Avoid Becoming a Victim of Dark Web Breaches

Dark Web BreachesThe Organizational Assessment is one simple step to avoid becoming a victim of dark web breaches.

There’s no secret that the Dark Web is a scary place to lose your information. Medical records information sell anywhere from $1-$1000 by identity thieves! So, what if it affected your entire company?

 

What is a “breach” and where has the data come from?
A “breach” is an incident where data is inadvertently exposed in a vulnerable system, usually due to insufficient access controls or security weaknesses in the software. Data breaches are becoming more common and sometimes out of your control.

You  can protect yourself and/or your organization by:

  1. Carefully monitoring where you store and enter your passwords can be extremely beneficial to help minimize the risk of a hack and keeping personal or patient information protected
  2. Routine password changes and monitoring where you store and enter your passwords can be extremely beneficial to help reduce the risk of becoming a victim to a hacker. Passwords should be long, unique in characters, capitalization, and alphanumerical

 

If you believe sensitive information about your organization was compromised, report it to the appropriate people within the organization, including network administrators, so they can be alert for any suspicious or unusual activity.

The web browser, Firefox, has a “Monitor” that will warn you by saying, “Your password is your first line of defense against hackers and unauthorized access to your accounts. The strength of your passwords directly impacts your online security.”

EZClaim’s partner, Live Compliance, can help. They aggregate breaches and enable you to assess where your personal data has been exposed. Dark Web scanning is built right into the Live Compliance portal, which allows a company to keep an eye on employees whose information was involved in a breach (and where the breach took place), and the suggested next steps to take.

 

What can I do to ensure this doesn’t happen to me or my organization?

Live Compliance can make checking off your compliance requirements extremely simple. It provides:

  • Reliable and effective compliance
  • Completely online, our role-based courses make training easy for remote or in-office employees
  • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required, but is a useful tool to expose potential vulnerabilities, including those such as password protection.
  • Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out of the office, all updated in real-time
  • Electronic, prepared document sending and signing to employees and business associates

 

So, don’t risk your company’s future on dark web breaches. Contact one of EZClaim’s partners, Live Compliance, especially since they are offering a FREE Organization Assessment to help determine your company’s status. E-mail them, visit their website at LiveCompliance.com , or call them at 980.999.1585.

For more information about EZClaim’s medical billing softwaree-mail, visit their website, or contact them at 877.650.0904.

[ Article contributed by Jim Johnson of Live Compliance ]

HIPAA Compliance Reminder: Windows 7 End of Life

Windows 7 End of LifeAs 2020 comes to an end, the last thing on anyone’s mind is what operating system is installed on their computers. However, many are unaware that Windows 7 end of life happened over 10 months ago, and according to Microsoft, “If you are still using Windows 7, your PC may become more vulnerable to security risks.

When an operating system reaches the end of its lifecycle, servicing and support is no longer available for the product. This means, Microsoft no longer releases important security updates or technical support for any issues! In addition to that, the antivirus software, “Microsoft Security Essentials,” is also unavailable, and they are warning that, “Windows 7 users will be at greater risk for viruses and malware.”

As a result, possibilities of exploitation of private and sensitive data and information is increased, which makes it even more easily accessible to lurking hackers. The Windows 10 update is a safer solution for the common user, but there are still some steps that both Covered Entities and Business Associates should take in order to remain in compliance with privacy settings and HIPAA Rules and Regulations after making the upgrade.

 

One of EZClaim’s partners, Live Compliance, is an expert in determining compliance, and have offered to help. In addition to upgrading your machine to the latest version, the Live Compliance  team of HIPAA and HITECH experts will also ensure that your computer meets all other important compliance requirements, and is safe from other common vulnerabilities.

So, if you have questions regarding your organization’s compliance, Windows 7 end of life, or even assistance in setting up Windows 10, contact Live Compliance at 980.999.1585, or e-mail Jim Johnson.

[ Article contributed by Jim Johnson of Live Compliance ]

———————————-

ABOUT EZCLAIM:
EZClaim is a medical billing and scheduling software company that provides a best-in-class product, with correspondingly exceptional service and support, and can help improve medical billing revenues. To learn more, visit their website, e-mail them at sales@ezclaim.com, or call a representative today at 877.650.0904.

Noncompliance of HIPAA Security Rules Has Huge Consequences

HIPAA security rulesThe noncompliance of HIPAA security rules has had huge consequences for an IT and health information management company.

CHSPSC LLC, (“CHSPSC”) has agreed to pay over $2 million to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS), for the breach of Protected Health Information (PHI). The Business Associate was notified by the Federal Bureau of Investigation (FBI) that it had traced a cyber-hacking group’s advanced persistent threat into CHSPSC’s information system.

