Category Archives: accountability

How to Easily Update your HIPAA Business Associate Agreements Before Sept. 23, 2013

Posted on by • 0 Comments
One of the major changes for every business involved with the new HIPAA Omnibus Rule is that you are required to 
“Review and,  if Necessary, Amend Business Associate Agreements”
Whether your organization is defined as a Hospital, a Physician Practice, a Group Health Plan, a Managed Care organization, a Pharmacy, a Dental Office, or any kind of “Covered Entity” (CE), you have to change your business agreements with all the people who access, create, manage, store, or view your Protected Health Information (PHI).
The new HIPAA Omnibus Rule (45 CFR § 164.314(a) and .504(e)) added new elements that require you to adjust the Business Associate agreements to make sure they agree (in writing) to comply with the HIPAA Security Rule, to make sure they perform their own Risk Analysis to assess how they protect PHI.
Covered entities and business associates must ensure that their existing and future agreements contain the elements required by . In addition to previous requirements, the agreement must require the business associate to:


1.  Comply with the security rule.

2.  Execute business associate agreements with their subcontractors. 

3.  To the extent the business associate carries out an obligation of a covered entity, comply with any HIPAA
      rule applicable to such obligations.

4.  Report breaches of unsecured protected health information to the covered entity (organization).
If you’re not sure how to adjust all these agreement, DHHS-OCR has updated sample business associate language for you
to use at :  http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html.

The HIPAA Omnibus Rule has made accountability more important because it says that the Covered Entity (CE) is

are liable for the misconduct of business associates if the business associate is acting as the agent of the covered entity.

In the same way, business associates should review their agreements with their Covered Entities and also their Sub-Contractors to make sure that the language in their contracts is up to date and makes it clear that the subcontractors are acting as independent contractors and not as the agents of the covered entity or business associate, and that the agreements do not give the covered entity too much control over day-to-day operations of you, their business associate.

As of today, August 19, 2013, both the Healthcare Provider (CEs), and the Business Associates have 34 more Days to modify these agreements modified and up to date, making sure they match the new HIPAA Omnibus Rule if :

(1) the agreement they had in place on January 25, 2013, complied with the HIPAA rules as of that date, and

(2) the agreement does not expire or renew (other than through evergreen clauses) prior to September 23, 2014!

So get out those pencils, and those agreements and start reviewing, amending and modifying those agreements!
SPECIAL TIP:  Here’s a web site with sample Business Associate language to use as a resource:
  http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html

Snowden’s Shameful World Tour

Posted on by • 0 Comments

Being a security person, and believing that extrodinary measures are required to keep us safe from
the increasing terrorist threat…   I maintain that Edward Snowden is a total coward, now that he has launched his travel from the US to China to Russia, and presumably, Cuba, Venezuela and Equador.

His judgement on many things is in question, especially in taking advice from another coward, Julian Assange, who’s been living in a small Embassy in the UK for a year.

Perhaps he could make a case that he thought US taxpayers had a right to more details about their tax dollars at work – the NSA’s surveillance programs, but he certainly DOES NOT have the right to disclose any classified program information to other nations, like China and Russia – just to name 2.

He DOES NOT have the right to stir up suspicions between nations, sort of a misguided meddler, basically selling out US secrets to a hostile world, and who knows who’s paying for all the international travel?  Is he handling out secrets for free, or is he selling out our country for financial gain?

His cowardice is illustrated by his total fall into the “What’s Good for Me” logic, which totally ignores issues of national security, destruction of trust between nations, and these actions compromise every statement he’s made so far.

He made himself into a 7-day media star.  He got his 15-plus minutes of fame, and now, he obviously has done a little more thinking about his choices, so he’s totally intent on protecting himself from any penalities, any recriminations, any dialogue with the US over the far-reaching implications of his bad choices.

For these reasons, and quite a few more, and mostly because I believe that he threatens our hope for a more peaceful world, I hope that other nations will grab him, return him to the US – to face the music he chose.

More distrust, more self-absorbed leakers, more lack of respect for the laws that govern civilized countries, is just not something we need right now.

NSA Hearings on the Hill

Posted on by • 0 Comments

NSA is answering questions this morning about their mega data collection of phone call destinations, before the House Intelligence Committee.

Having worked with NSA for years, I decided to watch the hearings and hear what General Keith Alexander had to say.   Of course, I have a family history with congressional hearings.

For myself, I’m in total agreement with NSA that they should be LISTENING, COLLECTING and ANALYZING intelligence so we can know what is happening all over our complex world and be in a position to prevent catastrophic attacks by those terrorists using their religion like a free pass to kill, maim and attack.

