Whistleblowers, Incident Reporting and Incident Management…Is your Health Care Organization Ready?
Posted In Incident Reporting, Legal, Regulatory Compliance, Risk Management on August 31st, 2010 Tags: dodd-frank wall street reform, Health Care, Incident Reporting, whistleblower
A previous Lessons Learned Blog mentioned the Dodd-Frank Wall Street Reform and Consumer Protection Act and a special bounty program within the Act for whistleblowers. Did you see it?
An attorney at the Healthcare Financial Management Association’s Annual National Institute legal update says healthcare providers may be heading into a storm of whistleblower suits that could cause serious problems for the unprepared.
The attorney predicts the new Patient Protection and Affordable Care Act could lead to an explosion of whistleblower lawsuits because the new law does not require the plaintiff to have direct knowledge of alleged fraud to file a suit.
So if you are involved with healthcare industry…are you ready?
Healthcare organizations to make sure they are ready for whistleblower related challenges:
- Do employees have access to trusted tools to report suspicious actions?
- Do third-parties/business associates have access to trusted tools to report suspicious actions?
- Do patients have access to trusted tools to report suspicious actions?
- Are assessment teams defined and trained on how to respond to incident reports?
- Do assessment teams have tools to access, track and document their actions and decisions?
- Do organizations have a customized compliance program implemented and documented?
The short list above represents some but not all of the challenges healthcare leadership should be targeting as soon as possible to ensure legal defensibility for your leadership and your organization…are you ready?
No Comments
Email This Post
Veterans Affairs: Why Not Implement Data Breach Lessons Learned?
Posted In Human Resources, Incident Reporting, Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management on August 26th, 2010 Tags: Awareness Training, Data Breach, Information Security, lost laptops, Veterans Affairs
Dissemination vs. Implementation
The Veterans Affairs Department recently announced they will be publishing monthly online accounts of data breaches and lost BlackBerrys and laptops in order to improve accountability and increase transparency.
What was shocking to me was that from April through July of this year, the VA has lost 72 BlackBerrys and 34 laptops. Patient information has been sent to the wrong address or mailed incorrectly 441 times. There were 9,746 breach incidents involving notifications to patients and 2,501 incidents in which credit reporting was required.
Almost 10,000 breach incidents in 3 months! What is wrong with this picture? Instead of just disseminating data breaches after the fact, what if the VA actually explained and implemented lessons learned and took proactive steps towards prevention?
I think the VA needs to ask a couple of questions:
1) Why are so many handheld devices and laptops being lost? Are there ways we can educate our employees on best practices for protecting devices? Are there consequences?
2) With so many devices and laptops lost each month, how do we ensure these devices are protected with encryption? Are employees taking home sensitive information that should not be placed on personal devices? Do employees know what information is sensitive?
3) What should be done to improve efficiencies in the mail room and prevent mailing errors with patient information? How do we know there were only 441 errors; were these just the mistakes that were caught?
4) How can we implement ongoing awareness and educate our employees (and third-parties) on protecting sensitive information?
Breach notifications are expensive. Credit reporting is expensive. Replacing BlackBerrys and laptops is expensive. Correcting errors and re-mailing information is expensive.
Prevention is a lot less expensive for the Veterans Affairs and a lot less expensive for us tax payers too… is anyone interested in implementing lessons learned?
No Comments
Email This Post
SEC Creates Bounty for Whistleblowers?
Posted In Incident Reporting, Legal, Regulatory Compliance, Risk Management on August 24th, 2010
According to a recent Washington Post headline, law firms are gearing up for new whistleblower reward program.
The new program was included in the Dodd-Frank Wall Street Reform and Consumer Protection Act signed by President Obama in July 2009 has created a bounty program that rewards individuals who provide “original information” to the SEC. The SEC can then award the individual with up to 30 percent of any successful enforcement action that exceeds $1 million.
There is no doubt that federal agencies are publicly ramping up to police illegal corporate activity… future Lessons Learned Blogs will discuss healthcare, education and others.
Here are some questions your organization’s leaders should be asking:
- Are your existing compliance programs working as you want them to?
- Are your policies and procedures updated, communicated, acknowledged and documented?
- Are employees and third-parties aware of how to report incidents?
- Are you encouraging employees to report internally before going to the government?
- Are you confident in how employee complaints will be handled?
