June 2018

ACTIVE SHOOTER IN ANNAPOLIS, MARYLAND KILLS FIVE, INJURES THREE, AT THE ANNAPOLIS CAPITAL GAZETTE NEWSPAPER OFFICE

Posted on June 29, 2018 12:43 pm by Caroline Ramsey-Hamilton Comment

I WAS SHOCKED AND DISMAYED AS I WATCHED THE BREAKING NEWS: ACTIVE SHOOTER IN ANNAPOLIS, MD YESTERDAY. I teach Active Shooter Training, perform Active Shooter Drills and do Active Shooter Risk Assessments every week, but this one was different because I used to have an office right next to the Capital Gazette on Bestgate Road.

This horrific shooting had all the hallmarks of the other Active Shooters we have seen. The shooter was mad over something that had been written about him 7 years ago, so he thought about it every day, and fantasized about getting even, and then one day, he picked up his gun and headed to the Capital Gazette newspaper office.

He used his shotgun to shoot out the front glass doors, walked inside and started shooting. The extent of the carnage was kept out of the news for several hours, but then the Governor announced that five staffers had been killed and 3 other injured.

AGAIN, THE SHOOTING WAS OVER BEFORE THE POLICE ARRIVED. They eventually had 105 law enforcement officers on the scene within two minutes, but it was too late to save anyone.

Because Annapolis is the capital of Maryland, and a relatively small town, this was another case of IT CAN’T HAPPEN HERE! The newspaper office had no security in place.

Even though the shooter (who’s name I won’t use) had made many threats to the newspaper and its staff, the threats were not taken seriously, and there was minimal, if any, security at the Capital Gazette Office. There was no security presence in the office, or the building, no panic alarm, and no case management program had been set up to track and attempt to manage the shooter’s threats.

LESSONS LEARNED: Effective Security is the only thing standing between YOUR STAFF and an Active Shooter.

1. Effective Security is the only thing standing between YOUR STAFF and an Active Shooter.

2. Even the most basic security threats, such as having a solid, bullet-proof door (not glass),
having a safe room for staff, can make the difference in saving a life.

3. The newspaper had decided NOT to get a restraining order against him, thinking it would
make things worse, but instead, ignoring the threats is what inflamed the shooter.

THANKS FOR READING THE RISKAlert Report©

For more information and a free subscription: write to: caroline@riskandsecurityllc.com
We provide the best Active Shooter and Facility Risk Assessments & Training Programs. Find out more
at www.riskandsecurityllc.com .

Categories:
Risk Assessment & Compliance

77-Year Old Man in a Senior Care Retirement Home Fatally Shoots One Firefighter and Injures Another in Long Beach, California

Posted on June 27, 2018 4:04 pm by Caroline Ramsey-Hamilton Comment

RISKAlert Report # 1149 Updated: June 27, 2017 Long Beach, California

A 77-year-old retirement home resident identified as Thomas Kim, has been accused of intentionally setting a fire Monday morning to lure first responders to the facility. After the firefighters entered the Home and
put out the fire, Kim fired on the men, killing one firefighter and wounding another.

“It’s the first time we have seen anything like this said, Mike Duree, Long Beach Fire Chief..

Around 4 a.m. Monday morning, firefighters Capt. Dave Rosa and Ernesto Torres responded to reports of a fire, followed by an explosion and the smell of gasoline, at the Covenant Manor senior care facility, Duree said. As they approached the high-rise building, the firefighters noticed that the windows of one unit had been blown out and that the sprinklers were on.

After extinguishing the fire, Rosa and Torres remained inside the building to investigate the gas smell and explosion, the chief said. Ten minutes later, gunfire erupted and police received reports of an active shooter. Rosa, a 45-year-old veteran of the Long Beach Fire Department, was killed in the attack. Torres and another man, a civilian resident of Covenant Manor, were injured and taken to a local hospital.

Long Beach Police arrested 77-year-old Thomas Kim, who lived in the facility, in connection with the fire and the shooting.

They booked Kim on suspicion of murder, as well as two counts of attempted murder and arson, and is being held on $2 million bail. It is not known about where he got his weapon and how he started the high-rise fire.

Not much was immediately known about Kim, police said he was arrested years ago for auto theft and that detectives are looking into reports of erratic past behavior. His family said that they were stunned to find out the suspect was alive, living in Long Beach, and was a suspect in the murder and arson investigation.

LESSONS LEARNED:

Retirement facilities should institute a No-Weapons Policy for Residents.
Firefighters place themselves in danger every day, but didn’t expect to encounter
a killer in the retirement home!

THANKS FOR READING THE RISKAlert Report©For more information and a free subscription: write to: caroline@riskandsecurityllc.com
We provide the best Active Shooter and CMS Facility Risk Assessments & Training Programs. Find out more at www.riskandsecurityllc.com.

