Clearwater Compliance @clearwatercompliance - Tumblr Blog

Cyber Contagions Knock Out Hospital Systems — Prompting Triaging of Cybersecurity to Code Red Status

https://clearwatercompliance.com/blog/cyber-contagions-knock-hospital-systems-prompting-triaging-cybersecurity-code-red-status/ Typically, when hospitals declare emergencies, it’s for incoming patients—not their own internal computer systems. But, in March 2016, Methodist Hospital in Henderson, Kentucky, declared an emergency. After being hit by a ransomware infection, the hospital placed a scrolling red alert on its homepage stating: “Methodist Hospital is currently working in an Internal State of Emergency Continue reading The post Cyber Contagions Knock Out Hospital Systems — Prompting Triaging of Cybersecurity to Code Red Status appeared first on Clearwater Compliance.

Exclusive Webinar for American Hospital Association (AHA) Members

https://clearwatercompliance.com/blog/exclusive-webinar-for-american-hospital-association-aha-members/ On July 27th, 2016, OCR HIPAA investigator will share insider’s view of Office for Civil Rights (OCR) Phase 2 Audit readiness OCR allows 10 days to respond to a Phase 2 audit request. Are there still gaps in your HIPAA compliance program? Similar to Phase 1, the Phase 2 audit protocol includes a comprehensive Continue reading The post Exclusive Webinar for American Hospital Association (AHA) Members appeared first on Clearwater Compliance.

Clearwater Compliance Prepares to Unveil a New Version of IRM|Pro™ Software Suite

https://clearwatercompliance.com/blog/clearwater-compliance-prepares-unveil-new-version-irmpro-software-suite/ Not Just Another Pretty Face! Within a few weeks, Clearwater will be unveiling new versions of our IRM|Analysis™, IRM|Security™, and IRM|Privacy™ software products designed with enhanced workflow and streamlined efficiency in mind. Clearwater customers currently using the software will appreciate a makeover clearly intended to demonstrate that our products have evolved to the point where Continue reading The post Clearwater Compliance Prepares to Unveil a New Version of IRM|Pro™ Software Suite appeared first on Clearwater Compliance.

Studies Show CEOs Unwilling to Take Responsibility for Cybersecurity

https://clearwatercompliance.com/blog/studies-show-some-ceos-unwilling-to-take-responsibility-for-cybersecurity/ Who’s Responsible for Cybersecurity? Industry Searches for Clear Answers We’re now living in what has been called the “era of the mega breach.” Globally, businesses are estimated to lose $445 billion annually due to cybercrime, according to the Center for Strategic and International Studies. What’s more, the overall threat landscape has evolved significantly with respect Continue reading The post Studies Show CEOs Unwilling to Take Responsibility for Cybersecurity appeared first on Clearwater Compliance.

Preview : A Simpler And Better Alternative To The HITRUST Mandate For Third Party Risk Management In Healthcare

https://clearwatercompliance.com/blog/preview-simpler-better-alternative-hitrust-mandate-third-party-risk-management-healthcare/ This guest post was written by: Kamal Govindaswamy CISSP, CIPP/US, CCSP Principal, RisknCompliance Consulting Group I have written my opinion about HITRUST CSF/RMF and the HITRUST certification mandate starting with my first open letter to the HITRUST Alliance last fall, and subsequently second and third letters. More recently, I have been thinking about Continue reading The post Preview : A Simpler And Better Alternative To The HITRUST Mandate For Third Party Risk Management In Healthcare appeared first on Clearwater Compliance.

Bipartisan House Bill To Create Separate Office Of The CISO

https://clearwatercompliance.com/blog/bipartisan-house-bill-create-separate-office-ciso/ A proposed bill to establish the Chief Information Security Officer (CISO) as an organizational peer to the Chief Information Officer (CIO) at the Department of Health and Human Services (HHS) will drive cybersecurity concerns to the top of the list. If the bill passes, the CISO would have clear separation of duties from the CIO Continue reading The post Bipartisan House Bill To Create Separate Office Of The CISO appeared first on Clearwater Compliance.