After OCR ‘s investigation, it was found that CHSPSC had “longstanding, systemic noncompliance with the HIPAA Security Rule including failure to conduct a risk analysis, and failures to implement information system activity review, security incident procedures, and access controls.” The large health system provided various Business Associate services, including IT and health information management, to hospitals and physician clinics. These violations could have easily been avoided! OCR Director Roger Severino said, “The healthcare industry is a known target for hackers and cyber-thieves. The failure to implement the security protections required by the HIPAA Rules, especially after being notified by the FBI of a potential breach, is inexcusable.”

 

In addition to the monetary penalty, the Business Associate will be required to complete a “robust” Corrective Action Plan (CAP) with monitoring activity for at least the next two years. CHSPSC will also be required to do the following:

Implement technical policies and procedures to allow access only to those persons or software programs that have been granted access rights to information systems maintained
Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports
Conduct accurate and thorough assessments of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI

All this shows that ANYONE can face HUGE penalties, and they would most likely bankrupt a small billing company or an independent physician practice.

 

So, based on this specific example, it is VERY important to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, a billing company, or other vendor, suspect a breach, you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action.

Keep in mind, a Business Associate is a ‘person’ or ‘entity’. This means that ALL billing companies—large or small—need to comply with the Federal HIPAA security rules and regulations. So, if your company has not completed an accurate and thorough security risk assessment, there is a possibility that you could be penalized under ‘willful neglect’. (This category alone gas a fine of $50,000 per violation!)

 

So then, what can be done to ensure this doesn’t happen to my billing company or my organization? Well, one of EZClaim’s partners, Live Compliance, can make determining your compliance requirements extremely simple:

Completely online, Life Compliance’s role-based courses make training easy for remote or in-office employees
Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
Policies and procedures are curated to fit your organization, ensuring employees are updated on all workstation use and security safeguards in or out of the office. Update is in real time.
Electronic, prepared document sending and signing to employees and business associates

 

So, don’t risk your company’s future, especially when Life Compliance is offering a FREE Organization Assessment to help determine your company’s status. Either call Life Compliance at 980.999.1585, visit LiveCompliance.com to schedule an assessment, or e-mail Jim Johnson.

[ Article contributed by Jim Johnson of Live Compliance ]

———————————-

ABOUT EZCLAIM:
EZClaim is a medical billing and scheduling software company that provides a best-in-class product, with correspondingly exceptional service and support, and can help improve medical billing revenues. To learn more, visit their website, e-mail them at sales@ezclaim.com, or call a representative today at 877.650.0904.

Failing to Implement HIPAA Causes Large Fine

Failing to ImplementFailing to implement HIPAA causes a large fine for a small town North Carolina health services provider. They were fined $25,000 for multiple, easily avoidable, HIPAA violations for “longstanding, systemic noncompliance” with the HIPAA Security Rule. [Note: The provider is a part of a health center which offers discounted medical services to the underserved population in rural NC, and the fines were reduced in consideration of this, but it still resulted in a significant monetary loss].

In 2011, Metropolitan Community Health Services (Metro), doing business as Agape Health Services, filed a breach report regarding “the impermissible disclosure of protected health information to an unknown email account.” The breach affected over 1,200 patients!

In addition to the large monetary penalty, the practice is required to develop and adopt a corrective action plan (which includes two years of thorough monitoring) after the Office for Civil Rights (OCR) discovered that Metro failed to conduct a thorough and comprehensive HIPAA Security Risk Assessment and Analysis. In addition, Metro did not implement a single HIPAA Security Rule Policy and Procedure for the health center. Possibly worst of all, Metro failed to provide workforce members with HIPAA Privacy and Security Awareness training until 2016!

Patients must trust who they share their personal, private, and protected health information with. A breach such as this, is obviously devastating for the patient, in addition to their doctor’s reputation. So, how can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?

First off, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so  highlights any major flaws in a practice’s administrative and technical safeguards, and accentuates the policies and procedures that the practice needs to implement.

In addition to that, the designated HIPAA Privacy and Security Officer must ensure that ALL employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy Rule and actionable policies and procedures.

So, remember, healthcare organizations and their vendors have a responsibility to be HIPAA compliant, and that starts by performing, updating, or reviewing an accurate and thorough Security Risk Assessment covering your technical, administrative, and physical safeguards. This will help uncover any vulnerabilities, and help you understand what information is being transmitted, shared, and how it is being transmitted.

 

TAKE AWAYS AND THINGS TO CONSIDER:

  • Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
 Remediate any potential risks or vulnerabilities.
  • A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information (PHI)
  • Develop actionable policies and procedures that clearly outline disclosures of PHI
  • Ensure all employees have a clear understanding of the HIPAA Privacy rule and its policies and procedures

 

Live Compliance provides everything you need to become and maintain your organization’s HIPAA compliance requirements. All policies and procedures can be edited and shared directly with staff from your staff portal. Trainings are delivered and monitored within your portal, can be customized, role-based, and be accessed anytime and from anywhere. You can also easily send and monitor HIPAA training with one click.

Failing to implement HIPAA can cause tremendous problems and use precious resources and time to implement. Live Compliance makes it 10X easier than trying to do it on your own.