- Do you have the right tools in place to connect the dots?
If law firms are gearing up…it is probably a good idea to pay attention to headlines and this Lessons Learned Blog too.
No Comments
Email This Post
Whistleblowers, Incident Reporting, Incident Management…Are You Ready?
Posted In Incident Reporting, Information Security, Legal, Regulatory Compliance, Risk Management, Workplace Violence on August 19th, 2010 Tags: bank fraud, CYA, financial reform, Incident Reporting, online safety, SEC, whistleblower, Workplace Violence
Have you been paying attention to recent headlines?
“New whistleblower reward program has law firms gearing up”
“Attorney tells audience to brace for a storm of whistleblower lawsuits”
“Financial reforms up retaliation risk”
“Preventing violence in health care setting”
“Banks seek customers’ help to stop online thieves”
Lessons learned and headlines are mounting and organizational leaders from nearly every sector should be paying close attention if they want to prevent their name and their organization’s name from being featured in unwanted headlines and lawsuits.
In a few of our next blog posts, I will be sharing lessons learned on how incident reporting, incident management, threat assessment teams, prevention, intervention, documentation and CYA will play a critical role for the foreseeable future….are you ready?
No Comments
Email This Post
Rite Aid – HIPAA Violation – Lessons Learned Not Implemented
Posted In Incident Reporting, Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management on August 12th, 2010 Tags: CVS, FTC, HIPAA, HITECH, Rite Aid, Security Awareness
Did everyone see this ultimate lesson regarding lessons learned but not implemented?
Remember back in February 2009 when the Federal Trade Commission (FTC) issued a settlement against CVS Caremark? According to the settlement, CVS Caremark violated the HIPAA privacy rule and the FTC Act when some of its stores improperly disposed of prescription information and pill bottles that had patient information on them. The settlement resulted in a $2.25 million fine and they must ensure their security program meets the standards of the settlement [including ongoing audits] for the next 20 years.
Now roll the clock ahead to July 2010 and another pharmacy chain – Rite Aid Corp. – has agreed to pay a $1 million fine because they violated the HIPAA privacy rule and the FTC Act when some if its stores improperly disposed of prescription information in dumpsters.
The HHS settlement against Rite Aid requires their pharmacies to:
- Establish policies and procedures for disposing protected health information and sanctioning workers who do not follow them;
- Create a training program for disposing of patient information;
- Conduct internal monitoring;
- Obtain an independent assessment of its compliance for three years.
The FTC settlement against Rite Aid requires the company to:
- Establish a comprehensive information security program designed to protect the security, confidentiality and integrity of the personal information it collects from consumers and employees;
- Obtain, every two years for the next 20 years, an audit from a qualified independent third-party professional to ensure that its security program meets the standards of the settlement.
For lessons learned to become lessons implemented, organizations must ensure that their program [security, privacy, compliance, risk management, etc.] is clearly defined, communicated, acknowledged by all appropriate personnel, documented, updated and maintained on an ongoing basis.
Unfortunately most programs are just pushed out on portals, intranets and shared drives or blasted out in binders, e-mails and memorandums.
Albert Einstein said it best:
“Insanity is doing the same thing over and over again and expecting different results.”
Are you and your organization doing the same thing over and over again and expecting different results?
No Comments
Email This Post
SEC Provides Lessons Learned on Policies and Porn
Posted In Business Continuity, Human Resources, Incident Reporting, Information Security, Legal, Risk Management on July 7th, 2010 Tags: Federal Computer Week, incident management, SEC, security policy, social media policies
A recent follow up article in Federal Computer Week (FCW) highlighted the porn scandal at the Securities Exchange Commission (SEC) and suggested this was a dramatic wake-up call for any government agency who doubted the need for and importance of an airtight security policy.
Good for Teri Robinson… who wrote the article!!
However…the steps Teri laid out that an agency should take to build and enforce a security policy are missing a couple of critical steps based on lessons learned and legal defensibility. Teri suggested the following steps:
- Review existing policy
- Social media guidelines should be included and should be specific
- Assign responsibility because policies are more easily adopted if someone is in charge
- Train, train, train as threats change so do policies so regular training is needed
- Enforce the rules
- Ramp up resources with technology and staffing
I agree with Reviewing Existing Policy, Including Social Media and Enforcing the Rules.
