! BREAKING ! OCR releases NEW HIPAA Audit requirements that will impact your business + The Singapore F1 Grand Prix

Rob: 0:00

You're still Dawn.

Dawn: 0:01

I am. You're still Rob I am.

Rob: 0:03

Ooh, I got another button Ready Ha ha ha. I have new toys. It's fun Cheeseball . Oh my gosh, Dawn, I'm excited, you're excited, we're excited. Right, we are excited. We finally have some updates. Updates to the audit requirements for the HIPAA.

Dawn: 0:29

The HIPAA.

Rob: 0:29

The HIPAA. We also just had a heck of a F1 race in Singapore.

Dawn: 0:34

Yes, that was exciting and fun.

Rob: 0:35

We're going to start there and then we're going to talk. This podcast is really going to focus on the new audit requirements for the HIPAA, and our team is already working on updating our platforms because our customers get that. That's what they get. They get the latest and the greatest in HIPAA audit technology and service. So, yeah, so actually, don, who is your favorite F1 team? And I'll preface this by yeah, we're big F1 fans. They don't watch any other sports but little college football, but obviously F1 races. So who's your team?

Dawn: 1:11

Well, I'm partial to Ferrari.

Rob: 1:13

I don't like Ferrari, the Ferrari.

Dawn: 1:15

Like the Ferrari, but the Ferrari. But I like. Well, I like a few.

Rob: 1:21

Let me just preface I like somebody just give you a Ferrari. I like some of the drivers.

Dawn: 1:25

So I like Leclerc, he's Ferrari, I do like Lando with McLaren and I like Russell with Mercedes. So I'm kind of all over the place. But honestly, ferrari was amazing in Singapore. It's amazing that thank goodness they light up that track because again they're driving 200 or some miles an hour with no headlights, you know, but they make it work. That's like the light name of Queen.

Rob: 1:47

Remember that, remember he got Well, yeah, well, they got NASCAR stickers, but there's no headlights, Right?

Dawn: 1:51

right same thing, but no, it was a very exciting race Actually last week in Italy.

Rob: 1:58

The Temple of Speed, the Temple of Doom? No Temple of Doom.

Dawn: 2:01

That was pretty amazing too, because they have, the way the tracks are, a lot of really good passing, and so it's not like Monaco, where you can't pass, but yeah, maybe one place Exactly.

Rob: 2:14

But yeah, it was amazing, you finally won one. You've won your Ferrari, your Dutchman.

Dawn: 2:20

I keep saying it he is a winner. He's great, we saw him in person on his track 10 in a row. He is an amazing young lad. But, sometimes you fall when you're the winning person.

Rob: 2:36

Oh, it just was not set up. The car was not set, the car wasn't set, the driver's were set, it was just not set. But hey, they broke the record. Of Max won 10 in a row and remember he's not grumpy. He's Dutch like me, so you just remember that, Don.

Dawn: 2:51

Okay, and you know what's funny is, if you guys don't know, rob is half Dutch, half Italian. And so yes, but it's now. It's. Oh, I'm Dutch. I'm Dutch, I'm Dutch when your Dutchman was winning, but now it's like oh, oh what.

Rob: 3:07

no, I didn't flip over to the Ferrari. It's good to see the Ferrari, you gotta say it. Like the Ferrari. Good to see they won.

Dawn: 3:13

Finally, Carlos has been right there.

Rob: 3:15

So was it more strategy, Ferrari strategy or more Carlos' strategy? Because he's chums, I think, he with landup.

Dawn: 3:23

Oh yeah, no, I think he did great himself.

Rob: 3:27

So yeah, it was amazing To keep land on. So now, but next week's in Japan next week's a new race, you never know. Next week's. Well, this week Yuki could win. Yuki could win.

Dawn: 3:36

Maybe that would be nice if he finally won something.

Rob: 3:38

I think Lawson's gonna continue to go. I don't know where Carlos is gonna be back, because he busted up his hand.

