HIPAA Audits Are Coming To Dental Practices

Starting in February of 2016, the Office of Civil Rights (a division of the US Department of Health and Human Services) began phase 2 of the HIPAA audit program. What does this mean for dental practitioners and other health service providers? What does a health service provider need to do to be prepared for an audit? And what happens if a provider isn’t prepared?

Let’s start with a little bit of history on HIPAA audits. In 2011 the OCR began Phase 1 of the HIPAA audit program. They selected 115 covered entities to audit for HIPAA compliance. A covered entity is defined as: health plan providers, health care clearinghouses, and health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. At the time, they weren’t worried about Business Associates or other tangentially related businesses. These audits were very targeted and didn’t affect most health practitioners.

Microsoft Word - Address Verification Email.docxFast forward to 2016 and the OCR has begun Phase 2 of this audit program. Instead of targeting just 115 providers, they are now compiling a comprehensive list of all medical service providers in the United States and will be reaching out to each provider via phone, mail, or email. Click here to view a sample contact letter. Once they add you to their list, they will make contact to find out who your HIPAA compliance officer is and ask for your HIPAA compliance documentation. They will expect you to have comprehensive documentation that generally adds up to somewhere between 50 and 150 (sometimes more) pages of legal documents, policies, training records, and other documentation.

You should already have a binder that contains all of this documentation ready to go. Part of being HIPAA compliant is being able to prove that you are HIPAA compliant. When performing HIPAA risk assessments for our clients, we generally find HIPAA documentation to be lacking or non-existent. If you don’t already have a HIPAA compliance binder, start one today. You’ll need copies of all of your policies surrounding HIPAA, records of employee HIPAA trainings, results of recent and regular internal HIPAA audits, and other documentation. If you don’t know where to start, contact J.J. Micro at 636-556-0009. With our PracticeProtect™ offering, we will help you every step of the way towards full compliance and documentation.

What happens if you are contacted and you aren’t ready for an audit? The OCR will give you 10 business days to respond with your documentation. If they don’t receive your documentation within 10 days, they will schedule a site audit. During a site audit, they will still want to see all of your documentation, but they will also want to interview your employees and look for any potential breeches or lack of documentation. From there, they will begin levying fines based on the severity of potential breeches. Benign issues could be $100 per issue, serious issues can be up to $50,000 per issue.

On average it takes somewhere between three and six months for one of our clients to go through the process of becoming HIPAA compliant. Do not wait until you are contacted by the OCR to begin the process. 10 business days is not enough time to gather all of the information, come up with your own policies, document everything, and provide the proper training for all of your employees. Get started now with PracticeProtect™!

Posted in Business, Dental, HIPAA Tagged with: ,

HIPAA Compliance For Dental Office Managers

J.J. Micro works with a variety of dental practices in the Saint Louis area. We offer a HIPAA compliance as a service package called PracticeProtect™ that brings practices into HIPAA compliance and provides the IT support that all 21st century practices are in need of.

When we first started working with dental practices, we focused all of our HIPAA compliance remediation on the technology side of the business. We were mostly concerned with preventing breaches caused by improper security protocols, lack of encryption, and unsecured networks. But as we started becoming HIPAA certified ourselves, we realized that we were missing about half of the HIPAA compliance equation: the administrative side of HIPAA.

While performing internal HIPAA audits for our clients, we have found that many practices are missing some of the most basic requirements of HIPAA. Things like simple documentation, annual employee HIPAA trainings and refreshers, and many practices even lack a designated HIPAA compliance officer. This led us to design PracticeProtect™ around these failures so that we could offer a solution that automates many of these requirements so doctors and practice managers can focus on providing the best care for their patients.

The purpose of this article is to go over some of the most commonly missed items so that as a practice manager, you can know whether you are HIPAA compliant or not. With the OCR scheduling surprise audits starting in 2016, all covered entities (like dental practices) are at risk of hefty fines if they can’t prove they are HIPAA compliant. Let’s go over some of these commonly missed compliance gaps so that you can work on a plan to become compliant yourself.

