Select Page
Protecting HIPAA Data On Mobile Devices

Protecting HIPAA Data On Mobile Devices

by | Jan 12, 2016 | HIPAA, Managed IT Services, Security

HIPAA stands for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996.

Essentially, HIPAA enshrines the means by which American workers and their dependents can keep their health insurance coverage should they change or lose their jobs.

 

HIPAA also sets industry-wide standards for electronic billing of health care services. Additionally, this law mandates the confidential handling of an individual’s medical information.

 

So what does this have to do with mobile devices? Plenty.

 

Mobile devices have affected every industry sector. With each passing day, more and more professionals conduct their business using tablets, laptops, or smart phones. This includes the medical industry. Doctors, nurses, and physician’s assistants routinely send confidential (HIPAA) data over satellite data plans and WiFi.

 

Securing HIPAA Data Remotely

In most cases, the medical industry’s use of mobile devices translates into better patient care. But it also opens personal medical data to the threat of cyber theft.

To maintain HIPAA compliance, health care professionals and IT managers should implement the following best practices when handling health care data on mobile devices:

Obtain Written Permission Before Operating via Mobile

Make sure to document the fact that your patients have signed off on communicating with your office via email or any other electronic means. Documented consent is critical to HIPAA compliance. It’s also one of the simplest and best ways to avoid embarrassing misunderstandings and potential legal suits down the line.

Stick to Proper Professional Jargon

The ease and speed of mobile devices often results in users relying on abbreviations, emoticons, and other forms of internet vernacular. Put simply: DON’T DO THIS. Due to the nature of the field, any HIPAA data created should be kept appropriate for long-term records. Remember that communications, notes, and files that appear unprofessional can subject health care practitioners to confusion at best and malpractice suits at worst. Treat every character you type on behalf of your job as the valuable work product it is. Your company and the patients you treat depend on accurate communications scripted in proper industry vocabulary.

Everything Goes Into the File

Remember that every email you send or receive, every file you upload or download, every conversation you have by phone is part of your patient’s official medical record. Text messages, phone calls, and conversational asides might not seem important in the moment. However, they all form a piece of the overall puzzle a patient’s profile presents. Be sure to record every instance of communication diligently to prevent confusion and delays in treatment, as well as to maintain HIPAA compliance.

Encrypt Your Transmissions

No one leaves for work each day while the door to the house stands open wide. That’s just common sense. By the same token, no one using a mobile device in the 21st century should send any transmission without securing that message via data encryption. User passwords activate only one tier of proper data security. DON’T STOP THERE! Due to the sensitivity of medical information, add as many layers as you can in the form of personal questions, icons, PINs, and other challenge-response tests. Remember that there’s no such thing as too much security.

 

Managed IT Keeps HIPAA Data Safe

Our ComplianceCare service from EstesCloud can help you solve all of your HIPAA IT issues.

Get more tips on protecting HIPAA data on mobile devices with our comprehensive advice on remote worker security. Because mobility increases the risk of cyberattacks, our helpful IT security guides can keep your employees and clients safe. Fill out the form below to receive a presentation on remote workforce security. This presentation was an event in partnership with the Loveland Chamber of Commerce. EstesGroup’s headquarters is in Loveland, Colorado, where we help small and midsize businesses deploy mobile cybersecurity solutions.

How To Reduce Email And Website Spam

How To Reduce Email And Website Spam

by | Jan 2, 2016 | Security

How to reduce SPAM on your website and in your mailbox

SPAM can be time-consuming and frustrating, and can lead to additional problems on your website and in your email. It becomes increasingly frustrating when it seems to grow like uncontrollable mold. To prevent SPAM, it is important to know how it is defined, how it comes about and finally, how to reduce SPAM or stop it altogether.

What is SPAM?

Spam can be defined as:

Posts and links that go to a spammer website

Inappropriate messages sent to a large number of people

Electronic “junk mail”

Mass commercial advertising

How does SPAM happen?

“Spammers harvest recipient addresses from publicly accessible sources, use programs to collect addresses on the web, and simply use dictionaries to make automated guesses at common usernames at a given domain.” SOURCE: Reducing Spam

