Let’s look at the historical approach from OCR when it comes to HIPAA Security Rule enforcement. Since 2005, the Office for Civil Rights (OCR) has relied on the carrot approach rather than the stick. The existing Security Rule defines risk analysis as the first required implementation of the first required standard. But the existing language … Read more
Remember the days of “Never gonna happen” when people wanted to work from home, even occasionally? All the compliance focus was on what was happening at the office, or during business travel. Then came the pandemic, and the organizations that would have fallen on their swords to prohibit all remote work for coders, or customer … Read more
Product and gadget creators get in a tight spot when IoT (the Internet of Things) security takes a back seat. It sounds harmless: “Let’s get to market then release security updates.” Getting market share vs taking care of security seems like a matter of course. Until someone uses that security gap to shut down a power plant. … Read more
The Internet of Things (IoT) is leaving gaps that malicious software can exploit, bringing down extensive systems. The increasing frequency and severity of the attacks has healthcare systems and their supporting technology vendors on pins and needles. Healthcare organizations may lose ability to access systems that are critical to patient care, in addition to affecting … Read more
The risk is real. With all of the attention on external threats to ePHI, like ransomware and cyberattacks, healthcare organizations and their digital health vendors may be distracted from threat of insider risk. Yet according to a recent HHS OCR newsletter “insider threat is becoming one of the largest threats to organizations and some cyberattacks may … Read more