HIPAA Documentation Binders

The most commonly missed and arguably most important item to have in an audit is documentation. If an auditor calls, emails, or shows up at your office, the first thing they will ask you for is your HIPAA binder. They will want to see that you are documenting everything from your privacy statement for patients to your record of when each employee last took their HIPAA refresher training. If you don’t already have a HIPAA binder, you should start one today. If an OCR auditor asks you for your HIPAA binder and you don’t have one, they are much more likely to do a full audit and start handing out fines. A thorough HIPAA binder will likely be about 25 to 75 pages and will be updated regularly.

Annual HIPAA Training for your Employees

Many practices do take the time to do occasional HIPAA trainings for their employees. However, we find that it’s not unusual for there to be long lapses in between trainings. HIPAA compliance laws require regular documented training of existing employees and initial training for any new employee. Most experts agree that even though there is no set time limit for regular training intervals, one year between each training should be the maximum. In addition to ensuring these trainings take place, you will need a signed document from each employee each time they take the training so that you can prove to an auditor that each employee understands what is required of them in regards to HIPAA compliance.

BAAs (Business Associate Agreements)

If you do business with any outside vendor that comes into contact or potentially comes into contact with PHI (protected health information), you will need a BAA signed and on file with each vendor. A BAA holds vendors accountable to properly handling your PHI to prevent breaches or losses. Examples of vendors that would require a BAA are IT service providers, insurance billing providers, document shredding handlers, contractors, accounting services, outside janitorial crews, online data backup services, cloud server providers, and email encryption services. Every BAA should be on file in your HIPAA binder and will need to be reviewed annually to ensure that new HIPAA laws aren’t being ignored.

Designated HIPAA Compliance Officer

HIPAA standards require that your practice nominate a HIPAA compliance officer. It is this person’s duty to ensure that the practice is following HIPAA compliance laws in all areas. This person will keep the HIPAA binder up to date, ensure employees are taking their trainings, and be a general watchdog to ensure that employees are handling PHI with care. Most commonly this responsibility falls on the practice manager. If the OCR contacts your practice about a HIPAA audit, lack of a HIPAA compliance officer will be a big red flag.

Regular HIPAA Security Reviews

HIPAA laws require that your practice regularly perform a self audit to address any new gaps that may have opened regarding your HIPAA compliance. Again, most experts agree that regularly in this case refers to yearly. In addition to doing a full internal HIPAA audit yearly, you must document your findings and document any remediation steps you took. This should all be in your HIPAA binder. If the OCR asks for your HIPAA documentation and doesn’t find any information about an internal audit in the last 12 months, that is another big red flag.

Record Retention and Disaster Recovery Plan

An important and often overlooked aspect of HIPAA compliance is record retention and disaster recovery. The state of Missouri requires your practice to keep patient medical records on file for 7 years. If you were to lose any of those medical records during that 7 year period, it would be considered a breach and you would be subject to fines of up to $50,000 per record lost. For this reason, it’s important to have a good backup plan and a documented disaster recovery plan. Do you have a document that outlines what exactly will take place if your building was lost in a flood, tornado, or fire? An auditor from the OCR will want to see that you have a documented step-by-step plan to recover all patient records from an off-site backup.

PracticeProtect™

Time and time again we have found that doctors, dentists, practice managers, and other staff just don’t have enough hours in the day to stay focused on HIPAA compliance. With PracticeProtect™ we automate as many of the steps as we can. You will still need to understand HIPAA compliance and follow security standards to ensure PHI is safe. But employee training, writing BAAs and reviewing them annually, designing privacy forms for your patients, sending patient records over the internet using encryption, performing security audits, and all of the hundreds of other small details will be available to you in a simple and easy to use web platform. J.J. Micro will design a customized compliance plan for your practice and help you follow that plan to maintain compliance. With PracticeProtect™ you can know that even when a new HIPAA law is passed or when HIPAA rules are changed, your plan will be updated accordingly. You will no longer have to worry about a surprise HIPAA audit. When they ask for your HIPAA binder you can hand it to them and smile knowing there won’t be any issues.

Give J.J. Micro a call today at 636-556-0009 to schedule your free, no strings attached, HIPAA compliance check. We can help you decide if you are compliant or if you need PracticeProtect™.

Click here to learn more about PracticeProtect™.

Posted in Business, Dental, HIPAA, Uncategorized Tagged with:

The Real Cost of Downtime

Everybody knows that when your IT infrastructure goes down it can cost your business money. But have you taken the time to truly quantify the cost of downtime for your business? At first it can seem daunting to put a real price on an hour or day of downtime. However, if you know how much your business brings in on a yearly basis and how many employees you have and their average wage, we can do some simple calculations to find a per hour or per day downtime cost estimate.