I sort of agree with Assigning Responsibility and Train, Train, Train…
I disagree with Ramping Up Resources and Staffing Up.
Based on lessons learned, the following steps are also needed:
- Accountability at the Individual Level
- Documentation of Individual Acknowledgements
- Situational Awareness and Case Studies that relate to organization specific policies
- Incident Reporting and Incident Management Tools for Assessment/Prevention Teams
And based on lessons learned, more staff for enforcement and training is probably not necessary if you implement the right tools for current personnel to utilize.
Now if we could just get federal agencies to start using “tractors” instead of “old horses”…
No Comments
Email This Post
Supreme Court: You Can Spy on Employees if…
Posted In Information Privacy, Legal on July 2nd, 2010 Tags: policies and procedures, search, supreme court, text messages
Did you happen to notice the recent Supreme Court ruling that ruled in favor of employers having the right to check up on employee usage of mobile devices to protect their bottom line?
These days it is fairly common for organizations to equip their employees with mobile devices and pagers. But when employees are given a character allowance for texting and they go over the allowance, the organization is charged overage fees and this is where the ruling comes in.
In this court case, the employers were looking to get costs back in line and requested transcripts of the employee text messages to verify if the overage fees were necessary. What the employers found were lots of personal (some highly explicit) text messages being sent on company owned devices.
After several lower court rulings, the Supreme Court ruled that because the employers suspected that people were breaking the rules and using their mobile devices and pagers for non-business communications, the employers were justified in requesting and reading the text message transcripts.
But before employers get too excited…there are multiple lessons learned in this Supreme Court ruling, and employers do not have free reign. Employers must have clearly defined policies that spell out what employees can and cannot do on the clock and off the clock with company property. The employer’s dos and don’ts should include phones, laptops, etc. Employers must also communicate the policy to all appropriate employees to make sure they understand what the dos and don’ts include. Employers should also make sure managers and supervisors understand what steps they can and cannot take when it comes to keeping costs down and privacy rights cannot be invaded just for the sake of controlling costs.
Does your organization have the right policies in place with the right people? Would your policies and procedures hold up in a court ruling?
No Comments
Email This Post
Prevention is Key to Escalating Costs for Banks and Customers…
Posted In Information Privacy, Information Security, Legal, Regulatory Compliance on June 4th, 2010 Tags: ACH Fraud, Awareness Training, Financial Security, Hillary Machinery, PlainsCapital, Security Awareness
Did you see this lesson learned involving a bank and their customer?
We all know that famous quote from Benjamin Franklin – “An ounce of prevention is worth a pound of cure”….but knowing it and implementing it are two entirely different efforts.
I hope financial institution and business leaders are paying attention and realizing that COSTS related to implementing prevention are a whole lot less expensive than COSTS related to reaction and damage control?
What if PlainsCapital and Hillary Machinery had invested more in individual level awareness and tools that could have prevented this string of events?
- Cyber criminals transferred more than $800,000 out of Hillary Machinery’s bank account via ACH and wire transfers.
- Hillary Machinery and PlainsCapital bank were able to recover about $600,000 of the funds that were sent to eastern Europe.
- Hillary Machinery asked PlainsCapital to repay the remaining $229,000.
- PlainsCapital responded by filing a lawsuit against Hillary Machinery asking the judge to declare the bank’s security measures “reasonable”.
- Hillary Machinery filed a countersuit that charged that the bank did not catch the irregular wire transfers and ACH transactions made to Europe over a weekend.
- Hillary Machinery moved their business accounts to a different bank.
- PlainsCapital settled its lawsuit against Hillary Machinery.
Hillary Machinery is saying nothing and PlainsCapital is saying nothing.
Bottom line…the COSTS to both organizations were significant. When you add up the COSTS for legal fees and reputation management related to negative headlines along with each organization’s time, resources, marketing, damage control and lost business…you see that prevention would have been much less expensive.
Is your financial institution prepared to prevent this type of incident? Are customers prepared to do their part in preventing this type of incident? Are business leaders prepared to prevent sophisticated cyber attacks and risks?
One last thing…don’t you wonder what the settlement details were?
No Comments
Email This Post
What is a “Failure to Implement”?
