Industry Watch

Security

Top data security tips for healthcare orgs

Despite the fact that 94 percent of the 80 healthcare organizations surveyed in the study suffered data breaches, these events don’t have to be disastrous. Pre- and post-breach processes can be initiated and coordinated to better protect patient data and minimize impact.

ID Experts, a provider of comprehensive data breach solutions, offers the following 10 tips from their experts to creating healthier security habits for your organization.

1. Establish mobile and bring-your-own-device (BYOD) policies that include technical controls and employee and management procedures. Rick Kam, CIPP/US, president and co-founder, ID Experts
2. Control the cloud, or it’ll control you. Make it a point to fully understand what cloud service-level agreements mean in practice, and then push for meaningful information on failover and disaster recovery practices used. Richard Santalesa, senior counsel, InfoLawGroup LLP
3. Have a current breach response plan that is ready and tested. This will help pave the way for a well-executed response that can mitigate the financial, legal and reputational harm caused by a security incident involving patient information. Marcy Wilder, partner and director of Global Privacy and Information Management Practice, Hogan Lovellis
4. Conduct small but focused risk assessments rotating control review on a monthly basis to continually understand and measure risk. Most importantly, have a plan to address the risk, through remediation, mitigation or risk transfer activities. Chad Boeckmann, president and chief strategy officer, Secure Digital Solutions, LLC
5. Immunize mobile devices against viruses that might steal patient data. Dr. Larry Ponemon, chairman and founder, Ponemon Institute
6. Attack your leadership team with phishing and other social engineering campaigns. Nothing raises awareness like catching people and correcting them on the spot – and it’s a lot more interesting than the annual 30-minute online security training. Michael Boyd, director of Information Security Management, Providence Health & Services
7. Use a checklist periodically to evaluate whether covered entities and business associates are in compliance with all privacy and security requirements. Sign and date the checklist to show that your organization is not guilty of “willful neglect” in complying with privacy and security laws. Jim Pyles, founding partner, Powers, Pyles, Sutter & Verville, P.C.
8. Educate all staff to recognize applications, mobile devices and medical equipment that collect, contain or transmit patient information and/or biometric data. Train them to communicate the risk to those responsible for information security management. Christina Thielst, FACHE, vice president, Tower
9. Decide how to handle the residual risk of a data breach, how much risk to accept and how much, if any, risk to transfer through cyber insurance. Christine Marciano, president, Cyber Data Risk Managers, LLC
10. Boards should ensure their organizations have robust, board-reviewed and approved security policies and procedures. Larry W. Walker, president, The Walker Company

Claims and Coding

CMS says no more ICD-10 delays

Physicians must use ICD-10 codes on claims to payers for services starting Oct. 1, 2014. That point was made clear in a letter from Centers for Medicare & Medicaid Services (CMS) Acting Administrator Marilyn Tavenner to the American Medical Association’s (AMA) president, Jeremy Lazarus, M.D., dated Feb. 6, 2013. Submitted claims that do not use the new coding system will be rejected. Period.

“We believe that the one-year extension through September 30, 2014, offers physicians adequate time to train their coders, complete system changeovers, and conduct testing,” wrote Tavenner.

More than 80 physician groups represented by the AMA requested that CMS stop the changeover to the more-complex ICD-10 system in December 2012, after the initiative had already been granted a one-year deadline extension in September 2012, from Oct. 1, 2013, to Oct. 1, 2014.

“Many in the health industry are underway with the necessary system changes to transition from ICD-9 to ICD-10,” wrote Tavenner. “Halting this progress midstream would be costly, burdensome, and would eliminate the impending benefits of these investments. Many private and public sector health plans, hospitals and hospital systems, and large physician practices are far along in their ICD-10 implementation and have devoted significant funds, resources and staff to the effort.”

INFOGRAPHIC

How do doctors feel about mobile healthcare apps?

Clinical information systems provider eClinicalWorks conducted an online survey with responses from 2,291 healthcare professionals in the United States. All interviews were conducted Jan. 18-24, 2013. The sample included responses from 649 physicians.