As an example, if your company does $1,000,000 in revenue per year with 10 employees making on average $20 per hour, you have a potential downtime cost of $681 per hour and $5,446 per day.

Does your company have a backup and disaster recovery (BDR) plan to mitigate downtime? If not, it is imperative to design a plan that fits your needs. The average cost of one day of downtime is more expensive than many BDR solutions for the company described above.

At J.J. Micro we offer many BDR solutions ranging from simple cloud backups to fully fledged high availability clusters with active failover to the cloud. We can design a solution for you that takes into account your recovery point objective and recovery time objective.

The recovery point objective is how often you need your data to be backed up and how many copies of the data you want to keep. For instance, if you have mission critical data that changes hourly and you want to keep each change for a week, you need a backup that runs hourly and keeps 168 copies of the changes.

The recovery time objective is how quickly you want to be able to recover from a disaster or data loss. In a company where a few hours of downtime is acceptable, a simple image based backup might be perfect for you. But if your business needs constant uptime, you should heavily consider live replication to the cloud with automatic failover in the case of an outage.

Call J.J. Micro today at 636-556-0009 to schedule a free Backup and Disaster Recovery consultation. We will work with you to eliminate downtime and keep revenue flowing.

Posted in Business, Cloud, Data Backup, Productivity Tagged with: ,

AFCOM Data Center World 2016

Brian Mitchell at AFCOM Data Center World in Las Vegas

Brian Mitchell at AFCOM Data Center World in Las Vegas

A huge push towards cloud services means major investment in data centers. Our own Brian Mitchell visited AFCOM Data Center World 2016 in Las Vegas to find out where the industry is headed and how we can leverage our data center investments to better provide cloud services.

This is how AFCOM’s website describes Data Center World:

The speed of change is outpacing traditional infrastructure systems, legacy processes and mainframe mindsets. Legacy applications and current speeds for deployment can’t support the growing performance demands on digital enterprises. Data Center and IT Infrastructure professionals are facing increasing pressures from the C-suite to gain efficiency, add resiliency and become ever more agile – and with greater security! Are you prepared to tackle these challenges?

There were many new and improved data center solutions to see and hear about at AFCOM DCW this year. From racking and cabling solutions, to power and cooling solutions. Brian noticed two main themes that would apply to our clientele:

Many vendors were focused on putting IT equipment in non-traditional spaces.

There were several vendors showing ways to mount servers, switches and patch panels in offices and small closets. There is a new Schneider rack that is intended to be used in office environments. It is soundproof and uses room cooling.

IMG_2699

This Schneider rack is soundproof and uses room cooling.

There is also a pull-down patch rack from Chatsworth that mounts in place of a ceiling tile. Patches can be made overhead and then tucked away out of sight.

IMG_2701

Chatsworth in ceiling patch panel enclosure

Hammond Mfg displayed two different styles of wall mounted racks. The more novel one mounts servers vertically so it is low profile against the wall.

IMG_2814

Hammond vertical wall mount for servers

Color coding power and data distribution

In redundant power systems, there is opportunity for errors during the original installation in which both PDUs are plugged into the same utility feed or server power supplies are plugged into the same PDU. This defeats the redundancy and drops the reliability significantly. It is also extremely difficult to diagnose and troubleshoot in a network of all black equipment/cords.

IMG_2700

Color coded PDU units

Vendors including Schneider Electric, Raritan, Server Technologies, Geist and Enlogic all showed color coded PDUs. A host of cord and cabling manufacturers also displayed their color capabilities. They all had anecdotes about customers requesting separate colors following lessons learned after a bad experience. Similar situations and stories came from fiber and connector manufacturers. For most, there is no obvious or industry accepted convention. There is a general trend of red and blue for the A and B power feeds, but even that is widely varied. One vendor described a customer specifying green and yellow because he was a Green Bay Packers fan. Whether you are building out your data center or looking for creative ways to place your equipment in-house, AFCOM DCW had a lot to offer this year.

Here are more pictures Brian took of the event.