Posted In Human Resources, Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management on April 19th, 2010 Tags: Assessments, CVS, documentation, FTC, HIPAA, Implementation, Infotec, legal due diligence, Omaha, Security Awareness
Recently, Awareity’s CEO, Rick Shaw, was asked to present at the Infotec conference in Omaha. During his presentation, “The Truths (and Myths) About Assessments, Planning and Implementing”, Rick discussed the three-legged stool each organization is sitting on, and the importance of all three legs (Assessments, Planning/Developing and Implementing).
Most organizations understand the importance of assessments and planning, but where many fail to deliver is in the implementation phase. As we have seen with numerous headlines and lessons learned, a failure to implement can lead to expensive fines, lawsuits, breaches and losses. Rick used a case study for CVS Caremark. Due to employees carelessly tossing old pill bottles into a store’s dumpster, CVS now has the FTC coming to audit their information security program for the next 20 years and was forced to pay a HIPAA violation fine of $2.25 M.
The FTC Complaint Docket No. C-4259 read:
“Among other things, respondent failed to: 1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal.”
During the presentation, one woman raised her hand and asked, “What do you mean by “implement”? How do you “implement” your policies and procedures once they are created?”
I thought this was a great question and one that should be expanded upon.
An organization can have the best security policy (or plan, program, etc.) in the world, but if the policy is not implemented down to the individual-level, how will individuals be able to help the organization achieve better results?
If your organization is just blasting your security policies out to your people in e-mails and memos…how do you know if anyone received the email or is reading the policies and understands them? Or perhaps you are sending out updated pages for the employee handbooks or manuals…how can you ensure your employees are actually reading these policies? Are the binders just sitting on a shelf untouched?
Implementing policies, procedures, plans and processes means organizations have documentation and proof that individuals have read, understood and acknowledged their roles and responsibilities. Regulations require proof of implementation. Legal due diligence requires proof of implementation. Lessons Learned continue to prove that organizations that lack implementation will continue to experience expensive and embarrassing results.
Organizations must ensure all appropriate individuals (employees, third-parties, etc.) are receiving updated policies and guidelines, reading the policies, understanding the policies, and acknowledging their individual roles and responsibilities. Providing employees with a once-a-year general training session is not good enough as we know risks, threats, best practices, etc. are constantly changing. The bad guys are not taking 364 days off, is your organization?
Comment (1)
Email This Post
“Culture Eats Strategy for Lunch”
Posted In Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management on April 6th, 2010 Tags: Boulder Community Hospital, culture, Data Breach, Management, strategy
Perhaps you have heard this saying before?
Culture eats strategy for lunch.
Culture is most commonly defined as the behaviors and beliefs characteristic of a group of people. So an organization’s culture of behaviors and beliefs are what shape the decisions people make and results an organization achieves.
Lessons learned indicate that an organization’s culture is driven from the top down. For example, what culture related messages do organizational leaders send:
- With their words?
- With their actions at work? In public?
- When they respond to conflicts?
- When information is shared internally and externally?
- When changes are encountered?
- On an ongoing basis?
So how does culture eat strategy for breakfast?
Simple…an organization can have the best strategy in the world, but if their culture will not allow or enable the strategy to happen…the strategy is not going to succeed.
There has never been a more critical time for organizational leaders to ensure new strategies are aligned with their organization’s culture. Organizational leaders must also eliminate gaps and connect-the-dots to ensure their organization’s culture is consistent across levels and silos of people.
How is culture created, implemented and managed?
Lessons learned show that organizations first need to replace their traditional and reactive methods of communications – manuals, general and annual training, memos and memorandums – with proactive methods that ensure awareness, accountability and measurability.
Lessons learned show that organizations are more successful when their acceptable behaviors and organizational beliefs are communicated using methods that require individual level acknowledgements of understanding.
If your organization is just blasting your acceptable behaviors and beliefs and policies out to your people in manuals, e-mails and memos…how do you know if anyone is reading them or understands them?
A recent example of culture eating strategy for breakfast comes from a hospital in Colorado. The hospital recently found out that some of their patients received letters informing them that their medical records were taken from unsecured recycling bins outside the hospital owned clinic. A hospital spokesperson told a Denver news affiliate the following:
“We learned that while we have good policies for protecting patients’ information, those policies weren’t really being followed.”
I guess their culture ate their strategy (and policies) for breakfast…
Comment (1)
Email This Post
