First HIPAA Security Risk Analyst "Whatsoever things I see or hear concerning the life of men, in my attendance on the sick or even apart therefrom, which ought not to be noised abroad, I will keep silence thereon, counting such things to be as sacred as secrets." - Hippocratic Oath, 4th Century, B.C.E. Welcome to today’s Live Event… we will begin shortly… Please feel free to use “Chat” or “Q&A” to tell us any ‘burning’ questions you may have in advance © 2010-11 2010-12 Clearwater Compliance LLC | All Rights Reserved 1 How to Conduct a Meaningful Use / HIPAA Security Risk Analysis April 17, 2012 Bob Chaput, MA, CISSP, CHP, CHSS, MCSE 615-656-4299 or 800-704-3394 bob.chaput@ClearwaterCompliance.com Clearwater Compliance LLC © 2010-11 2010-12 Clearwater Compliance LLC | All Rights Reserved 2 Bob Chaput CISSP, MA, CHP, CHSS, MCSE • • • • • • • • President – Clearwater Compliance LLC 30+ years in Business, Operations and Technology 20+ years in Healthcare Executive | Educator |Entrepreneur Global Executive: GE, JNJ, HWAY Responsible for largest healthcare datasets in world Numerous Technical Certifications (MCSE, MCSA, etc) Expertise and Focus: Healthcare, Financial Services, Legal • Member: NMGMA, HIMSS, ISSA, HCCA, ACHE, AHIMA, NTC, ACP, Chambers, Boards http://www.linkedin.com/in/BobChaput © 2010-12 Clearwater Compliance LLC | All Rights Reserved 3 About HIPAA-HITECH Compliance 1. We are not attorneys! 2. HIPAA and HITECH is dynamic! 3. Lots of different interpretations! So there! © 2010-12 Clearwater Compliance LLC | All Rights Reserved 4 5 Actions to Take Now 1. Formally establish and charter a Privacy and Security Risk Management Council and establish a Security Management Process per 45 CFR §164.308(a)(1). 2. Complete an Evaluation per 45 CFR §164.308(a)(8) to assess Security Rule “black letter” compliance and to understand the complete regulation; the Security Rule is the ultimate checklist. 3. Complete a Risk Analysis per 45 CFR §164.308(a)(1)(ii)(A) to assess risk and determine the CE’s security posture and initiate a corrective action plan. 4. Complete an assessment of compliance with the Privacy Rule using per 45 CFR §164.530 Administrative Requirements as a guide. 5. Document and act upon a corrective action plan for Security Rule compliance, Privacy Rule compliance, and overall Risk Management per 45 CFR §164.308(a)(1)(ii)(B). Demonstrate Good Faith Effort © 2010-12 Clearwater Compliance LLC | All Rights Reserved 5 Session Objectives 1. Review Regulatory Requirements and HHS/OCR Final Guidance 2. Understand Risk Analysis Essentials 3. Learn how to Complete a Risk Analysis © 2010-12 Clearwater Compliance LLC | All Rights Reserved 6 HITECH meets HIPAA … at Meaningful Use Risk Analysis 45 CFR 164.308(a)(1)(ii) (A) HIPAA Security Final Rule Meaningful Use Final Rule © 2010-12 Clearwater Compliance LLC | All Rights Reserved 7 Two Dimensions of HIPAA Security Business Risk Management Compliance 45 CFR 164.308(a)(8) Security 45 CFR 164.308(a)(1)(ii)(A) Overall Business Risk Management Program; Not “an IT project” © 2010-12 Clearwater Compliance LLC | All Rights Reserved 8 Security Evaluation v. Risk Analysis 45 C.F.R. §164.308(a)(8) Standard: Evaluation. Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, which establishes the extent to which an entity's security policies and procedures meet the requirements of this subpart. 