Limit the damage spam can cause

  1. Because SPAM is one way to carry a virus, using a good anti-virus is important for all internet and e-mail users. Because SPAM can come from a known domain, and because they are becoming more sophisticated in obtaining e-mail address, it is important to know the sender and even verify the information before opening suspicious links. Most mail systems already filter email, but those that are aware of your ‘safe senders’ are more accurate and effective in reducing spam email.
  2. Use strong passwords to protect your accounts from being forged. A strong password typically includes a mix of 8 or more characters including upper and lower case letters, number and special characters. Change your passwords regularly to prevent hacking. Once your email address is compromised, it can be used to send out SPAM to your entire contact list, and those messages will be coming from a legitimate source – you!
  3. If you get an attachment from an unexpected sender, or you weren’t expecting an attachment from a known sender, chances are good it’s malware. Don’t open it!
  4. Hover over links and analyse the “from” address before clicking any links to see where they will be directing you. Also, be aware of changes to your accounts and always call if there is a question. For example, if Chase Bank sends an email telling you of an issue with your account, they will have you login to your Chase account or ask you to contact a representative. They will not ask you to respond to the email with sensitive information such as your name, birthdate or social security number.  If I’m interested in the product, I’ll type the URL rather than risk clicking the link with the trackers embedded.
  5. Keep a web filter running to prevent the unaware user from clicking the phishing link and being taken to the wrong site.

How to Reduce SPAM: Tools and Tricks

  1. In addition to an anti-virus programs, use an anti-spam filter. These filters will look for certain known “tricks” spammers will use including phishing schemes. Phishing scams are when the request is being made for personal or private information.
  2. Use throw-away email addresses.  If you need to use your email address to post or publish online, use an email address specifically for that purpose, but keeping your ‘real’ email address safe and secure. To reduce spam email, be careful when using your email address to sign up for items online, making sure to uncheck any boxes giving authorization to third parties to contact you and that there is a “won’t sell your email” policy.
  3. Don’t publish your email address online, including on your website. If you do, disguise it in a way that human readers will understand but programs trolling for email addresses won’t, such at “example at hotmail.com”.  Some use a graphic to show an email address, and not HTML text that’s easily harvested, effectively reducing spam email.
  4. Disabling user generated content is another way to prevent SPAM on websites. These are automatically created comments that are usually submitted to blog pages. The negative side of this is when an actual customer or potential client is interested in offering feedback, they can’t immediately post. Having them complete a contact form is a better way of getting information from them than having them leave a comment.  If you need them to post live content, post-process the data to ensure it’s not spam or worse!
  5. Use a CAPTCHA form to cause someone to enter information to prove they are indeed human and not automated. These are images with text that is unreadable by computers, thus limiting what can be submitted.
  6. One user reported having great results with reducing spam on their website by creating a form with a field invisible to human readers, but that automated systems couldn’t resist. When this invisible field was populated with an answer, it was automatically discarded as spam.

See SANS for a sample email policy here https://www.sans.org/security-resources/policies/general#email-policy

 

We can help you limit spam and keep your inbox clean.  Deploy EstesCloud ClientCare and let us help you get IT together!

EstesCloud // Explore our Managed Services Solution:

CompleteCare: Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost.  Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business.
Let’s start the conversation!

ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff.
EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers.
Discover the Benefits of ServerCare.

ClientCare: Proactive support for your desktops, laptops, and mobile devices.  We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365.
EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed.

Take control of your systems today.

ComplianceCare: Are you a medical provider under HIPAA or HITECH regulatory compliance? Are government auditors keeping you up at night? Our HIPAA IT Management Service will ensure you are HIPAA compliant.

For the health of your IT Enterprise.

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and

Get IT Together.

HIPAA Technical Safeguards

HIPAA Technical Safeguards

by | Dec 10, 2015 | HIPAA, Managed IT Services, Security

HIPAA Technical safeguards are designed to decrease the possibility of a security issue or data breach in an organization.

Businesses handling protected health information (PHI) must have current and comprehensive technical safeguards in place to remain secure from any threats, whether internal or external. Organizations that require HIPAA technical safeguard compliance must determine the extent of their security measures and if they are reasonable and appropriately suited for the size of the organization. For example, internet filtering and full disk encryption may be appropriate and cost effective for entities with tens of thousands of records managed by multiple users, while a smaller organization may be sufficiently protected with a less complex antivirus, file encryption or simple firewalls.

What are HIPAA technical safeguards?

HIPAA technical safeguards are simply the policies and procedures for the use of technology put in place to protect patient health information. It includes the technology, software, hardware, administration and more. There are four main components:

HIPAA Access Control

This is a policy or procedure that controls who can access information. Only authorized people should be able to access certain information and all activity must be able to be tracked to a specific user. User verification and automatic log-off after times of inactivity, as well as emergency access procedures are addressed here.

HIPAA Audit Control

These controls are designed to record and examine activity where patient information is accessed or stored. The procedure should include a process that outlines the frequency, methods and scope of the audit, as well as processes for violations.

HIPAA Integrity Control

This control is in place to ensure patient data is not destroyed or altered. This typically begins with a risk assessment to determine how outside sources may be able to access the information and then addressing those areas of weakness. Protection for external storage of information is also included here. It can also include procedures, processes or software that authenticates information.