My father died over ten years ago, but one of my favorite memories of him is that is, while he was suffering from cancer, he never missed a Congressional hearing.  He sat with a TV Tray in front of him, with a stack of monogrammed notepaper, envelopes and stamps.

As the hearings progressed (I especially remember him watching Iran-Contra), he would write to each of the congressmen and senators, telling them how he judged their questions, writing to them about mistakes he thought they made.  This was true democracy in action.  From his pen right to the powers-that-be.    And he took his responsibility in this very seriously.

I hope everyone starts watching, learning and taking their role in our democracy as seriously!  An attention-seeking junior technician is having his 5 minutes of fame, and I hope that the great work of the US intelligence community is not going to be slowed down or damaged by his thoughtless disclosures. He should start writing letters to HIS elected representatives.

 

Oklahoma Tornado, Boston Bombing, Young Soldier Killed – It’s time to do a Security Risk Assessment!

Posted on by • 0 Comments

More Tornado victims will be buried this week.   Including many children who died at their schools because the school district didn’t spend the extra $3000 to have a storm cellar/safe room available.

One month ago, we watched as victims of the Boston Marathon Bombings were buried.

Yesterday, we watched an Islamic Jihadist savagely kill a  young British soldier with knives.

What other events do we have to witness before we start taking security assessments seriously?   How many more grieving parents do we have to watch crying on TV and, in my opinion, the casualities did not need to be so high and the aftermath so catastrophic.

If you group all these disasters together, you can that at the root of each one, is the feeling that, “IT CAN’T HAPPEN HERE”…..    Britain, for example, has tolerated mosques preaching hate, thinking that nothing like the knife attack could happen in civilized London.

In Moore, Oklahoma, people thought, “we already had a major tornado, so IT CAN’T HAPPEN AGAIN”!  Well, surprise – it happened again.  While forecasters cannot dictate the exact path of a tornado, they can get close, and with just fifteen minutes advance warning, there is  time to get everyone into storm cellars, safe rooms and underground shelters.  BUT IF THERE IS NO SHELTER AT A SCHOOL…….

Many obvious solutions-controls-safeguards were missed in these recent tragedies because proper, formal security risk assessments weren’t done effectively.  If they had been done, perhaps the London police could have picked up someone who touted murder and hate.

If a risk assessment had been done in Moore, OK, maybe the high risk of a tornado would have allowed the schools to all add the safe rooms they needed, and in Boston, the older brother Boston bomber, should have been in jail already for his participation in a previous murder – or at least actively monitored based on his facebook postings.

The clues are all there, and, looking backwards, you can see the pieces that SHOULD HAVE BEEN ENOUGH TO PROMOTE some kind of action to either:

        1. Eliminate the threat  or, 

              2. Reduce the severity of a potential threat in case it occurred.

Security risk assessments gather the numbers and the information organizations need to make better choices about how to protect people’s lives, facilities, and organizations.  I hope these events will prompt more Security Directors to take an objective and unbiased look at their own organizations, and the controls they have in place, before you end up on CNN!

 

Benghazi Hearing Demonstrates Attack Uncovered A Fatal Lack of Coordination & Funding for Embassy Security

Posted on by • 0 Comments

Just two weeks ago, we were talking about the lack of coordination between DHS agencies and known intelligence on the brothers responsible.

Now we have the Benghazi Senate hearings, and here is the same problem again – lack of coordination between different parts of the State Department, and with the Defense Department, AND with the CIA and the intelligence community.

Add to this, the appalling cuts in funding for diplomatic security, and a flawed process about what needs to be done about security and protection to our embassies around the world.

“In these tight budget times, the committee has had to make some tough choices to prioritize funding.”, said a GOP aide in The Hill article (GOP cuts to embassy security draw scrutiny), by Alexander Bolton on September 18, 2012.   In spite of the uncertainly of the Arab Spring, the demonstrations every Friday in streets from Bahrain to Tunesia, the embassies had their budgets cut.

Of course, security experts are used to this, security doesn’t directly generate revenue, and it is often one of the first functions on the chopping block.  However, to cut funding to the critical embassy functions in this volatile environment, is obviously a very bad decision on the part of the GOP.

For example, the security risk assessment which are routinely done on these embassies are not done on a systematic basis.  As a risk expert, these security risk assessments should be done WEEKLY, and they should be automated so they can instantly be compared to environments in other embassies, and comparisons made by month, by year, and trends can be tracked.

If we can’t afford to do these assessments and just as important, if we can’t afford to fix the problems that assessments reveal, then we should not have embassies in these places.

The security risk assessments that are done properly must also include complete threat assessments.  “We need to develop a paradigm for managing risk“, said Gregory Hicks, a Foreign Service Officer who testified today on Capitol Hill.

