Ed Yousfi

I've read the 114-page "Health Breach Notification Rule" document so that you don't have to. There is specific mention on page 96, that this entire rule does not apply to covered entities under the HIPAA Security rule (business associates and healthcare clearing houses), but rather to apps that are capable of collecting, storing, processing, or selling personal health information. This means that there are about to be more regulatory requirements on service providers that aggregate personal health information on individuals, regardless of their "intended purpose" of that collection, like apps that collect health and fitness data on your activities. Several high-profile enforcement actions were brought against "app" providers that sold and misrepresented themselves as being HIPAA "compliant", when they were not protecting the systems housing the data in question. While heathcare providers are held to the HIPAA Security Rule, others may be collecting data that could be subject to upcoming federal regulation, including but not limited to health, financial, and other protected information. These new agency rules, along with state and proposed federal laws are steering regulatory controls on our systems towards more strict reporting and operating requirements. Companies should be increasing their compliance and cybersecurity audits and assessments to assist in identifying and remediating issues before they result in any reportable events, resulting in revenue and brand reputation losses. Key takeaways: A product feature or integration that exists and is able to draw protected sensitive records is covered under the rule, regardless of status (beta, dev, prod). A "breach" of security includes unauthorized acquisition of sensitive information as a result of a data breach or unauthorized disclosure (access). A breach of security can be considered "sharing inconsistent with consumer expectations", which triggers this rule. Digital notifications (website banner, emails, etc.) are appropriate for consumer notification of "breach of security". Not only postal mail notifications. Details of third-party who improperly accessed sensitive data should be disclosed to affected consumers, along with scope of data accessed. Regulatory and consumer reporting of security breach no later than 60 calendar days following discovery of the incident. Estimated security breach in-house labor hours per incident is 150 hours per breach, with an average cost of $10,770. Third-party forensic costs are estimated at $20,000, for 40 billable hours. Appendix A of the document contains sample email, web banner, and consumer notification templates and federal reporting forms for required reporting. SOURCE: https://lnkd.in/gxVH4hv3 #hipaa #ftc #breach #cyber

2

1 Comment

The EBSA's Compliance Assistance Release No. 2024-01 broadens the compliance responsibilities for ERISA fiduciaries, covering both employee benefit plans and cybersecurity. It encourages plan sponsors and fiduciaries to implement controls that protect sensitive data, including data managed by third-party service providers. This additional guidance emphasizes that fiduciaries must portect plan data to fulfill their legal duties. The guidance confirms that the agency's 2021 cybersecurity advice applies to all ERISA-covered benefit plans, including health and welfare plans. Plans impacted include medical, dental, and vision, as well as life and AD&D insurance, long-term disability benefits, and health flexible spending arrangements. Under ERISA, employee welfare benefit plans offer a range of services, including healthcare and insurance. Fiduciaries overseeing these plans must take steps to secure participant data. An important compliance step is identifying which plans fall under the expanded guidance. While ERISA governs many benefits, cybersecurity remains essential for all employee benefit plans, including those not covered by ERISA. Fiduciaries must consider all service providers involved with the plans, not just the primary ones like insurance carriers. EBSA's guidance covers service providers such as brokers, consultants, auditors, wellness providers, and cloud storage companies. Each entity providing services must comply with cybersecurity controls. Health and welfare plans present different challenges compared to retirement plans. While retirement plans may involve a few beneficiaries, health and welfare plans often cover dependents, making data management more complex. Additionally, different internal teams and vendors manage health and retirement plans, which means that fiduciaries must adjust their cybersecurity efforts accordingly. HIPAA compliance remains important for group health plans, but EBSA’s guidance places greater responsibilities on plan fiduciaries. It emphasizes more rigourous oversight of service providers, including those that are not typically covered by HIPAA. Unlike HIPAA, the EBSA guidance requires continuous monitoring of service providers to ensure they comply with cybersecurity standards. #cybersecurity #EBSA #ERISA #compliance

3

1 Comment

Have you ever thought about how hobbies could make you a better leader? As a CIO and CISO, my life is a whirlwind of digital transformation and cybersecurity. But outside the office, you’ll find me hunting, fishing, or conquering CrossFit challenges. Here’s why my hobbies make me a better leader: 𝗣𝗮𝘁𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝗣𝗿𝗲𝗰𝗶𝘀𝗶𝗼𝗻 Hunting demands patience and exactness. Like IT, one mistake can cause chaos. It teaches you to wait for the perfect moment and make calculated decisions. 𝗔𝗱𝗮𝗽𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗮𝗻𝗱 𝗣𝗿𝗼𝗯𝗹𝗲𝗺 𝗦𝗼𝗹𝘃𝗶𝗻𝗴 Fishing is unpredictable, just like cybersecurity. Changing conditions teach you to adapt swiftly and think on your feet. 𝗥𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝗣𝗲𝗿𝘀𝗲𝘃𝗲𝗿𝗮𝗻𝗰𝗲 CrossFit pushes you to your limits, fostering resilience. In leadership, this means handling setbacks and staying motivated. 𝗪𝗼𝗿𝗸-𝗟𝗶𝗳𝗲 𝗕𝗮𝗹𝗮𝗻𝗰𝗲 Intense hobbies combined with a high-pressure job force you to prioritize and manage your time, which is key to avoiding burnout. 𝗧𝗲𝗮𝗺 𝗗𝘆𝗻𝗮𝗺𝗶𝗰𝘀 Outdoor activities often involve teamwork, highlighting the importance of communication, trust, and collaboration—vital leadership skills. 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗧𝗵𝗶𝗻𝗸𝗶𝗻𝗴 Both hunting and fishing require strategy. You must understand your environment and plan accordingly. This mirrors IT and cybersecurity strategies. 𝗥𝗲𝘀𝗽𝗲𝗰𝘁 𝗳𝗼𝗿 𝗡𝗮𝘁𝘂𝗿𝗲 𝗮𝗻𝗱 𝗦𝘂𝘀𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 Engaging with nature cultivates respect for the environment. This perspective is crucial when considering the long-term impacts of business decisions. Leadership extends beyond technical skills and business acumen. Diverse hobbies bring a well-rounded perspective, enriching our lives and careers. Do you have a hobby that shapes your professional life? Share your story below!👇

20

4 Comments

Highly entertaining and gritty article about the reality of digital forensics, what data you can trust, and setting the standards of trustworthy evidence. Props to Justin Seitz! https://lnkd.in/g2x8zSrD

6

1 Comment