HIPAA Transmission Security

This technical HIPAA security safeguard addresses the concern of unauthorized access to patient information being transmitted over a network. The use of electronic medical records which allow medical personnel to access patient data inside an office or on the other side of the country, must be secure. Encryption is the key tool here.

Any technical safeguards will change as technology and threat landscape changes.

But with HIPAA security safeguard components in place, the opportunities for cyber attacks and data loss can be reduced significantly. While medical providers are required to follow HIPAA regulations, any network can be made more secure with the very same guidelines. EstesCloud ComplianceCare offers the best-of-breed HIPAA compliance services, making sure your practice will pass any audit that might come your way!

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and

Get IT Together.

Do You Have A Password Policy?

Do You Have A Password Policy?

by | Nov 30, 2015 | Security

Continuing our EstesCloud IT Security blog series which began with why you should write a security policy and do you have a malware policy, we continue with our next edition about malware.

A client recently changed managed IT service companies to EstesCloud and we quickly discovered some issues that involved passwords. It is typically only after an organizational change that password and security problems are exposed, so what’s the solution? We suggest creating a password security policy.

Basically a password security policy is a document that outlines how users can use and create passwords. This can also include guidelines for creating logins/ usernames and more. It is important to an organization’s security, as most assets are protected only with a name and a password.  Consider how many websites and doors open up with just a name and a password.  Now, consider the ramifications if those passwords were compromised!

It is likely you have never considered implementing a specific password policy, so let’s take a moment and look at some of the problems with not having one and some of the components to consider when you do write a password policy. Microsoft implements a default password security policy with these settings:

  1. Passwords must be changed every 42 days, but not more often than once a day.

  2. Passwords must be 7 or more characters

  3. 24 previous passwords are remembered and can’t be reused

  4. Passwords must be complex (UPPER, lower, numbers and symbols)

  5. Passwords cannot contain the username

Problems in neglecting having an password security policy implemented

1.   When an employee leaves.

When an employee leaves, regardless of death, quitting or termination, or even for temporary leaves of absence, the next person to handle the roles needs to have access to information. This can include computer passwords, website log-ins, e-mail access and more. Employees can set up their own logins and security passwords which causes the successor to not be able to access important information.

Example: Susie used an online payroll processing company and when she created her log-ins, used personal information in setting up the security questions. When she was terminated for not processing the payroll one week, all those answers went with her. She was not cooperative in providing that information to her former employer. This resulted in lost productivity when the owner had to prove ownership and reset the account, including transferring all the historical data.

2.   When changing a vendor.

This is similar to when an employee leaves because the vendor is like an employee. They have information that they take with them when the contract ends, and getting it back, when they are no longer financially tied to you, is difficult.

Example: John was hired to replace the former IT company who failed to perform and test regular back up tests. When he attempted to resolve an issue with Microsoft, he didn’t have the information needed to login or verify the business. A password reset wasn’t working because it wasn’t know what e-mail address was used to create the account. This resulted in lost money by the company who had to pay John to troubleshoot something created by another vendor, who was already paid.

Components to consider in writing a password policy

1.   Purpose and Scope of the policy

Explain why this policy is being created and where it is to be implemented. For example, is it only for client data, or all web uses?

2.   How long a password can be in place before it needs to be changed

This is usually between 60 and 180 days for most companies. When there is less of a security risk, longer periods can be considered. Requiring changes more frequently than 30 days results in employee frustration, and usually users will write their passwords on a post-it note and leave it under the keyboard

3.   How long a password needs to be

Strong passwords are 8-14 characters. The longer, the harder they are to be cracked.  Think pass-phrase instead of pass-word and you’ll be safer.

4.   Variety of password characters

Requiring letters, capitalization, numbers and symbols can create a more secure password. It can also exclude things like repetition, use of a name or username, etc.

5.   How passwords are stored

Passwords may be stored in a secure document, in a shared cloud file, an encryption program or more, and needs to be specified. Additionally, note how passwords shouldn’t be stored, shared or communicated.

6.   How the policy will be enforced and disciplinary actions if not adhered to

Clearly communicate how this policy will be enforced and by whom. Lay out the action steps if the policy is not followed. This may also be where a component is added regarding an account lockout. Remember the end result is in creating security, not in creating endless disciplinary actions.

7.   Administrations rights

Define what the administration is able to access and when.

A good password policy can help a company keep information secure, as well as have an action plan in case of an organizational change that results in having a successor take over with tasks that require the use of a password. Partner with your IT company when creating your password policy as they are typically the administrators of the policy. They will be instrumental in setting up the behind-the-scene processes that will manage password security.

Click Here to see SANS for a sample password policy.

In some cases where single-factor authentication (name/password) is insufficient, we can help with multi-factor authentication (like PIN# and a text message).  EstesCloud Server Care includes a password policy review, and depending on your company policy, we can propose a more secure password policy.

