Senior living and care providers spend their days safeguarding residents and patients. Yet one threat too often slips past the front desk unnoticed: cybercriminals. Across the sector, cybersecurity is frequently underestimated, underfunded, or treated as an afterthought—an IT issue rather than an enterprise risk. That blind spot is exactly what hackers are counting on.
Jenny Holmes
The stakes could hardly be higher. Organizations serving seniors, whether skilled nursing, assisted living, or rehabilitation facilities, home health and home care providers, hospices, or continuing care, independent living or other senior housing organizations, as well as the vendors who support them, maintain data regulated under federal or state data privacy or security laws. Medical records, financial and banking information, Social Security numbers, and insurance details are among the most sensitive data available, and health-related data in particular commands premium prices on the dark web.
Senior living and care providers must be vigilant in their cybersecurity practices to eliminate or lessen risks to the data they hold and transmit. The good news is that a thoughtful, well-structured program can dramatically reduce that exposure. Here is where to begin.
Valerie Breslin Montague
You cannot protect what you cannot see. When creating or reviewing a cybersecurity program, organizations should start with a data-mapping analysis, beginning with the types of data that the organization holds and transmits. As part of this analysis, providers of senior care and living services should determine the regulatory schemes applicable to their organization. For example, HIPAA applies to healthcare providers billing payors or engaging in other “standard transactions” using prescribed forms, which will include most skilled nursing facilities, home health agencies, hospices, and certain assisted living facilities. Vendors supporting these organizations will also be regulated by HIPAA if their services involve using or disclosing protected health information (PHI). Whether or not an organization holds PHI, it will maintain employee data, often vendor or governing board data with identifiers regulated under state law, and many have self-insured health plans that themselves fall under HIPAA regulation. The organization should understand on which servers or other locations it stores regulated data; which apps, systems, or other methods are used to transmit data; and the persons or entities who receive individually identifiable data from the organization.
Once an organization understands its data, it needs the right people guarding it. Senior care and living providers should assess their cybersecurity team and ensure that their combined internal and external resources are sufficient for the size and complexity of the organization. If the entity is HIPAA-regulated, or regulated under a state law with a similar requirement, it must appoint a security officer. The organization also should ensure that it has internal or external information technology and information security support, as well as compliance and legal personnel knowledgeable about applicable regulatory requirements.
Even the most capable team needs a clear playbook. In addition to personnel, organizations serving seniors should ensure that they have comprehensive, up-to-date cybersecurity policies and procedures. The policies should address topics including the provision of system access to personnel and vendors, how the organization monitors its systems, and the security controls and methods in place to prevent unauthorized access. HIPAA-regulated organizations should ensure that their policies address all of the required HIPAA Security Rule topics, and organizations also should consider any policy requirements stemming from state law licensing rules or other applicable regulatory schemes.
Policies on paper, however, are only as strong as the safeguards that enforce them. An organization’s review of its cybersecurity policies should occur hand-in-hand with a review of its security controls. These controls should be informed by the organization’s security risk analysis, discussed below, and should include physical, technical, and administrative protections. They should include everything from strong password requirements to providing only needs-based access to implementing multi-factor authentication and encryption. Equipment and devices should be secured through facility and screen locks, and devices no longer in use should be subject to proper disposal processes.
How does an organization know which controls matter most? One of the best ways to strengthen a cybersecurity program is to conduct a comprehensive, enterprise-wide security risk analysis. This is a requirement for entities regulated under HIPAA and other cybersecurity compliance structures, such as an International Standards Organization (ISO) certification, and it is an important best practice for all organizations. A risk analysis can be conducted by internal personnel or externally by a vendor to analyze risks and vulnerabilities to confidential data across the organization. This analysis should be conducted at least annually and should be a “living” document, updated to reflect any new services, processes, or technology. Senior care and senior housing organizations should then translate the results into a risk management plan, focusing on eliminating or mitigating areas of high risk. This process can be structured in a manner that is manageable for the organization and that allows personnel and vendors to tackle issues simultaneously under a common plan.
As organizations work through identified risks, two priorities deserve a permanent place on the list: training the organization’s personnel and scrutinizing the security posture of its vendors. People remain the first line of defense, and often the weakest link. HIPAA, certain state laws, and other certification requirements mandate that organizations implement data security training. While this can be accomplished with a standard online module, providing personnel with focused, role-based data security training may result in greater security awareness. Entities also should provide training reminders, including in response to identified threats or actual incidents. Vendors, meanwhile, can open a back door into an otherwise secure organization, making vendor diligence and security controls critical to preventing cybersecurity incidents. Vendor contracts can include requirements that the vendor maintain certain security standards to protect confidential data, specify incident reporting requirements, and require indemnification for incident-related liability or other noncompliance.
Preparation for the worst day matters as much as prevention. Another key component of a strong cybersecurity program is ensuring that the organization maintains and tests an incident response plan. Like a security risk analysis, the incident response plan must be a “living” document that is updated to account for organizational changes. It should identify the organization’s incident response team, including personnel and external vendors, and allocate responsibilities to team members. The plan should describe how the organization will respond both to specific types of incidents and to the risks the organization has identified. It should include template documents to facilitate a rapid response, such as data breach notifications for regulators, individuals, consumer reporting agencies, and the media. The plan also can include internal and external communication templates for stakeholder notifications. Senior care and living organizations should ensure that their incident response team conducts periodic tabletop exercises to simulate an incident and test the organization’s response. Lessons learned and identified gaps should be addressed in an update to the plan.
Finally, because even the best-prepared senior care and living organizations, and the vendors that serve them, may not be able to thwart every cybersecurity incident, cyber liability insurance offers one more layer of protection. Insurance coverage, together with the other protections described above, can help safeguard those providing important services to a vulnerable population. Hackers are looking for an open door; with a deliberate, well-maintained cybersecurity program, senior living and care providers can make sure they never get the chance to move in.
Nixon Peabody partner Jenny L. Holmes serves as deputy leader of the firm’s Privacy & Technology practice and the firm’s broader Cybersecurity & Privacy team. As a Certified Information Privacy Professional/United States (CIPP/US), Jenny advises clients on the ever-changing legal landscape of data privacy and cybersecurity law. She also co-hosts Nixon Peabody’s popular video series, A Little Privacy, Please!®.
Nixon Peabody partner Valerie Breslin Montague represents a variety of healthcare providers, digital health companies, senior living facilities, nonprofit trade associations, life sciences companies, and vendors of healthcare providers. A Certified Information Privacy Professional/United States (CIPP/US), Valerie focuses her practice on HIPAA and health information privacy and security, regulatory compliance, and nonprofit governance.
r
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version=’2.0′;
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,’script’,
‘https://connect.facebook.net/en_US/fbevents.js’);
fbq(‘init’, ‘2553523204690571’);
fbq(‘track’, ‘PageView’);
——————————————————-
Click Here For The Original Source.