45 C.F.R. §164.308(a)(1)(i) Standard: Security Management Process (1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations. (ii) Implementation specifications: (A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity. © 2010-12 Clearwater Compliance LLC | All Rights Reserved 9 EP Meaningful Use - Core Eligible Professionals 15 Core Objectives 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. Computerized provider order entry (CPOE) E-Prescribing (eRx) Report ambulatory clinical quality measures to CMS/States Implement one clinical decision support rule Provide patients with an electronic copy of their health information, upon request Provide clinical summaries for patients for each office visit Drug-drug and drug-allergy interaction checks Record demographics Maintain an up-to-date problem list of current and active diagnoses Maintain active medication list Maintain active medication allergy list Record and chart changes in vital signs Record smoking status for patients 13 years or older Capability to exchange key clinical information among providers of care and patient-authorized entities electronically 15. Protect electronic health information © 2010-12 Clearwater Compliance LLC | All Rights Reserved EH & CAH Meaningful Use EHs and CAHs 14 Core Objectives 1. Use CPOE for medication orders directly entered by any licensed healthcare professional who can enter orders into the medical record per State, local, and professional guidelines. 2. Implement drug-drug and drug-allergy interaction checks. 3. Maintain an up-to-date problem list of current and active diagnoses 4. Maintain active medication list. 5. Maintain active medication allergy list. 6. Record specific set of demographics 7. Record and chart specific changes in the certain vital 8. Record smoking for patients 13 years old or older 9. Report hospital clinical quality measures to CMS or, in the case of Medicaid eligible hospitals, the States. 10. Implement one clinical decision support rule related to a high priority hospital condition along with the ability to track compliance with that rule. 11. Provide patients with an electronic copy of their health information (including diagnostic test results, problem list, medication lists, medication allergies, discharge summary, procedures), upon request. 12. Provide patients with an electronic copy of their discharge instructions at time of discharge, upon request. 13. Capability to exchange key clinical information (for example, problem list, medication list, medication allergies, and diagnostic test results), among providers of care and patient authorized entities electronically. 14.Protect electronic health information © 2010-12 Clearwater Compliance LLC | All Rights Reserved …from HHS/OCR Final Guidance Regardless of the risk analysis methodology employed… 1. Scope of the Analysis - all ePHI that an organization creates, receives, maintains, or transmits must be included in the risk analysis. (45 C.F.R. § 164.306(a)). 2. Data Collection - The data on ePHI gathered using these methods must be documented. (See 45 C.F.R. §§ 164.308(a)(1)(ii)(A) and 164.316 (b)(1).) 3. Identify and Document Potential Threats and Vulnerabilities Organizations must identify and document reasonably anticipated threats to ePHI. (See 45 C.F.R. §§ 164.306(a)(2), 164.308(a)(1)(ii)(A) and 164.316(b)(1)(ii).) 4. Assess Current Security Measures - Organizations should assess and document the security measures an entity uses to safeguard ePHI. (See 45 C.F.R. §§ 164.306(b)(1), 164.308(a)(1)(ii)(A), and 164.316(b)(1).) 5. Determine the Likelihood of Threat Occurrence - The Security Rule requires organizations to take into account the likelihood of potential risks to ePHI. (See 45 C.F.R. § 164.306(b)(2)(iv).) 6. Determine the Potential Impact of Threat Occurrence - The Rule also requires consideration of the “criticality,” or impact, of potential risks to confidentiality, integrity, and availability of ePHI. (See 45 C.F.R. § 164.306(b)(2)(iv).) 7. Determine the Level of Risk - The level of risk could be determined, for example, by analyzing the values assigned to the likelihood of threat occurrence and resulting impact of threat occurrence. (See 45 C.F.R. §§ 164.306(a)(2), 164.308(a)(1)(ii)(A), and 164.316(b)(1).) 8. Finalize Documentation - The Security Rule requires the risk analysis to be documented but does not require a specific format. (See 45 C.F.R. § 164.316(b)(1).) 