What to Know About OCR Pre-Audit Questionnaires

https://clearwatercompliance.com/blog/know-ocr-pre-audit-questionnaires/ The Office for Civil Rights (OCR) Phase 2 Audits are definitely underway. In the past five days alone, we have had more than a dozen organizations contact us letting us know that they have received a formal pre-audit questionnaire from OCR. OCR designed the pre-audit questionnaire as a way to build its pool of potential Continue reading The post What to Know About OCR Pre-Audit Questionnaires appeared first on Clearwater Compliance.

Health Care Entities “Not Vigilant” on Cybersecurity, Reports 2016 Ponemon Institute Study

https://clearwatercompliance.com/blog/health-care-entities-not-vigilant-cybersecurity-reports-2016-ponemon-institute-study/ $6.2 billion. That’s the new estimate of how much data breaches cost the health care industry annually, according to a new study by the Ponemon Institute. What’s more, despite the increased frequency of breaches, the study found that “many organizations lack the money and resources to manage data breaches caused by evolving cyber threats, preventable Continue reading The post Health Care Entities “Not Vigilant” on Cybersecurity, Reports 2016 Ponemon Institute Study appeared first on Clearwater Compliance.

Move Over Credit Cards — Stolen Medical Records Are Selling for Record Prices on the Dark Web

https://clearwatercompliance.com/blog/move-credit-cards-stolen-medical-records-selling-record-prices-dark-web/ It’s a sellers market for personally identifiable data on the “dark web,” where stolen information is anonymously bought and sold. Like all savvy businesspeople, hackers go where the money is; right now the hottest selling commodity is medical record data—going for as much as $60 per record.[1] To put that in context, in its heyday, Continue reading The post Move Over Credit Cards — Stolen Medical Records Are Selling for Record Prices on the Dark Web appeared first on Clearwater Compliance.

President Obama’s 2017 Fiscal Budget Proposal Prioritizes HIPAA Audits

https://clearwatercompliance.com/blog/president-obamas-2017-fiscal-budget-proposal-prioritizes-hipaa-audits/ President Obama’s administration submitted its budget proposal for fiscal 2017 earlier this year—indicating a clear funding prioritization of HIPAA compliance audits and other health care initiatives. According to the FY 2017 OCR Budget Brief, the increased budget would “modernize HIPAA protections, support innovation in healthcare, ensure adequate protections in new programs and technologies, streamline requirements Continue reading The post President Obama’s 2017 Fiscal Budget Proposal Prioritizes HIPAA Audits appeared first on Clearwater Compliance.

Engineering Compliance and Information Risk Management

https://clearwatercompliance.com/articles/engineering-compliance-information-risk-management/ In a recent article published by CIOReview, our CEO, Bob Chaput discusses how the cybersecurity industry is changing and what Clearwater can do to help your organization. Read the full article here. The post Engineering Compliance and Information Risk Management appeared first on Clearwater Compliance.

If Ransomware Is the Question, Then Information Risk Management Is the Answer

https://clearwatercompliance.com/articles/ransomware-question-information-risk-management-answer/ Ransomware is malicious software that compromises the availability of critical information. Unlike other hacking forms, ransomware does not compromise the confidentiality or integrity of the data, nor does it require the hackers to sell the information to a 3rd party in order to benefit from the proceeds. This article originally appear in the Compliance and Continue reading The post If Ransomware Is the Question, Then Information Risk Management Is the Answer appeared first on Clearwater Compliance.

Poor Cyber Risk Management Can Negatively Impact Your Credit Rating

https://clearwatercompliance.com/blog/poor-cyber-risk-management-can-negatively-impact-credit-rating/ Cyber breaches already impact an organization’s regulatory standing and reputation. Now breaches, along with poor cyber risk management, can impact an organization’s credit rating as well. Two financial services firms recently announced that they will now factor cyber risk into their credit rating evaluations. Both Moody’s Investors Service and Standard & Poor have reached a Continue reading The post Poor Cyber Risk Management Can Negatively Impact Your Credit Rating appeared first on Clearwater Compliance.