These paradigms for managing risk already exist and they have been totally ignored by the State Department, which makes it almost impossible to get a clear, unfiltered view of the security situation at any embassy, at any point in time.

At least both sides of the political aisle agree, we do not want this to happen again!  Benghazi is not a political problem, it is a massive security failure problem!

 

Tragedy at the Boston Marathon – What Went Wrong?

Posted on by • 0 Comments

Looking at the CNN footage of the Boston Marathon finish line yesterday, I was struck by the shock of the bystanders and the chaos that followed the blasts.

Having just giving two seminars on security controls, I pulled out my list to see what could possibly have been done differently to prevent this devastating outcome, and there was the first word on the list ACCESS CONTROL.

After thirty years as a security expert and risk-threat analyst, I am about 85% sure that this was a lone wolf attacker who made his crude bombs to address some personal perceived problem, whether it was fear of gun legislation, spillover from the Israeli-Palestinian conflict, the Neo Con torture initiative, or something else.

Putting the attacker aside for a moment, the tragedy happened because SOMEONE WAS ABLE TO WALK RIGHT UP TO THE FINISH LINE AND PUT AT LEAST 3 BOMBS right near the finish line!   THiS IS NOT RIGHT.

There has to be SCREENING and ACCESS CONTROL PROCEDURES IN PLACE!  You can’t have security if you have open access to a major event like the Boston Marathon.  For year, security experts have cautioned that large crowds make a great target, and so events have paid lip service to this concept, without staying on the task, and making sure that SECURITY CONTROL NUMBER ONE –  ACCESS CONTROL  is ALWAYS in place.

But people don’t like access control, it’s too much trouble, they say.  They don’t like metal detectors, too expensive, too much trouble, too intrusive.  Well, it’s not as intrusive as having a major injury.   There are ways to secure these high profile sites, but the security community has to lead on this.

Yes, it is very sad and depressing that the world has come to this — but it has.  And it will happen again.  As long as security is perceived as too much trouble, too expensive, too tough to do, and too intrusive, there will be more tragic events like this one.

 

 

Wondering Which Security Controls Offer the Highest Protection for Less Money?

Posted on by • 0 Comments

Security Controls can be incredibly cost effective or astronomically expensive.  And when you’re faced with a facility or a school campus, or a system that has to be secured, but you also have a budget to keep in mind – what do you do?

The simple answer is ROI – Return on Investment.  This simple calculation compares the Cost of the Proposed Control to the Protection is Provides and that creates the magic ROI Number.

Here’s an example:   A hospital near the New Jersey shore wants to create a new emergency ops center.  They have the space,
but it would cost about $250,000 to build it out.  Here’s what we look at – how often would they use an emergency ops center?

Threat data shows that they would need to use it about 3-6

Operations Center (OPS)
Operations Center (OPS)

times a year, including severe storms, thunderstorms and hurricanes.

(After Hurricane Sandy, the hospital was closed for two days because they were not able to resume service right away.  As a result, the hospital lost about $2,000,000 per day because it could not bill for any services, none could be provided.)  

So we take that lost $2,000,000 per day and say that if we could keep the facility open because we had a better operational center, we could easily save 2 days of revenue which is $4,000,000 for the 2 days, and if it cost us only $ 250,000, and saves us $ 4,000,000, that’s a Return on Investment of SIXTEEN to ONE, 16:1.

Say it saved us 3 days of revenue a year – that’s a ROI of TWENTY-FOUR to ONE, 24:1!

You can get more info by writing to me directly at caroline@riskandsecurityllc.com and requesting a webinar invitation,
or a copy of the video.

 

New App does a Workplace Violence Baseline Assessment

Posted on by • 0 Comments

New Workplace Violence Prevention App helps companies do an OSHA Violence Baseline Assessment

DATELINE:    Boca Raton, Florida,  March 12, 2013

Workplace Violence in US companies is a problem that is getting worse.  Workplace violence is a serious recognized occupational hazard, ranking among the top four causes of death in workplaces during the past 15 years. More than 3,000 people died from workplace homicide between 2006 and 2010, according to the Bureau of Labor Statistics (BLS). Additional BLS data indicate that an average of more than 15,000 nonfatal workplace injury cases was reported annually during this time.

The latest figures show that high-risk organizations like hospitals, behavioral health treatment, home health workers and late night retail establishments are at a dramatically increased risk for experiencing a violent incident at work.

OSHA, and over thirty state government regs recommend that companies do an annual Workplace Violence Basement Assessment, but these are time-consuming and difficult to manage.

To solve the problem,  Risk & Security LLC has released a new web-based app, Workplace Violence Risk-Pro©, which makes security directors into Risk Professionals!