9. Periodic Review and Updates to the Risk Assessment - The risk analysis process should be ongoing. In order for an entity to update and document its security measures “as needed,” which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed. (45 C.F.R. §§ 164.306(e) and 164.316(b)(2)(iii).) © 2010-12 Clearwater Compliance LLC | All Rights Reserved 12 Risk Management Guidance Guidance on Risk Analysis Requirements under the HIPAA Security Rule Final • • • • • • NIST SP800-30 Revision 1 Guide for Conducting Risk Assessments – DRAFT NIST SP800-34 Contingency Planning Guide for Federal Information Systems NIST SP800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach NIST SP800-39-final_Managing Information Security Risk NIST SP800-53 Revision 3 Final, Recommended controls for Federal Information Systems and Organizations NIST SP800-53A, Rev 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans © 2010-12 Clearwater Compliance LLC | All Rights Reserved 13 Session Objectives 1. Review Regulatory Requirements and HHS/OCR Final Guidance 2. Understand Risk Analysis Essentials 3. Learn how to Complete a Risk Analysis © 2010-12 Clearwater Compliance LLC | All Rights Reserved 14 Risk Analysis is Not Easy © 2010-12 Clearwater Compliance LLC | All Rights Reserved 15 What A Risk Analysis Is Not • • • • • • A network vulnerability scan A Risk Analysis IS the process of A penetration test prioritizing, and estimating identifying, risks to organizational operations A configuration audit (including mission, functions, image, reputation), organizational assets, A network diagram review individuals, other organizations, …, resulting from the operation of an A questionnaire information system. Part of risk incorporates threat and Informationmanagement, system activity review vulnerability analyses, and considers mitigations provided by security controls planned or in place. © 2010-12 Clearwater Compliance LLC | All Rights Reserved 16 NOT Risk Management © 2010-12 Clearwater Compliance LLC | All Rights Reserved 17 Risk Analysis and Risk Management 1. What is our exposure of our information assets (e.g., ePHI)? 2. What do we need to do to treat or manage risks? Both Are Required in MU and HIPAA © 2010-12 Clearwater Compliance LLC | All Rights Reserved 18 Security Risk Management Process Risk Management Approach Asset Inventory © 2010-12 Clearwater Compliance LLC | All Rights Reserved Risk Analysis Risk Treatment Docu mentation 19 What is Risk? Risk = Impact * Likelihood Overall Risk Value Impact HIGH Medium High Critical MEDIUM Low Medium High LOW Low Low Medium LOW MEDIUM HIGH Likelihood Goal = Understand What Risks Exist and Into What Category They Fall © 2010-12 Clearwater Compliance LLC | All Rights Reserved 20 Risk Analysis “Algebra” © 2010-12 Clearwater Compliance LLC | All Rights Reserved 21 Threat Sources 1. Adversarial • Individual-Outsider, -Insider, Group-Ad hoc,-Established… 2. Accidental • Ordinary User, Privileged User 3. Structural • IT Equipment, Environmental Controls, Software 4. Environmental • Natural or man-made disaster (fire, flood, hurricane), Unusual natural event, Infrastructure failure/outage (telecomm, power) … An adapted definition of threat Source, from NIST SP *00-30, is “The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally exploit a vulnerability...” © 2010-12 Clearwater Compliance LLC | All Rights Reserved 22 Vulnerabilities 1. 2. 3. 4. 5. 6. 