Previous Image
Next Image

info heading

info content

Posted in Business, Cloud, Hardware, Server Tagged with: , ,

HIPAA Compliance for Dental Practices and Their Business Associates

HIPAA

HIPAA

For almost 20 years since the Health Insurance Portability and Accountability Act (HIPAA) came into existence, the health care industry has had to deal with increasingly complex layers of regulations. Dental practices are acutely affected by HIPAA, namely by the recently added rule that holds a dental practice responsible for the security procedures of any company or individual it does business with.

With the increasing complexity of regulation and the huge possible fines for noncompliance, many dental practices find that working with a third-party company that is already an expert on HIPAA compliance is the the best way to stay in compliance. Below I have given an overview of the issues, and shown why working with a company like J.J. Micro LLC IT Consulting can eliminate the fear of HIPAA compliance for your practice.

BASIC HIPAA REQUIREMENTS

The HIPAA Privacy Rule, effective since 2003, is probably familiar to most dentists. This rule gives patients various rights regarding their protected health information (PHI). These rights include the right to change what is in their records and to limit the sharing of these records. The HIPAA Security Rule, (2005), relates to a dental practices’s management of its patients’ electronic health records (EHRs) and mandates a set of ongoing, practice wide, security protocols. These protocols include staff education, regular risk audits, secure redundant backups, email encryption, and documentation of these protocols. An Enforcement Rule (2009) and a Breach Notification Rule (2010) added more requirements regarding when the media has to be alerted to a breach and what kinds of civil penalties can be levied. As stringent as these regulations are, they seem simple to follow when compared to the HIPAA Privacy and Security Omnibus Final Ruling from January of 2013.

YOU ARE NOW RESPONSIBLE FOR YOUR CONTRACTORS

The Omnibus Final Ruling strengthens and expands the regulations enacted previously. But it also adds another level of regulations that make a dental practice responsible for the security protocols of any outside entity it does business with. HIPAA calls these outside entities Business Associates. These are entities such as a collection agency, a document storage or disposal company, billing providers, and IT service providers. Every dental practice must keep on file a Business Associate Agreement (BAA) that outlines who is allowed to be in contact with protected health information (PHI) and what is allowed to be done with that information. If a dental practice were to give a 3rd party access to PHI without a BAA in place, the practice will be liable for any non-compliance penalties.

LET AN EXPERT HANDLE YOUR INFORMATION TECHNOLOGY HIPAA COMPLIANCE

You’re dedicated to providing the best possible care for your patients. This probably takes up the vast majority of your time. With an already busy work schedule, why spend time trying to be your own IT manager. As time goes on, privacy and security laws will only continue to become more complex. Let J.J. Micro LLC IT Consulting stay abreast of the changing state of HIPAA compliance regulations and leave you and your staff to what you do best, caring for patients. Contact J.J. Micro today to schedule a free HIPAA compliance checkup. We will help you develop a plan to become compliant and then keep you in compliance going forward.

For more specifics on the ways J.J. Micro will help you become HIPAA compliant, read our article on HIPAA compliance IT recommendations

And here is more information about HIPAA compliance from the American Dental Association. 

Posted in Business, Dental, HIPAA, Security Tagged with:

How To Block Windows 10 Upgrade in Domain Environments

Windows 10 Reservation Screen

Microsoft has released yet another update that attempts to force Windows 10 on users of older Microsoft operating systems. This time is different though. Up until now, domain connected PCs running Windows Vista, 7, or 8 Professional were unaffected. We have found that this update is affecting those previously unaffected computers.

Windows 10 Reservation Screen

At this point, we know that PCs running Windows 7 Enterprise are unaffected as there is no free update to Windows 10 offered for that sku. But most of our clients are running Windows 7 Pro and might be affected.

Luckily there is a fairly easy way to prevent the new Get Windows 10 icon in the taskbar from displaying. A simple GPO can be pushed to your domain connected PCs. Here’s how to do that.

Open Group Policy Management

Right-click on the organizational unit that you want to apply this GPO to and select “Create a GPO in this domain and Link it here”

Enter a name for this GPO like “Prevent Windows 10 Upgrade Icon” and select “None” for source starter GPO. Then click “Ok”.

Right-click on the new GPO you just created and select “Edit”.

In the left pane drill down through Computer Configuration -> Preferences -> Windows Settings -> Registry

In the right pane, right-click and choose “New Registry Item”.

