n\n\n