In this month's Product Watch, we look at a phishing and social engineering threat simulator that includes security awareness training intended to mitigate the threat of phishing and the risk of a data breach.
Twelve state attorneys general filed a federal lawsuit last month against Medical Informatics Engineering Inc., in Fort Wayne, Indiana, for failing to secure its computer systems, which resulted in a HIPAA data breach that compromised the data of more than 3.9 million people.
Q: In a previous question, you said you can destroy paper records like charts as soon as they are scanned into the EMR if your state considers electronic storage media legally acceptable for medical records. My organization is currently rewriting our policy on shredding charts; is there any reference to this in HIPAA that we can use to back this up?
The healthcare sector is a frequent target of cyberattacks due to the value of PHI, which is the target of financial identity theft and medical identity theft. To safeguard PHI, you need to know the differences among phishing, ransomware, and DoS attacks.
A recent phishing attack against Network180, a mental health organization in Grand Rapids, Michigan, led to a data breach affecting approximately 2,200 patients.
In December, HHS Office for Civil Rights (OCR) released a request for information seeking input from the public in order to identify provisions of HIPAA that may impede value-based care or limit care coordination among individuals and covered entities, and which do not meaningfully contribute to protecting the privacy and security of protected health information.
Approximately 16,000 patients of Mind and Motion Developmental Centers of Georgia had their protected health information compromised after a ransomware attack on a server at the facility.
Q: A patient recently told me she was surprised to learn from another physician at our facility that her adult child had been prescribed a particular medication for high cholesterol. Her child is not a dependent adult under her care. Is it a HIPAA violation for a provider to discuss the care of non-dependent adult children with their parents?
In this month's HIPAA Q&A, we answer your questions about sending unencrypted emails to the right recipient, discussing patients with colleagues, scheduling appointments for spouses, and filing complaints against insurance companies.