7. Lack of strong password Lack of personal firewall Lack of data backup Lack of policies Failure to follow policies Lack of training Lack of encryption on laptops with ePHI… 8. …and on and on … NIST Special Publication (SP) 800-30 as “Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.” © 2010-12 Clearwater Compliance LLC | All Rights Reserved 23 Controls Help Address Vulnerabilities Threat Source Vulnerabilities Controls • Burglar who may steal Laptop with ePHI • • • • • • • • • • • Information Asset • Laptop with ePHI © 2010-12 Clearwater Compliance LLC | All Rights Reserved Device is portable Weak password ePHI is not encrypted ePHI is not backed up Policies & Procedures Training & Awareness Cable lock down Strong passwords Encryption Remote wipe Data Backup 24 Risk = f([Assets+Threats+Vulnerabilities+Controls] * [Likelihood * Impact]) Likelihood Impact Risks • • • • • • • • • • • • • • • • • • Not Applicable RareBased on Unlikely threat, vulnerabilities Moderate and current Likely controls in Almost Certain place © 2010-12 Clearwater Compliance LLC | All Rights Reserved Not Applicable Insignificant Based on size, Minor sensitivity Moderate and effort or Majorcost of remediation Disastrous Financial Political Legal Regulatory Operational impact Reputational 25 Establishing a Risk Value Risk = Likelihood * Impact Likelihood Rank 0 1 2 3 4 5 Description Not Applicable Rare Unlikely Moderate Likely Almost Certain Example Will never happen May happen once every 10 years May happen once every 3 years May happen once every 1 year May happen once every month May happen once every week Impact Rank 0 1 2 3 4 5 Description Not Applicable Insignificant Minor Moderate Major Disastrous Example Does not apply Not reportable; Remediate within 1 hour Not reportable; Remediate within 1 business day Not reportable; Remediate within 5 business days Reportable; Less than 1,000 records compromised Reportable; Greater than 1,000 records compromised • • • • © 2010-12 Clearwater Compliance LLC | All Rights Reserved Critical = 25 High = 15-24 Medium = 8-14 Low = 0-7 26 Simplified Risk Analysis Example Asset Laptop Likelihood (1-5) Impact (1-5) Risk ( L * I) Device is portable 4 3 12 Weak password 2 4 8 ePHI is not encrypted 3 5 15 ePHI is not backed up 1 2 2 Threat Theft Vulnerability © 2010-12 Clearwater Compliance LLC | All Rights Reserved 27 The Process Risk Approach Asset Inventory © 2010-12 Clearwater Compliance LLC | All Rights Reserved Risk Analysis Docu- Risk Treatment mentation 28 Criteria For Accepting Risks Score Range: 0-25 Risk Values Critical = 25 High = 15-24 Medium = 8-14 Low = 0-7 Example: • Acceptable level of risk: 14 • Value of risk A: 9 – no treatment is needed • Value of risk B: 17 – risk treatment is needed 29 © 2010-12 Clearwater Compliance LLC | All Rights Reserved Risk Treatment • Risk Management = making informed decisions about treating risks 1. 2. 3. 4. 5. Avoid Accept Mitigate Transfer Share • Not all Risks need “mitigation” • All Risks need “treatment” 30 © 2010-12 Clearwater Compliance LLC | All Rights Reserved Risk Management Risks of all types & sizes exist Risk Identification Risk Treatment Avoid / Transfer Risks Mitigate / Transfer Risks Accept Risks © 2010-12 Clearwater Compliance LLC | All Rights Reserved 31 Risk Mitigation Example Before Asset Threat Laptop Theft Vulnerability Likelihood (1-5) Impact (1-5) Risk ( L * I) Device is portable 4 3 12 ePHI is not encrypted 3 5 15 After Asset Threat Vulnerability Likelihood (15) Impact (15) Residual Risk ( L * I) Cable lock down 1 3 3 ePHI is not Full Disk encrypted Encryption 1 5 5 Laptop Theft Device is portable © 2010-12 Clearwater Compliance LLC | All Rights Reserved New Control 32 Session Objectives 1. Review Regulatory Requirements and HHS/OCR Final Guidance 2. Understand Risk Analysis Essentials 3. Learn how to Complete a Risk Analysis © 2010-12 Clearwater Compliance LLC | All Rights Reserved 33 The Process Risk Approach Asset Inventory © 2010-12 Clearwater Compliance LLC | All Rights Reserved Risk Analysis Docu- Risk Treatment mentation 34 The Risk Analysis Dilemma Assets and Media Backup Media Desktop Disk Array Electronic Medical Device Laptop Pager Server Smartphone Storage Area Network Tablet Third-party service provider Etcetera… Threat Sources ADVERSARIAL -Individual -Groups ACCIDENTAL -Ordinary user -Privileged User STRUCTURAL -IT Equipment -Environmental -Software ENVIRONMENTAL -Natural or man-made -Unusual Natural Event -Infrastructure failure Threat Actions Burglary/Theft Corruption or destruction of important data Data Leakage Data Loss Denial of Service Destruction of important data Electrical damage to equipment Fire damage to equipment Information leakage Etcetera… Over 10 million Permutations Potential Risk-Controls © 2010-12 Clearwater Compliance LLC | All Rights Reserved NIST SP 800-53 Controls Vulnerabilities Anti-malware Vulnerabilities Destruction/Disposal Vulnerabilities Dormant Accounts Endpoint Leakage Vulnerabilities Excessive User Permissions Insecure Network Configuration Insecure Software Development Processes Insufficient Application Capacity Insufficient data backup Insufficient data validation Insufficient equipment redundancy Insufficient equipment shielding Insufficient fire protection Insufficient HVAC capability Insufficient power capacity Insufficient power shielding Etcetera… PS-6 a The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access. PS-6 b The organization reviews/updates the access agreements [Assignment: organization-defined frequency]. AC-19 a The organization establishes usage restrictions and implementation guidance for organization-controlled mobile devices. AC-19 b The organization authorizes connection of mobile devices meeting organizational usage restrictions and implementation guidance to organizational information systems. AC-19 c The organization monitors for unauthorized connections of mobile devices to organizational information systems. AC-19 d The organization enforces requirements for the connection of mobile devices to organizational information systems. AC-19 e The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction; Issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. Etcetera…570 35 Software Design Basis • HHS / OCR Final Guidance on Risk Analysis • NIST SP800-30 Revision 1 Guide for Conducting Risk Assessments – DRAFT • NIST SP800-34 Contingency Planning Guide for Federal Information Systems • NIST SP800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach • NIST SP800-39-final_Managing Information Security Risk • NIST SP800-53 Revision 3 Final, Recommended controls for Federal Information Systems and Organizations • NIST SP800-53A, Rev 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans 36 © 2010-12 Clearwater Compliance LLC | All Rights Reserved Clearwater HIPAA Security Risk Analysis™ Educate | Assess | Respond Monitor| Document https://HIPAASecurityRiskAnalysis.com/ 37 © 2010-12 Clearwater Compliance LLC | All Rights Reserved How Risk Analysis Software Helps You Risk Approach • Approach rigorously based on OCR & NIST Guidance • Semi-quantitative • Comprehensive • Flexible for Setting Risk Appetite Asset Inventory Risk Analysis • Captures essential documentation • Includes 9 essential elements • Identifies underlying media • Serves as ‘wizard’ to guide detailed process • Creates database for deletes / adds / changes • Comprehensive documentation © 2010-12 Clearwater Compliance LLC | All Rights Reserved • Assures consistency, repeatability • Ratings facilitate dynamic risk ranking Docu- Risk Treatment mentation • Reporting facilitates informed decision making • Produces and houses all essential documentation • “Notes” facilitate critical documentation re: Risk treatment decisions • Provides “living, breathing risk management repository” • Enables easier, future incremental 38 analyses Asset Inventory List © 2010-12 Clearwater Compliance LLC | All Rights Reserved 39 Risk Questionnaire Form © 2010-12 Clearwater Compliance LLC | All Rights Reserved 40 Risk Rating Report © 2010-12 Clearwater Compliance LLC | All Rights Reserved 41 Sample Export – Asset Inventory © 2010-12 Clearwater Compliance LLC | All Rights Reserved 42 Risk Analysis WorkShop™ Process High Value – High Impact I. PREPARATION A. Plan / Gather B. Read Ahead C. Complete QuickScreen™ II. ONSITE SESSION A. Facilitate