Clearwater Compliance Ranks in CIOReview’s Top 20 for Second Year in a Row

https://clearwatercompliance.com/awards/clearwater-compliance-ranks-top-20-second-consecutive-year/ Clearwater Compliance, a leading provider of healthcare compliance and cyber risk management solutions, today announced it has earned another spot on the “20 Most Promising Enterprise Security Companies 2016” list by CIOReview Magazine, for the second consecutive year. A technology magazine that focuses on enterprise solutions, CIOReview is a leading source for technology decision makers. The annual list, which CIOReview released this month, is based on a careful evaluation and selection process conducted by a panel of independent technology and industry experts. Clearwater Compliance was selected for the quality of solutions and expertise the company provides to the healthcare market and their service providers. CIOReview evaluated leading enterprise security companies on a wide range of parameters including execution, technology and market reach capabilities to rate maturity, experience and expertise. “We are thrilled to be recognized as a top-ranking enterprise security compa

FTC Reports Increased Commitment to Secure PII — and Enforcement

https://clearwatercompliance.com/blog/ftc-reports-increased-commitment-secure-pii-enforcement/ At a time when organizations are facing an increased number and intensity of cybersecurity risks, the Federal Trade Commission (FTC) is doubling down on its commitment to keep personally identifiable information (PII) secure. This was the clear message in the agency’s 2015 Privacy and Data Security Update, released on January 28th, 2016—which happened to be, appropriately, Data Privacy Day. The most recent annual report highlights the FTC’s consumer privacy actions taken and programs implemented last year, including its enforcement actions, public workshops, educational initiatives and international cooperation efforts. Its enforcement actions confirm that the agency is delivering on its promise to closely scrutinize companies’ data privacy and security policies, and execute enforcement when necessary. The agency stated that it remains committed to ensuring consumers are able to reap “the benefits of innovation in the marketplace, confident that their personal information—

HIPAA Risk Analysis Tip – The Biggest Risk Management Surprises in the 2016 OCR Audit Protocol

https://clearwatercompliance.com/hipaa-hitech-news/hipaa-and-it-security/hipaa-risk-analysis-tip-the-biggest-risk-management-surprises-in-the-2016-ocr-audit-protocol-2/ This entry is part 48 of 48 in the series HIPAA Security Risk Analysis TipsHIPAA Risk Analysis Tip – The Biggest Risk Management Surprises in the 2016 OCR Audit Protocol A quick look at the “Current Protocol” reveals greater coverage of the regulations and more in-depth inquiries and documentation review, but the details provide even bigger surprises. OCR isn’t kidding about the need for greater information security and formal risk management processes. What’s New in the Current Protocol To begin with, OCR didn’t even have an Audit Inquiry for Risk Management (§164.308(a)(1)(ii)(B)) in the 2012 Audit Protocol Well, now they do! Not only will the auditors be looking for policies and procedures for a risk management process, but also the details of how risk will be managed, by whom, how often and documentation of management’s acceptable level of risk. In addition, they will want evidence that security measures have been implemented as a result of that risk analysis and

Secure Your Physical Devices with a “Double-Bolt” Lock — Encryption Plus a Cybersecurity Framework

https://clearwatercompliance.com/blog/secure-physical-devices-double-bolt-lock-encryption-plus-cybersecurity-framework/ It happens more often than you might think: the loss of consumers’ personally identifiable data due to lost hardware. Due to headline-grabbing cyber breaches, we often forget about the very real problem of lost data on devices. Whether stolen or just missing in action, these types of data breaches are a regular occurrence—and a serious risk. For example, in January, Modern Healthcare reported that the health insurance company Centene Corp. was hunting for six computer hard drives containing the health records of nearly one million patients. The company said the hard drives were being used in a data project analyzing lab test results to improve members health outcomes. The PHI (personal health information) on the missing drives included individuals names, dates of birth, Social Security numbers, member ID numbers and unspecified “health information.” Centene is not the only company facing the problem of lost devices. Several studies have reported on the issue. For example, eSec

Trending Blogs

Recently Viewed Blogs

Clearwater Compliance