Select Action Update, Hive HKEY_LOCAL_MACHINE, and key path SOFTWARE\Policies\Microsoft\Windows\GWX

Under value name leave the box marked default unchecked. Then enter DisableGWX as the value name.DisableGWX Properties

Set Value type to REG_DWORD and enter the value 1 (decimal).

It should look like this:

Close the Group Policy Management Editor window and return to the Group Policy Management Window.

The GPO is now ready to be pushed to the domain connected PCs. You can either force an update on each PC by running gpupdate/force from the command prompt or you can wait for the GPO to apply on its own over the next day or two.

Posted in Business, Uncategorized, Windows, Windows 10, Windows Update Tagged with: , ,

Troubleshooting CrashPlan Backup Completion Issues

CrashPlan Pro

When using CrashPlan Home or CrashPlan Pro for online data backup, you may notice that your backup never fully completes. You may get a status email that says 99.9% or 100% completed with last completion date weeks or months in the past. You may start wondering why Crashplan never catches up and finishes the backup. Here is an example of what I see in my CrashPlan log emails sometimes.

CrashPlan Email Log

CrashPlan Email Log

In my experience, it’s not that your internet is too slow or that you have too many files that need to be backed up again every day. It’s that Crashplan is having trouble accessing a specific file or folder that has been selected for backup.

There is an easy way to find out which files or folders CrashPlan doesn’t have access to.

Open the C:\ProgramData\CrashPlan\log folder.

Inside you will find a file called backup_files.log.0

Copy that file to a different location (you can’t open this file if it’s in use by CrashPlan).

Then double click on the file to open it and choose Notepad to open it with.

The file will look similar to this:

I 01/25/16 10:10PM 42 d2e9eefef5bf7e096dee6be94f3d5ca7 0 C:/Users/. . .
I 01/25/16 10:10PM 42 c8dc77dba0da3454dc8b5c9009e65e93 0 C:/Users/. . .
I 01/25/16 10:10PM 42 83ce8fff98e976c2ff3be1d23cc9190b 0 C:/Users/. . .
I 01/25/16 10:10PM 42 0767af0e1471ec8d01502e8793ff8cbc 0 C:/Users/. . .
I 01/25/16 10:10PM 42 899644bd3322949766a4c9c7fb628864 0 C:/Users/. . .
I 01/25/16 10:10PM 42 af987dc3545e753c27f6331dc062241b 0 C:/Users/. . .
I 01/25/16 10:10PM 42 0e3938f366c7ff7509f622cc8746c72a 0 C:/Users/. . .
I 01/25/16 10:10PM 42 a64da407130b71be94afe9f87d20a329 0 C:/Users/. . .
I 01/25/16 10:10PM 42 [Default] Completed backup to CrashPlan Central in < 1 minute: 44 files (17.40MB) backed up, 388.10KB encrypted and sent @ 3Mbps
I 01/25/16 10:10PM 42 – Unable to backup 16 files (next attempt within 15 minutes)
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .
W 01/25/16 10:10PM 42 – C:\Users\. . .

Each line that starts with I is a file that was successfully backed up.

Each line that starts with W is a file that CrashPlan wasn’t able to back up.

You can use Control+F to search through the document for lines that start with W. I find that if you search for W plus the first two digits of the date you are looking for, you won’t get stuck on all of the files that have a W in their name. So try searching for this:

W 03/

The next step is to figure out why that particular file is locked. Sometimes the files are inside an encrypted folder. If you inadvertently turned on file encryption on that folder, you can disable it in Windows by right clicking on the folder, choosing properties, and clicking advanced. There you can uncheck “Encrypt contents to secure data”.

Sometimes the files are locked by whatever program uses them. If this is the case, maybe you don’t need to backup this particular file, so you can uncheck that file in Crashplan’s backup settings. By opening Crashplan and on the backup tab choosing “change”. From there you can uncheck specific files and folders from the backup.

If the file needs to be backed up, but is locked by the program that uses it, either CrashPlan has to wait until the program isn’t locking the file to try to back it up, or you will need to schedule a copy of the file to be made on a regular basis so CrashPlan can back it up.

If the problem file isn’t needed at all on your PC and you don’t want it to be backed up, you could just delete the file. But please be careful, you don’t always know if a file is important or not.