OSHA standard 3148 (Guidelines for Preventing Workplace Violence for Health Care &

Social Service Workers)and the new OSHA Inspection Directive, Enforcement Procedures for Investigating or Inspecting Incidents of Workplace Violence, from September, 2011, are both included in the new, easy-to-use application.

The program has been tested on some of the largest organizations in the US, and runs on a laptop, PC or tablet, and even on a smartphone!.  Workplace Violence Risk-Pro©  is built to be affordable and simple to use.

The web 2.0 program, includes newly compiled, updated threat databases, and automated web-surveys  based on the exact OSHA Directives.

The new program gives human services and security professionals a quick and easy way to conduct a workplace violence baseline assessment that will pass an audit!

The Risk-Pro©  model has been used for easy software applications with the Department of Defense and over hundreds of organizations, hospitals, maritime organizatons, and local, state and federal government agencies.

About Risk & Security  LLC

Risk & Security  LLC is a security risk assessment and risk analysis company with over 30 years of combined expertise in security risk.  It specializes in consulting on risk assessment projects and global application development of risk solutions.  Risk & Security partners with security companies around the world to provide state-of-the-art security expertise to analyze risk and recommend cost-effective countermeasures.

The team of risk and security experts is led Caroline Ramsey-Hamilton, who has created more than 40 software programs, and conducted more than 200 specialized security risk assessments in a variety of environments, including companies in the United States and around the world, including in Abu Dhabi, Hong Kong, Japan, South Africa and Qatar.

How Chavez Ruined Venezuela, Up Close and Personal

Posted on by • 0 Comments

My risk assessment company was contacted in 1995 to come to Caracas and work on a variety of security risk projects for
3 of the major Venezuelan companies — PDVSA (Petroleum de Venezuela, south America), and the two gas utilities, Maravan and Lagovan.

Never had been to south America, and I was worried about security so I remember buying special security devices to take with me and then one Sunday I flew down to Miami and caught the plane for Caracas!

The first thing I noticed was that I was out by the pool, and there were men with machine guns on the roof of the Caracas Intercontinental Hotel!   Later, room service delivered 7 large books, as big as encyclopedias – they were a History of Venezuela, a History of the Venezuelan Oil Industry and a few more.  I guess I was supposed to read them all by Monday.

That was the beginning of a long relationship with the people at PDVSA, many of whom became friends for life.  So I saw the downward spiral up close and personal.  First, the crime started to increase.  Places I had felt safe before, like the public square where the old men played chess at night.  Then one of the women I knew was pistol-whipped at her beach house.

Slowly, Chavez replaced the business people on the corporate Boards, and the staff, of these cash-cow companies with uneducated people with no business experience.   In a real world replay of Ayn Rand’s ATLAS SHRUGGED, these people didn’t care about maintenance, infrastructure, or security, they were the looters who wanted a total redistribution of wealth, without realizing the companies had to actually PRODUCE something to keep that cash flowing.

Within five years, as I continued to go down to Caracas, everyone I knew had left and many moved to other companies.  One married and moved to Spain, several went into other petroleum operations in the US.   An entire industry had been ruined by Chavez and his lack of understanding, or care, of the one income-producing business in Venezuela.

The currency was so devalued that I still have a six inch stack of Bolivars, the paper currency that was worth less than a few pennies apiece.

So it really is possible for one person to totally ruin a country’s economy and main industry, putting his ego and his desire for fame and power to ruin an entire country.

Fate has intervened to give Venezuela another chance – I hope they run with it.

 

 

Will the Risk of the Sequester Affect Security Budgets in 2013?

Posted on by • 0 Comments

Every time the TV is on, every anchor is crying about the dreaded Sequester.

Will it have an impact on security budgets?  I have seen security budgets, especially for the facilities security departments, swing from almost unlimited budgets after 2001, to bare bones in 2009 and 2010, and thought they were trending back up for 2013.

Now, with the uncertainty about what a Sequester  actually is, (please note my use of the capital “S”), how will it affect our security departments?

Obviously, the most obvious casualty are the government contractors who’s contracts may be arbitrarily cut, and civilian managers of federal programs will see lost days and furloughs.

The trickle-down effect will probably extend to state, county and municipal governments, too.   So that means it’s even more important to start budgeting new security controls so that the most important get the funding!

One of the themes we go over in our webinar programs is how important it is to create a COST JUSTIFICATION and Return on Investment information so that you can create a business case for every control you need to improve security.

And one more thought on the Sequester – we often see an increase in crime, white collar crime and fraud when things are unsettled and people aren’t sure what’s going to happen next.

Maybe it’s a good time to do another risk assessment?  Maybe the Sequester is the next new Threat!