Dawn: 3:44

Yeah.

Rob: 3:45

And Zanvort. So and you know listeners if you love F1, just let us know. Put it in the comments have a little chit chat, a little chit chat, chit chat, that was fun.

Dawn: 3:55

That was like a race. You wore your jersey proud there, don. You did good, I did you did good, I did, you did. So let's talk about the big news in the HIPAA.

Rob: 4:05

Oh, let's see where's my other button. Yeah, horn Jazz is good. Actually we need the little news ticker.

Dawn: 4:12

This is big news. Actually, this is very important news.

Rob: 4:16

Why don't you go ahead and break the news?

Dawn: 4:17

Don. So the HHS OCR they just came out with in the last few days. They came out with some updated audit requirements.

Rob: 4:31

They did.

Dawn: 4:32

So our customers know, and some that have been through the audit, you know, one year, two year, three year, four year, the questions are remain about the same.

Rob: 4:44

They have been. They remain about the same, very stagnant.

Dawn: 4:48

What the HHS OCR did is they have updated them to be more I can't find the word the more current, more current with cybersecurity relatedness in them? I guess I don't know. However, you want to say that.

Rob: 5:05

Yep.

Dawn: 5:06

So basically, what they've done is they've taken because of cybersecurity is such a buzzword, if you will they've really updated and said you know what?

Dawn: 5:18

we're not just going to ask you do you have a policy procedure? We're going to ask you specifically about your security and, honestly, the whole assessment is more about, instead of really the administrative, technical, physical kind of. It is more just about security in general. I mean it encompasses physical security and technical, yes, but it is very focused on the word security. So we are excited because this is where we need to be now the HIPAA has not changed in over 30 years.

Rob: 5:50

The law is the law. Well, it changed in 13. The high tech law yes, the high tech. It changed in 20, but the foundation has been the same.

Dawn: 5:57

I appreciate that the questions are tailored more towards the electronic age we're in and to more cybersecurity. So we are updating that currently and it is going to. The questions are going to evolve, they're just going to be more robust. So that is very exciting, very exciting.

Rob: 6:18

It is. And when the government makes changes, they don't change the law. They're making subtle changes to how you're audited. So if you get your audits through us which I hope you do or you do your own audit what you can do right, but you're going to get lost in that audit. I'd say, right now it is tough Everybody that's tried it. They come right back to us and go, nope, we're going to do it. Or they come to us and have help. They're really focused on cybersecurity and your practice or your business has got to be audited against the new standard and the reason for this is the 405D program.

Dawn: 6:52

So what this is is the HHS developed this, this is basically a task group and they developed the health industry cybersecurity practice Yep, hicp I know another acronym, right Another acronym, but this is amazing because they are really focused, focused on managing threats and protecting patients, protecting data. So they have outlined the top threats, the top five threats, and they've outlined 10 mitigating practices. You could do so we're going to go through that, but this is big, so we want to make sure we cover this. So then you get the information Yep.

Rob: 7:38

Let's go ahead and dive in Dawn

Dawn: 7:40

Dive in.

Rob: 7:41

Because it's a focus on cybersecurity.

Dawn: 7:42

Okay.

Rob: 7:43

So we're going to do a new HIPCA, hipca, hippa.

Dawn: 7:47

HIPAA, I don't know.

Rob: 7:50

Let's just go ahead and dive in. Let's just do it, let's do it.

Dawn: 7:54

So let's talk about you know, we just we in our last podcast, we talked about HIPAA violations. We talked about you know, rob talked about MGM, the breach, ransomware attack excuse me, not a breach Well, it did breach data, but anyway, social engineering. So that is one of the top five threats. Social engineering if you don't know what that is, I'll tell you. It's an attempt to trick you into giving out personal information or infecting your device by clicking on a link and basically that link, by you clicking on that, that gives access to the hackers. So that's social engineering. That's that is happening a lot.