Posted in Business, Cloud, Data Backup, Uncategorized Tagged with:

.NET Framework 4.6.1 and Microsoft Exchange Incompatibility

.NET 4.6.1 is now a recommended update for Microsoft server operating systems.

If you are running any version of Exchange from 2007 to 2016, know that Microsoft says .NET 4.6.1 is not compatible. Here is the Exchange Supportability Matrix on Microsoft’s site.

We are specifically seeing reports of incompatibility between the new .NET Framework 4.6.1 update and Exchange 2013.

We have blocked this update on the servers we manage that run Exchange and Microsoft says you should do the same.

Blocking the update using a registry edit is fairly simple. Here’s how to do it:

  1. Back up the registry.
  2. Start Registry Editor. To do this, click Start, type regedit in the Start Search box, and then press Enter.
  3. Locate and click the following subkey:HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP
  4. After you select this subkey, point to New on the Edit menu, and then click Key.
  5. Type WU, and then press Enter.
  6. Right-click WU, point to New, and then click DWORD Value.
  7. Type BlockNetFramework461, and then press Enter.
  8. Right-click BlockNetFramework461, and then click Modify.
  9. In the Value data box, type 1, and then click OK.
  10. On the File menu, click Exit to exit Registry Editor.
Posted in Server, Windows Update Tagged with: , ,

IT Related HIPAA Compliance for Dental Practices

HIPAA

 

J.J. Micro LLC IT Consulting provides managed IT services to dental practices in the Greater St. Louis area. Working with dentists over the years has allowed us to become familiar with HIPPA compliance as it pertains to IT infrastructure. Below is some great information that could help your practice become compliant. If you would like a free HIPAA compliance consultation, please call or text message us at 636-556-0009 or email us at help@jjmicro.com. To view other services we provide, please visit www.jjmicro.com.

 

 

HIPAA Magnifying GlassAs a dental practitioner, when was the last time you thought about HIPAA compliance? Are you aware that rules regarding the storing and sharing of protected health information have been changing over the last decade? Do you have a plan in place to address the new laws the Omnibus final ruling in 2013 created? The new laws allow for a $50,000 fine per patient record breach with a maximum fine of $1.5 million per year. These hefty fines could bankrupt a smaller practice and the negative press from a data breach will affect any practice large or small.

HIPAA compliance can be overwhelming if you don’t already have a good plan in place. My experience working as an IT consultant for local dental practices in the Saint Louis, Missouri area has forced me to become familiar with HIPAA laws to be able to provide compliant solutions to my clients. Whether you have an existing HIPAA plan in place or not, I hope I can explain some areas of HIPAA compliance you had not previously considered.

HIPAA stands for the Health Insurance Portability and Accountability Act. As it pertains to technology, we are mainly concerned with the word accountability. Accountability in this context means many things. HIPAA requires that you control access to PHI (protected health information). You must provide proper electronic storage for your PHI. All physical storage spaces must be secure. You and your employees shouldn’t be sending PHI via standard email attachment. Any wired and wireless networks have to be secure. Your IT providers and other contractors must be HIPAA compliant. And finally, a large part of HIPAA compliance is having a written plan in place to address all of these subjects.

When I begin working on a HIPAA plan with a new client, I start with controlling access to PHI. Every employee of your practice must have a unique username and regularly changing password to login to their workstation. This way you have a log of who used which workstation and when they were accessing specific files. Your compliance plan should include a section on what happens when an employee is terminated: which user accounts need to be deleted, if keys and alarm codes need to be changed, and who needs to be notified in the case of a termination (i.e. your IT provider).  If an employee is terminated and all employees share the same login, it is difficult to prevent the former employee from accessing your systems. With unique usernames and passwords, it is easy to control access.

It is always a best practice for your users to lock their workstation any time they leave it unattended. However, people can be forgetful. To prevent unintended access to PHI, your workstations should be set to lock automatically after a period of inactivity. Additionally, on computer screens that are visible to people besides your employees, privacy filters should be installed. A privacy filter is a piece of polarized film that is applied to the monitor so that only a person directly in front of the monitor can see what is being displayed. Anyone viewing the monitor from an off-axis angle just sees a black screen. Many times a practice will have computer monitors in the front desk area that are clearly viewable by patients in the waiting room. If this is the case, a snooping patient could be seeing sensitive information. This would be considered a breach under HIPAA rules.

