web-MINImag
- 1. You Can’t Manage What You Don’t Measure. TM Are your privacy & security rules HIPAA compliant? FIND OUT! SUMMER | FALL 2014 *Exclusive eLearning The Quay ModuleTM Random Audits for Compliance New OCR program www.fortisquay.com Benefits of FQ Reporting Functionality Insurance Premiums may reduce
- 2. The Healthcare Industry Faces Unique Information Governance Challenges. The management of sensitive patient data has increasingly become a concern for hospitals and medical practices as the introduction of new technologies has left these organizations vulnerable. The Ponemon Institute/Experian Data Breach Resolution Report examined how organizations in several industries, including healthcare, are working to prevent and respond to data breaches. The 2013 report found that, of those surveyed • 94% reported experiencing a data breach in the past two years • 39% said they had no data breach response plan in place • 30% said they had trained customer service staff to respond to data breach-related questions • 21% said they had trained communications teams to respond to questions about a data breach • 19% said they are equipped with appropriate tools to determine the size and cause of a data breach The mishandling of information by hospital employees and medical professionals leaves these organizations open to lawsuits, fines, brand damage, and data breach. Regulations like the Health Insurance Portability and Accountability Act of 1996 (HIPAA) have placed stringent standards on organizations to protect private patient information, and while the survey found that health care organizations have a clear understanding of the risks and potential consequences of data breaches, many are not taking adequate steps to protect themselves. IsYour Organization Compliant with the HIPAA Privacy and Security Rules? Beginning on September 23, 2013, The Department of Health and Human Services’ Office for Civil Rights (OCR) is expected to launch a national audit program. Covered Entities and their Business Associates may be randomly audited for HIPAA Compliance. * Are you ready? *Taken from HHS.com. Why Conduct a HIPAA Assessment now? Avoiding hefty fines and collecting federal incentives are major motivators for the healthcare industry to adopt electronic health record (EHR) systems that are in accordance with the Health Information Technology for Economic and Clinical Health (HITECH) Act. Now is the time to make sure your systems, processes, and procedures comply with the rules. Our HIPAA assessment consultants will ☑ Review your policies, processes, technology, facilities, hosting solutions and training programs for employees for compliance in accordance with the latest Office for Civil Rights (OCR - the governing body that enforces HIPAA violation penalties) HIPAA Audit Protocol. ☑ Apply the OCR’ guidelines to your organization’s environment. The OCR HIPAA Audit Protocol covers the HIPAA Security, Privacy, and Breach Notification Rules. ☑ Ensure that your organization, as a covered entity (CE), meets the standards and best practices of this protocol. 94% reported experiencing a data breach in the past two years THE FORTIS QUAY, INC. HEALTHCARE OFFERING 2014
- 3. / fȯr-təs kē / : Your safe harbor from the digital storm : Measureable results for better information management : Best practices for eRisk reduction and defensible eDiscovery : Remember, You Can’t Manage What You Don’t Measure™ The Quay eLearning Module™ The Quay eLearning Module™ will educate managers and employees regarding the best practices for legal hold compliance and will measure and address this level of understanding. Organizations looking to reduce risk of non-compliance and embrace employee participation in the management of data are well suited for this module. Reporting functionality within the module affords a level of transparency and allows the organization to further refine their policies, technology, and training as needed with empirical data. Another benefit of the reporting functionality is that organizations may realize a reduction in insurance premiums. Fortis Quay, Inc. will deliver reports to the client and can submit them on behalf of your organizations to demonstrate compliance. In the event an organization needs expert testimony with regard to the compliance training your organization has selected and completed, Fortis Quay Inc. can provide this service. Finally, the information delivered to an organization by Fortis Quay, Inc. from the reporting and accompanying analysis will inform larger strategy, purchasing, policy, workflow, and compliance decisions while decreasing information governance risk. HIPAA Assessment Deliverables 1. Written reviews of all policies relating to HIPAA P Security Rules P Privacy Rules P Breach Notification Rules P Employee Training 2. Confirmation that established procedures conform to documented policies including P Review which vendors have access to Personal Health Information (PHI) and verify that proper Business Associate agreements are in place P Evaluate encryption protocols for electronic PHI (ePHI) P Evaluate whether verification logs are maintained and current, including: • Data Backups • Disaster Recovery Plan Tests • Archives and Data Classification • HIPAA security training • Security Incident Report • Destruction/Disposal of Electronically Stored information • Data Loss Prevention • Social Media Usage P Determine whether hardware and software inventories are current; confirm that appropriate versions are installed P Workstations – Review policies governing what software can/must be run and how it should be configured on systems that provide access to ePHI. Determine the safeguards for all workstations providing access to ePHI and evaluate the restrictions on that access to authorized users. P Review procedures protecting against Malware P Review the procedures and monitoring of system log ins and password management P Review policy and procedures for terminating an electronic session after a period of inactivity P Verify procedures are followed for removing employee access upon termination P Confirm if Verification logs are maintained and current that support backups and disaster recovery plan testing as well as contingency plans for the restoration of lost data 3. Executive Summary, Assessment Report, and Remediation recommendations 4. If appropriate, Turnkey and customized eLearning compliance modules will be recommended to measure and certify that employee training has been satisfactorily completed THE FORTIS QUAY, INC. HEALTHCARE OFFERING 2014
- 4. Contact us today to: 1. Engage in an eDiscovery Assessment, Business Associate Agreement, and HIPAA Assessment 2. Develop custom compliance training modules to reduce risk for employees in your organization by creating best practices policies for • Mobile Devices • Social Media • Privacy • Litigation Hold • Communication and Email Etiquette (877) 463-QUAY Fortis Quay, Inc. 530 W. Ojai Avenue, Suite 208 Ojai, California 93023 www.FortisQuay.com LEGAL OR LITIGATION HOLD is an indispensable concept in today’s digital world. In the United States, and for companies that are transacting business with the United States, there is a common law rule to preserve information once the “reasonable anticipation of litigation” is triggered. Many other jurisdictions also have the requirement to preserve data for litigation. Many times this trigger point is only clear in hindsight, which is why the proactive management of information and an established workflow within an organization are paramount for compliance with legal hold. Due to the disparate amount of data sources in an organization, and the unstructured nature of many of them, employee understanding and cooperation are necessary. While each organization may have different technology, methods of disseminating a legal hold notice, and resources, there are some key requirements that can be learned and abided by to reduce the risk of spoliation. E M P L O Y E E S THE LARGEST ROLE IN LEGALHOLD COMPLIANCE It is not only the policy and training that ensure success for an organization, but the measurement of the results. Fortis Quay, Inc. has assisted organizations in resolving the issues surrounding Information Management. We work with Information Technology, Legal, and Compliance (as well as other members of the Information Governance Committee™) teams to review, identify, and remediate the gaps and deficiencies commonly found in organizations in this digital era. In no other industry is this type of service more critical than in the Healthcare environment. visitoursite Preserving necessary documents in litigation / Legal Hold can be confusing, time-consuming and expensive, but it needs to be done right. Fortis Quaycan help. We customize the Legal Hold process for your organization, making it simpler, faster, &more effective LESSexpensive