Rob: 8:31

Okay.

Dawn: 8:32

Yeah, ransomware.

Rob: 8:34

Yeah, we know what this one is.

Dawn: 8:35

Yeah, I'm a hacker, I'm in a. You know I'm going to hold your data, whatever that is could be billing data, could be health information, whatever that is, social security numbers, anything like that. I'm gonna hold it for ransom. I'm gonna ask you for a million dollars. I'm gonna ask you for Bitcoin, all that kind of stuff.

Dawn: 8:55

The third one is loss or theft of equipment or data. This is a big one. This happened a lot during COVID Discreneled employees, people that were like things were closing down, companies were shutting down. People were like stealing things because they were just upset that type of thing Stealing, stealing computers. And then, if they're not encrypted, you got to spore. If they still have access, that's the other thing still access the computer, they can get whatever they want off it. So, loss or theft of equipment or data. Also, people can't believe it. They leave their bags in their car and their front seat. I'm talking to mostly women on this one because it's just crazy In our neighborhood. I can't believe how many people post. My car got broken into. Oh really, what did you have in your front seat? Take stuff out of your car.

Rob: 9:45

And not only that, but travel, yes, travel. We've done a lot of travel the last few years. People have the big bags and the airports, the planes. Things need to be zipped, locked and lean is main, if you will, Absolutely.

Dawn: 10:00

So the? And the fourth one, insider, accidental or malicious data loss. Is there any disgruntled people that work at businesses and companies?

Rob: 10:10

Maybe that would quite quit. Or working remotely, or people looking for companies that do remote work only work. Or yeah, no, that never happens.

Dawn: 10:20

We had one Company bought company B. They merged into company A, whatever, and those people that got merged into it decided to start trying to steal customers to start their own company.

Rob: 10:36

See, so that's malicious.

Dawn: 10:39

So yes, that happens.

Rob: 10:41

People get malicious, people get desperate People are mean.

Dawn: 10:45

People are. There's some meanness out there. And then the last, the final one. This is a big one attacks against network connected medical devices.

Rob: 10:53

This is, this is so this is a big one.

Dawn: 10:55

So here's. Here's a scenario, if you're kind of confusing what this means. Cyber attacker gains act access to a care provider's computer network through an email phishing attack. Takes command of the file server Mm-hmm to which a heart monitor is attached. While scanning the network for advices, the attacker takes control of all heart monitors in the ICU. Yeah, multiple patients at risk now that is awful, that is like I mean that could, that's like murderous, I mean that's, that's just a whole, nother level of attack.

Rob: 11:29

Cyber war is it's. Probably the next larger war. It's actually being ongoing, yeah, yeah it's, it's pretty bad so.

Dawn: 11:37

So there you have it. Those, those are pretty big.

Rob: 11:39

I mean that's those are big ones. That's that's big ones. You've got it. This is. This is very exciting, because of course, that's the compliance world exciting.

Dawn: 11:47

We're excited, we have new requirements. Oh, yes, yes, yes, I don't want people dying.

Rob: 11:51

No, okay, okay, act, okay Good, because they're running windows.

Dawn: 11:55

Yeah, so now, now that I've talked to Said the five threats, rob, I want you to go through the tit, the, the ten Mitigating practices. So you're you're very good at this stuff, because this is like email encryption, this is all that kind of all that kind of stuff, and and so why don't you give us, you know, and I don't know if you want to run through all ten, but why don't you give us the ones that you know that you want to go through, that you feel that you want to?

Rob: 12:21

Yeah, because the Hicpe.

Dawn: 12:25

HICP oh.

Rob: 12:29

What what I'm excited about this is is the healthcare industry's security Guidelines are now in the audit. So when you perform your audit, if you have us do it, if which I highly recommend you know do it yourself. Either way, that'd be fine. But email protection systems is huge. Yes, they still love their, their posters, they still love your, the security, making sure that your in email environment is secure. You know there's many ways to do it. We've audited everything from Sophos to Baracuda's to 365 to Google, to everything, and everything has problems. But the best thing is you have to mitigate that and you have to secure email.