So, take advantage of Live Compliance’s FREE Organization Needs Assessment to understand your immediate compliance needs. For additional details, e-mail Jim Johnson (at jim@livecompliance.com), call (980) 999-1585, or visit their website at livecompliance.com/oa

Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.

[ Written by Jim Johnson, President of Live Compliance ]

New Compliance Regulations for Working at Home

Whether you and your workforce are back in the office, or still working from home, there are new compliance regulations, and your HIPAA Compliance program may be a bit different.

New Compliance RegulationsReliable and Effective Compliance

Completely online, our role-based courses make training easy for remote or in-office employees.

Contact-free and accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.

Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in or out of the office, and  updated in real time.

Electronic, prepared document sending and signing to employees and business associates.

Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status regarding the new compliance regulations. [ Click here to download a “HIPAA Compliance Requirements” document ].

Live Compliance is a partner of EZClaim, and you can contact them directly by either calling them at (980) 999-1585, e-mail Jim Johnson at Jim@LiveCompliance.com, or visit them at LiveCompliance.com

[ Written by Jim Johnson, President of Live Compliance ]

The PROS and CONS of Credit Card Collections

Credit Card CollectionsCredit card collections are a BIG part of any successful medical practice, and there has been a shift, in the last decade, that more insurance policies are adding co-pays with higher deductibles—which makes getting paid even more challenging.1 One industry report said that “73% of physicians shared that it typically takes at least one month to collect a payment, and 12% of their patients wait more than three months to pay.”2 With the current trend, more medical practices and their billing departments (or outsourced billing firms) are going the route of processing payment via credit cards, which has its PROS and CONS.

In light of this new information, the following are a few pros and cons for credit card processing that we anticipate in the near future, and some insights for choosing the best billing software that supports the credit card processing needs of medical practices:

  • PRO: To protect against the dangers of stolen data, fraud, or other compromises in security, practices should seek out medical billing software that has credit card processing built-in, which can help safeguard against these dangers.
  • CON: Security is a big risk, and a leak in data leading to stolen funds can end up in a physician paying out-of-pocket for the breach. It is also important to note that breach of credit card data is also considered a violation under the federal Health Insurance Portability and Accountability Act (HIPAA). 
  • PRO: Implementing credit card processing will reduce long waiting periods for payments from the majority of your patients, and will also reduce the additional effort your billing staff has to extend to collect on overdue notices.
  •  CON: Practices cannot require patients to share their credit card information to receive medical care, and even if patients do share their credit card information, physicians cannot continue to charge the credit card without a patient’s consent.
  • PRO: Physicians can end the process of being a “line of credit” to unpaid or underpaid claims, and collect on funds immediately.
  • CON: You will need to implement internal processes that include, but are not limited to proper personal information storage and security, establishing guidelines on maximum percentages charged per bill, and personal consent forms.

Overall, there are definitely MORE ‘PROS’ than cons for implementing credit card processing for your medical practice, and all the trends are pointing to this being the PREFERRED METHOD of payment in the near future.  EZClaim is proud to announce that it will release an integrated credit card processing solution, EZClaimPay, that is backed by a national merchant services vendor.  [ EZClaim will be sharing more details about EZClaimPay in the weeks to come, via their social media platforms, their monthly newsletter, direct communications, and more ]. 

 

In addition to the credit card  collections PROS and CONS above, we reached out to one of our partners, Live Compliance, to gather some regulatory and security advice. They suggested the following:

  • When accessing, transmitting, storing, or receiving any Protected Health Information (PHI), Health and Human Services (HHS) Office of Civil Rights (OCR) mandates that you are to maintain HIPAA compliance. 
  • When accepting, processing, or maintaining credit card information and debit card information, you must ensure that your organization is PCI DSS compliant (Payment Card Industry Data Security Standard).
  • In addition to the above Federal regulatory requirements, most states require privacy and security compliance requirements to be implemented, along with strict adherence to the privacy of Personally Identifiable Information (PII) and Breach Notification requirements.

For more information on your compliance requirements, visit Live Compliance for a Free Organization Assessment to identify and uncover your organization’s vulnerabilities.

 

If you are not a current customer of EZClaim, we would very much like to connect with you.  You can either schedule a one-on-one consultation with our sales team, view a recorded demo, or download a FREE 30-day trial right now. For detailed product features or general information about EZClaim, visit our website at ezclaim.com.

 

[ NOTE: If you would like a quote on the upcoming merchant services, please e-mail sales@ezclaim.com your last three merchant statements.  For more on our ongoing updates and industry news, you can follow EZClaim on Facebook and LinkedIn ].

Source Material:
1 – America’s Health Insurance Plans” report that there were 20.2 million co-pays in 2017, which was up tremendously from just over 1 million in 2005.
2 – Source: From InstaMed’s annual “Trends in Healthcare Payments” report.

> For more on this topic, read a previous article, Why Do I Have A Balance? – Patient Payments”