FEDERAL JUDGE RULES FOR OCR, FINES MD ANDERSON $ 4.3 MILLION DOLLAR FINE FOR MAJOR HIPAA VIOLATION INVOLVING UNENCRYPTED STOLEN DEVICES AND 33,000 PATIENT RECORDS

Posted on June 19, 2018 11:13 am by Caroline Ramsey-Hamilton Comment

In the ruling, the Judge found that The University of Texas MD Anderson Cancer Center (MD Anderson) violated the HIPAA RULE for Privacy and Security Rules and granted summary judgment to the Office for Civil Rights (OCR) on all issues, requiring MD Anderson to pay $4,348,000 in civil money penalties to OCR. The $4.3 million dollar fine is the fourth largest amount ever awarded to OCR.

MD Anderson is an academic institution and a comprehensive cancer treatment and research center located at the Texas Medical Center in Houston. OCR investigated MD Anderson following three separate data breach reports in 2012 and 2013 involving the theft of an unencrypted laptop from the residence of an MD Anderson employee and the loss of two unencrypted universal serial bus (USB) thumb drives containing the unencrypted electronic protected health information (ePHI) of over 33,500 individuals.

OCR’s investigation found that MD Anderson had written encryption policies going as far back as 2006 and that MD Anderson’s own risk analyses had found that the lack of device-level encryption posed a high risk to the security of ePHI. Despite the encryption policies and high risk findings, MD Anderson did not begin to adopt an enterprise-wide solution to implement encryption of ePHI until 2011, and even then it failed to encrypt its inventory of electronic devices containing ePHI between March 24, 2011 and January 25, 2013.

“OCR is serious about protecting health information privacy and will pursue litigation, if necessary, to hold entities responsible for HIPAA violations,” said OCR Director Roger Severino. “We are pleased that the judge upheld our imposition of penalties because it underscores the risks entities take if they fail to implement effective safeguards, such as
data encryption, when required to protect sensitive patient information.”

LESSONS LEARNED

1. MD Anderson had written encryption politics going back to 2006, and had identified lack of
encryption as a material weakness in their own risk analysis!

2. If a HIPAA Risk Analysis identifies a weakness in a critical area like encryption, immediately
start encrypting all electronic devices.

THANKS FOR READING THE RISKAlert Report©
For more information and a free subscription: write to: caroline@riskandsecurityllc.com

We provide the best CMS Facility All-Hazards Risk Assessments, HIPAA Risk Analysis, as well as Active Shooter Training,
Workplace Violence Assessments, and Mass Casualty Drills & Training Programs.

www.riskandsecurityllc.com and www.caroline-hamilton.com

Categories:
HIPAA
HIPAA fines
HIPAA Risk Analysis
Hospital Risk-Based Security
Medical Records
Office of Civil Rights

PARKLAND SHOOTING UPDATE: OF COURSE IT HAPPENED HERE SAID EX-SECRET SERVICE AGENT WHO REPORTED TO THAT MSD HIGH SCHOOL WAS VULNERABLE!

Posted on June 13, 2018 2:10 pm by Caroline Ramsey-Hamilton Comment

RISKAlert Report Updated: June 11, 2018

According to a retired Secret Service agent, Parkland’s Marjorie Stoneman Douglass staff was well
aware of the lack of security as much as 60 days before the fatal shooting took place. The former agent, Steve Wexler,
was invited to review the high school for security and he reported numerous weaknesses to the MSD staff including:
“Gates were unlocked. Students did not wear identification badges. A fire alarm could send students streaming into the halls. Active-shooter drills were inadequate,” he said.

In addition, he noted, “This stuff is blatantly obvious. You’ve got to fix this,’” Wexler said. He never
heard from the school again. His recommendations included:

1. School gates should be locked, and students should wear ID badges showing they belong on campus.
The shooter on Feb. 14 was able to get on campus because the gates were opened at the end of the school day.

Active-shooter drills should be routine. After the shooting, some students said they had not been involved
in drills this year.
Any adult should be able to declare a Code Red to lock down the school. Clark, the school district spokeswoman, said that is the current protocol, but Wexler said he was told an assistant principal notifies the principal, who then makes the call. “That’s a problem,” he said he told the staff. “This stuff happens fast. This playing telephone is no good. By that time we could sit down and have breakfast.”
Schools should not immediately evacuate students for a fire alarm without first confirming there’s a fire. During the shooting, the gunfire set off the smoke alarm, and students fled into the halls, where the shooter could take aim.

LESSONS LEARNED

1. If you have a security iny weaknesses identified by an expert – TAKE THEIR ADVICE AND
fix the issues that were identified!

2. Liability increases if staff were clearly warned BEFORE an incident that there were
existing security weaknesses.

For more information and a free subscription: write to: caroline@riskandsecurityllc.com

We provide the best Active Shooter Training, School Security Assessments, and & CMS Facility All-
Hazards Risk Assessments, Drills & Training Programs.