Far too many privacy officers lean on their electronic medical record (EMR) or electronic health record (EHR) system as a HIPAA compliance crutch. They believe (mistakenly) that an EMR/EHR system keeps their organization HIPAA compliant. Maybe that’s you. However,...
In January 2017, a HIPAA-covered Texas clinic learned that someone had stolen an unencrypted external hard drive. The thief took it from a locked closet inside the clinic. The clinic used that hard drive to back up patients’ protected health information (PHI)....
If you don’t record and review system activity, hackers or unethical employees can harm your organization without a trace. Therefore, The Office for Civil Rights (OCR) prompts HIPAA-covered organizations to collect, secure, track, and review their system audit...
A security risk analysis is a vital part of the risk management process. According to the HIPAA Security Rule, all HIPAA-covered organizations must conduct them. This analysis helps your organization prevent, detect, contain, and correct security violations. However,...
The Joint Commission (TJC) has concluded that it is not acceptable to use secure text messaging for patient care orders. Industry experts weighed in on the pros and cons of implementing secure text orders, and the impact on patient safety remained unclear. Therefore,...
We’re all familiar with what a technical hacker is. They sit behind a computer somewhere planning their strike on an unsuspecting healthcare company. Healthcare is a prime target for technical hackers. However, a more subtle threat exists: social engineering....