Proper storage of PHI is commonly an area I see go unaddressed with many of my new clients. PHI should always be encrypted wherever it is being stored. This may sound like an expensive proposition; but it generally doesn’t cost much to implement. All modern Windows Server operating systems have built in encryption software called BitLocker that can be enabled on whichever drives PHI is being stored. Encryption should be enabled on both a server’s internal hard drives and the external backup drives. Encryption also applies to any online or cloud backup software. Most online data backup providers do allow for encryption. But be sure to pick a provider that is HIPAA compliant and doesn’t store your encryption keys anywhere on their servers. Only you should have access to your encryption keys.

Many dental practices do not have a dedicated server room to store their server and backup drives. Some practices have a small closet with a locking door. While other providers place their server and backup drives right out in the open. It is not always practical to build a server closet or a server room in your office. In that case, it is important that your server is physically attached to something. If your office is broken into, you want it to be difficult for a thief to walk away with a server filled with PHI. A cable with a Kensington style lock works with most tower servers to physically attach them to something immovable. And if your server is rack mounted, make sure the server is bolted into the rack. If your external backup drives are encrypted, it is not as important to have them physically attached to something as the data stored on them is useless without the encryption keys. However, if you can’t encrypt them, they should be attached with a Kensington style lock as well. If your server and backup drives sit behind a locked door and are secure from potential thieves, pat yourself on the back; you are already a step ahead of many practices.

Sending PHI via email is something that HIPAA rules have made more difficult. The problem with most email systems is a lack of end to end encryption. If there isn’t encryption all the way from the sender to the intended recipient, PHI can be breached. If you are going to send a client’s PHI via email, you should make use of an encryption service like Virtru or Mail 2 Cloud. These services allow you to send PHI as a secure attachment to an email. The patient or medical provider that you are sending the email to has to create a username and password to download and view the secure attachment. This prevents the data from being intercepted during transmission and from being opened by an unintended recipient on the other end.

Many of my clients provide free WiFi to their patients. This is a great way to keep patients happy while they wait, but it can open a huge security hole if not implemented properly. It is important that both your internal and guest wireless networks are secured and encrypted. But beyond that, it is imperative that they are separated from each other. Internal and guest wireless networks shouldn’t communicate with each other at all. If you’re not sure if your WiFi networks are secure and segregated, you should contact an IT professional to have your networks inspected and secured.

Your wired network must be secured as well. This includes having a proper firewall to protect you from threats outside your network and limiting physical access to network ports inside your network. Business class firewalls can be properly configured to prevent intrusion. And you should never install a network port in an area where patients will be left unattended like your waiting room.

Many dental practices don’t ensure that their sub-contractors are following HIPAA compliance guidelines. To be HIPAA compliant, a practice must have a business associate contract on file with anyone who might have access to the practice’s protected health information. A business associate contract outlines how the business associate is allowed to handle PHI, how they will protect the PHI, and what they will do in the case of a PHI breach. When looking for an IT provider, you should ensure that the provider is familiar with HIPAA compliance laws and following all HIPAA rules when providing service for you. If an IT provider will not sign a HIPAA business associate contract, you should not work with them.

Once a dental practice has decided on a plan to address all areas of HIPAA compliance, that plan should be well documented and available to the US Department of Health and Human Services upon request. In addition, a single employee of the practice should be designated as the HIPAA compliance officer. It is the compliance officer’s job to make sure that all employees are aware of HIPAA rules and are following them. Having a written plan will allow the compliance officer to hold the entire practice accountable and work to prevent PHI breaches. For information on the other aspects of HIPAA that I didn’t cover, please visit the official HIPAA government website.

If after you read this article you can confidently say that you have addressed all of these concerns, I commend you. Many practices don’t have the time or energy to design or enforce a comprehensive HIPAA compliance plan. But a lack of time and energy is an excuse that will not fly with the US Department of Health and Human Services. If you haven’t started your HIPAA plan, you should schedule some time now to meet with your IT provider. You don’t want to be on the receiving end of a hefty fine or the bad press that will come when you are forced to list yourself on the HHS.gov breach list as a provider that has had a PHI breach.