B. Educate C. Evaluate III. CONSULTATION A. E-mail B. Telephone C. Web Meetings © 2010-12 Clearwater Compliance LLC | All Rights Reserved 43 Summary and Next Steps Risk Analysis is a Critical, Foundational Step Consider Assessing the Forest as Well Completing a Risk Analysis is key to HIPAA compliance But, is not your only requirement… Stay Business Risk Management-Focused Don’t Call The Geek Squad Large or Small: Get Help (Tools, Experts, etc) Consider tools and templates 44 © 2010-12 Clearwater Compliance LLC | All Rights Reserved June 25, 2012 | Chicago, IL Clearwater HIPAA Audit Prep BootCamp™ Take Your HIPAA Compliance Program to a Better Place, Faster © 2010-12 Clearwater Compliance LLC | All Rights Reserved Expert Instructors Jim Mathis, JD, CHC, CHP Healthcare Industry Attorney HIPAA Consultant © 2010-12 Clearwater Compliance LLC | All Rights Reserved James C. Pyles Principal Powers Pyles Sutter & Verville PC Bob Chaput, CISSP, CHP, CHSS, MCSE CEO Clearwater Compliance 46 Get Smart! “On Demand” HIPAA HITECH RESOURCES, IF NEEDED: 1. http://AboutHIPAA.com/about-hipaa/resources/ 2. http://AboutHIPAA.com/webinars/ © 2010-12 Clearwater Compliance LLC | All Rights Reserved 47 Contact Bob Chaput, CISSP http://www.ClearwaterCompliance.com bob.chaput@ClearwaterCompliance.com Phone: 800-704-3394 or 615-656-4299 Clearwater Compliance LLC 48 © 2010-12 Clearwater Compliance LLC | All Rights Reserved Additional Information © 2010-12 Clearwater Compliance LLC | All Rights Reserved 49 Why Now? – What We’re Hearing “Our business partners (health plans) are demanding we become compliant…” – large national care management company (BA) “We did work on Privacy, but have no idea where to begin with Security” – 6-Physician Pediatric Practice (CE) “We want to proactively market our services by leveraging our HIPAA compliance status …” -large regional fulfillment house (BA) “With all the recent changes and meaningful use requirements, we need to make sure we meet all The HITECH Act requirements …” – large family medicine group practice (CE) “We need to have a way to quickly take stock of where we are and then put in place a dashboard to measure and assure our compliance progress…” – national research consortium (BA) “We need to complete HIPAA-HITECH due diligence on a potential acquisition and need a gap analysis done quickly and efficiently…” – seniors care management company (BA) © 2010-12 Clearwater Compliance LLC | All Rights Reserved 50 What Our Customers Say… “The WorkShop™ process made a very complicated process and subject matter simple. The ToolKit™ itself was excellent and precipitated exactly the right discussion we needed to have.” – outside Legal Counsel, national research consortium "The HIPAA Security Assessment ToolKit™ and WorkShop™ are a comprehensive approach that effectively guided our organization’s performance against HIPAA-HITECH Security requirements.” -- SVP and Chief Compliance, national hospice organization “… The WorkShop™ process expedited assessment of gaps in our HIPAA Security Compliance program, began to address risk mitigation tasks within a matter of days and… the ‘ToolKit’ was a sound investment for the company, and I can't think of a better framework upon which to launch compliance efforts.” – VP & CIO, national care management organization “…the process of going through the self-assessment WorkShop™ was a great shared learning experience and teambuilding exercise. In retrospect, I can't think of a better or more efficient way to get started than to use the HIPAA Security Assessment ToolKit.“ – CIO, national kidney dialysis center firm “…this HIPAA Security Assessment Toolkit is worth its weight in gold. If we had to spend our time and resources creating this spreadsheet, we would never complete our compliance program on time…” — Director, Quality Assurance & Regulatory Affairs © 2010-12 Clearwater Compliance LLC | All Rights Reserved 51