Rob: 13:08

Endpoint protection is huge. I know here. You know our, our company as a compliance company. We run all max and I. Everything is encrypted, everything is fire vault on it. If you're on Windows, make sure everything is bit locked. If you're on Linux, you can encrypt that as well and track them. So we know where every computer is at any time. So someone, unfortunately on our team gets their computer stolen, we know where it is and we can shut it down, just like your phone, like find my iPhone.

Dawn: 13:32

Mm-hmm.

Rob: 13:33

That's the same, the same key Identity and access management is. Key is making sure you know who has access to your environment, so you cannot have access to people that are not supposed to have access. Yeah, so Make sure there's no anonymous. Make sure there's no passwords underneath the keyboards.

Dawn: 13:51

Make sure there's nothing like that in any Shores of that?

Rob: 13:54

Yeah, dlp, you know that is Data loss prevention, oh, I was saying protection. Disaster recovery. Yes. If you have an attack, if you have an incident, if you lose data, if you do anything like that, you have to make sure that you're able to restore that data and make sure to get that back.

Dawn: 14:16

Couple of these others just quite a few goons. And do we do disaster recovery and contingency planning?

Rob: 14:20

Oh, of course we do here at the Van Ryan Compliance pod. We should just do a whole thing on DR.

Dawn: 14:25

Oh, that's.

Rob: 14:25

Then we can talk about zero-tracks.

Dawn: 14:26

That's another folks listening. Disaster recovery planning is so People put that on the back burner. But here's the reality. We all have disasters that happen, I mean you have a storm.

Rob: 14:38

Your dog had a disaster with the skunk.

Dawn: 14:40

Oh yeah, you have a storm, you have money stolen, you have your business's revenues decrease. It doesn't matter what emergency or what accident or what things are gonna happen. But you have to plan for it you have to have some sort of insurance and that having a disaster recovery plan, what to do, when to do it and then how to continue. Your business is huge, yeah.

Rob: 15:06

The other area that DR is huge because obviously it's hurricane season, which we always track right. There's always cyber attacks. There's always power grid issues. So you gotta make sure you plan for that. The other thing you gotta make sure is know where your assets are. Asset management is big People forget.

Rob: 15:20

Yeah, I don't like Excel, but hey, if you can, just if you have a small team, fire up an Excel spreadsheet. Here's your team members in one column. Next there's a still number Wizard warranty expired. Also, your CPA is gonna need that for asset depreciation. He's Don, loves finances and asset depreciation.

Dawn: 15:40

You dive into that world lately.

Rob: 15:42

You've gotta track your assets and make sure you know what's going on.

Rob: 15:45

Yep, same with network management and vulnerability management. So network management is monitoring the network. Now how do we do that remotely? Right, there's how we do it remotely. Our team is remote and always will be. Remote is we have agents on every machine. So we have our rippling agent, which is tied into our HR, which is tied into the people which manages the assets, and then we have Sentinel-1 on every computer so we track all that. So we know everything. We know the information, we know what softwares installed. We know all of that.

Dawn: 16:19

We just had one on one of our employees' computers that we had to-.

Rob: 16:23

It was a hung install. It was a little weird.

Dawn: 16:25

It was really. It was a weird thing, but we were able to stop the process.

Rob: 16:30

Yep and mitigate it.

Dawn: 16:31

And mitigate it. It was really great to do that remotely, yep, and that ties into the vulnerability management.

Rob: 16:37

You gotta have the antivirus you gotta have, whatever platform operating system you're on, you gotta have antivirus and anti-mallware and make sure things are, have the ability to remediate that risk and that virus or the ransom attack. So, and if you're folks at home, make sure they have, like you know, wip 23 on their, on their wifi, make sure they have strong passwords, not just the house number, street number, name.