J.J. Micro LLC IT Consulting will provide a free HIPAA consultation for your practice. Please give us a call at 636-556-0009 and ask about our HIPAA checklist.

Posted in Business, Cloud, Data Backup, Dental, HIPAA, Network Security, Security, Server, Uncategorized, Wifi Tagged with: , , ,

HDD vs SSD: Which Disk Technology is For You

HDD vs SSD

With solid state drive (SSD) pricing falling fast, more and more people are choosing SSDs over traditional spinning disks (HDDs). For many of my own clients, the slight increase in cost of an SSD over an HDD is well worth the extra benefits like reliability, power savings, and most importantly speed. But there are still some good reasons to choose a standard HDD over an SSD. I want to talk about the differences between the drive types and help you decide which is right for you.

How is an SSD different from an HDD?

Spinning Disk Drive

Traditional Spinning HDD

An HDD consists of one or more spinning magnetic platters with armatures that scan along the surface of the spinning platters to read and write data. An SSD differs in that there are no spinning platters. In fact, there are no moving parts at all. An SSD drive is mainly made up of microchips. There is a chip to control the drive and multiple memory chips to store data.

What are the benefits of a traditional HDD?

HDDs currently and for a while to come will have much higher capacities than SSDs. Your average HDD has a capacity between 1TB (terabyte) and 8TB. The average SSD drive has a capacity between 128GB (gigabytes) and 2TB. There are a few SSD drives with bigger capacities than 2TB but they are extremely expensive. So if you plan on storing a lot of data on your drive, you should consider sticking with a traditional HDD.

The average price per GB for a traditional HDD is roughly $0.07 to $0.15 as of today (1/9/2016).  The average price per GB for an SSD drive is about $0.30 to $0.60. So if price is the most important consideration, a traditional HDD will likely be the right choice.

What are the benefits of an SSD?

Solid State Drive

Solid State Drive (SSD)

Speed, speed, and more speed. Depending on the task, SSDs are 33% to 730% faster than a traditional HDD. Windows boot time is on average 160% faster for an SSD equipped system. 63 seconds for an HDD versus 23 seconds for the same system with an SSD drive. File copies can be up to 730% faster; just 42MB per second with an HDD compared to a whopping 307MB per second with an SSD.

With its lack of moving parts, an SSD drive is much more rugged than a spinning drive. This is especially important for road warriors who use their laptops in many different environments. Vibration and sudden movements are both terrible for spinning drives, reducing longevity and causing data loss. SSDs are unaffected by sudden movements and vibration. It’s very common for me to close my laptop lid and toss my laptop in my briefcase before Windows has a chance to put the laptop fully to sleep. With a spinning drive, this could cause data loss. With an SSD, I don’t have to worry at all.

SSDs are unaffected by fragmentation. For decades, we have had to regularly defragment our spinning disk drives. Because of their rotary recording surfaces, HDDs work best with larger files that are laid down in contiguous blocks. In this matter, the drive armature can begin and end its read in one continuous motion. When hard drives start to run out of space, larger files can become broken up and scattered around the disk platter. Thus the armature has to bounce around the surface of the spinning platter to find each piece of the file. SSD drives don’t have to wait for an armature to move to a specific position to read a file. All places on the SSD drive are equally quick to access at any time.

We’ve all been in a room with a noisy computer. There are usually two reasons why a computer is noisy, fans and traditional HDDs. SSD drives have no moving parts making them inherently quieter than their HDD counterparts. The usual ticking or vibrating noise from HDDs is eliminated in SSDs. SSDs also put out less heat than a spinning drive reducing cooling fan speed in most systems and resulting in less noise.

The lack of a constantly spinning platter reduces power consumption considerably in an SSD. In a laptop this results in increased battery life. I personally saw an increase from about 2 hours of battery life to over 3 hours in my 6 year old Macbook Pro. On modern systems with better higher capacity batteries, the difference can be even greater.

So which is right for you?

If your main consideration is either price or maximum storage space, an HDD is currently your best bet. However, if you’d prefer speed, ruggedness, better battery life, and less noise, SSDs are worth the extra cost.

Generally, the extra cost for an SSD only adds about 10% – 20% to the cost of a new laptop or desktop PC. The productivity gains alone will pay dividends on your initial investment.

Posted in Business, Hardware, Productivity Tagged with: ,