EstesCloud // Explore our Managed Services Solution:

CompleteCare: Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost.  Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business.
Let’s start the conversation!

ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff.
EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers.
Discover the Benefits of ServerCare.

ClientCare: Proactive support for your desktops, laptops, and mobile devices.  We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365.
EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed.

Take control of your systems today.

ComplianceCare: Are you a medical provider under HIPAA or HITECH regulatory compliance? Are government auditors keeping you up at night? Our HIPAA IT Management Service will ensure you are HIPAA compliant.

For the health of your IT Enterprise.

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and

Get IT Together.

Do you have a malware policy?

Do you have a malware policy?

by | Nov 20, 2015 | Cloud, Managed IT Services, Security

Continuing our EstesCloud IT Security blog series on the importance of cyber security, which began with why you should write a security policy, we continue with our next edition about malware.

 

A server malware protection policy is designed to protect your systems from cyberattacks. Malware is software with the intention to damage or disable computers or computer systems. It can be code, spyware, cookies, viruses, worms, Trojan horses, and more that compromise your PC and possibly your whole network! They can be very expensive to correct, not just in lost productivity, but also in equipment restoration or replacement.

 

Malicious software typically enters in 6 ways:

  1. E-mail attachments
  2. E-mail links to suspicious websites
  3. Website surfing to problematic websites
  4. Website links to malicious sites
  5. Exploiting vulnerabilities in the hosts, communication networks or perimeter systems
  6. Convincing a user to install infected software/apps

 

How and why to create a malware policy

 

Just as with any policy, you will begin with the “Why”. Why are you creating the policy? Presumably it’s to minimize the likelihood and the subsequent impact of an infection.

 

Let’s begin with some more basic questions:

  • Who does it apply to?
  • What equipment is included?
  • What are we talking about?

 

We can then ask questions that lead to solid definitions:

  • What is malware?
  • What damage can it cause?
  • What is an anti-virus program?
  • What is filtering software?
  • How is the malware policy activated?
  • Where do we go for additional resources?

 

The malware policy itself can be stated in various ways:

  • What the anti-virus program is, who installs it and what devices require installation.
  • What to do in case of new devices, suspected infection, suspicious or problematic software links.
  • How and when scans should be run and if they are manual or automatically scheduled.
  • How the software should be monitored, updated and management of the required updates
  • Rules about installing applications, downloading information, updating software, and opening attachments.
  • The use of filtering programs such as website blockers and e-mail scanning.
  • Rules about spam, junk mail, chain e-mails, social sites and any other applicable areas of potential risk.

 

Then it might be a good idea to make a malware policy response plan

 

Sometimes all the policies, plans and procedures can’t stop a cyberattack, in which case you may consider a malware response plan. This response plan should be included as part of the malware policy.

 

The malware policy back up plan kicks into action when there is an infection or a threat. It is typically a flow chart of action steps to mitigate as much damage as possible.

Step 1: Determine if there is a threat and how significant it is.

Step 2: Isolate the problem. The solution may require blocking internet services or shutting down a server or workstation to prevent further infection.

Step 3: Remove the problem. This is what the anti-virus programs are designed for. It may simply be a scan, repair, re-installing the OS from original disks, or even replacement of equipment.

Step 4: Recovery. Once the problem has been isolated and eliminated, check the systems for any other problems. Depending on the depth of infection, you might consider the venerable “format C:” to remove most (but not all!) infections. Be careful you don’t re-infect your system as you restore data, and make sure you close the attack vector so you don’t get re-infected!  It is absolutely essential that your backup and disaster recovery plan be 100%, as some infections (like CryptoWall) cannot be removed!

Step 5: Communication. Talk about the malware was able to cause damage. Talk about the situation with users and make any needed adjustments with the IT company to avoid it happening again in the future.

 

The bulk of information involved in a malware policy is in the communication to users about what it is, how it can be prevented and what to do in case there is an infection. With EstesCloud Server Care, ClientCare, and our HIPAA Compliance Care antivirus and filtering software installed, incidents can be avoided and you’ll have support if there is an issue.

 

EstesCloud // Explore our Managed Services Solution:

CompleteCare: Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost.  Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business.
Let’s start the conversation!

ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff.
EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers.
Discover the Benefits of ServerCare.

ClientCare: Proactive support for your desktops, laptops, and mobile devices.  We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365.
EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed.

Take control of your systems today.

ComplianceCare: Are you a medical provider under HIPAA or HITECH regulatory compliance? Are government auditors keeping you up at night? Our HIPAA IT Management Service will ensure you are HIPAA compliant.

For the health of your IT Enterprise.

Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and

Get IT Together.