Dawn: 17:06

Don't have your dogs, that's what you're doing that's always fun to see what networks are open in the neighborhood.

Rob: 17:10

Yeah, yeah, I drive around.

Dawn: 17:11

So try that, try it like join other networks or turn on your see what other networks in the neighborhood that are like open it's pretty funny because you're like, oh, that's that neighbor, cause they have their full names, and it's like, oh my gosh.

Rob: 17:21

I wouldn't recommend joining, but you could.

Dawn: 17:23

Oh, don't join but, like you, when you turn it on, turn off, turn it on, you can see it. Lists yeah, yeah, you can see it all out there.

Rob: 17:30

Have strong passwords for your network. Have extremely strong.

Dawn: 17:34

Ours is hidden, which is a good idea. Zero trust yeah, we don't even. We don't even exist.

Rob: 17:39

Rough the grid.

Dawn: 17:40

Not, really, not really.

Rob: 17:43

Good idea, sir. You know the because it yeah. Vulnerability management is is key, making sure we have good cyber hygiene.

Dawn: 17:50

We wash our hair we wash our.

Rob: 17:52

we wash our teeth. Brush our face. Sure, wash our face, brush your teeth. Uh-oh, hey, we got the cheesy thing again. The next couple is just really really making sure you have cybersecurity governance and you have a team, a response team, that they know what they're doing. Do not ignore this. Um, it can be, and it's usually. It sits within your IT team, in in within your technology partners as well. They'll be there to help making sure you establish security policies, procedures and guidelines of what it takes to actually secure everything and make sure everything is secure.

Dawn: 18:32

Uh-huh.

Rob: 18:33

And know how to respond when there is a problem, don't ignore it.

Dawn: 18:37

Yeah.

Rob: 18:38

You know, don't just say, oh well, we'll be fine tomorrow. No, we gotta deal with it today.

Dawn: 18:42

Yeah.

Rob: 18:43

And also, if you have an attack, understand the attack. You need to understand, by law, you're supposed to understand it, and then you're actually, uh, actually, supposed to um, notify the FBI, because they need to track the type of attack as well, cause they they look at everything from a global standpoint. Yep, those are, those are key pieces. Those are all very key pieces that we've got to go ahead and dive into and make sure that we know what we're doing. Yes, we can ensure that we have a secure environment.

Dawn: 19:10

Mm-hmm.

Rob: 19:11

That's really good, don, is that the pod? That was a lot, we got a lot. I got through a lot. Let's see. Let's recap because I can't have.

Dawn: 19:18

I had fun things so as as current customers and prospective customers listening um. You know, when Rob and I built our assessment tool for the HIPAA, the HIPAA we, we, we tied in a lot more than the government questions.

Dawn: 19:36

So, as, as our customers know, we added probably about 50 additional questions, something like that, um, with a lot of cyber. So we are excited that now the government is addressing, adding more cyber uh, cyber uh questions, adding that more into the questions. So, um, we're excited because we, we, we had kind of already done that Um, but they have done, um, a couple things, a couple areas, a step further. So it's going to be really nice to blend that. So, uh, we, we've already um provided a very robust assessment, um, more than what the government has, and now they're sort of catching up, if you will. So it's exciting and it's exciting that they're finally identifying that they needed to up their game.

Rob: 20:24

So we're excited about this. There's a lot of rhetoric, there's a lot of stuff going on. Yes, there's an election in a year and, of course, we have to talk about it all the time. Um, but these are the things that we watch. This is the things that Van Ryan watches. Is, you know, um, what are the new laws? There's a lot of new state laws coming out too, and we'll have to dive in one of those.

Rob: 20:39

But obviously um, we're excited about the new requirements for audits All right, I think that's a wrap for the HIPAA.

Dawn: 20:47

That's the.

Rob: 20:48

HIPAA. And that's the pod. All right, we're out. Bye, bye.