The annual NIST and OCR security conference has come around again. This year, David attended the conference via webcast and shares his notes on the first day of the conference.
Before the conference discussion, we have to touch on the announcement from Equifax about their HUGE data breach.
For more information go to HelpMeWithHIPAA.com/121
We recorded this episode on the day that Harvey was hitting Houston and had no idea just how bad that disaster would eventually become for those on the gulf coast. On the day we publish this episode, we are both personally involved in the evacuations and preparations in advance of Irma. She is forecast to hit Florida, Georgia, and the Carolinas in the next few days. The timing for this discussion could not be more appropriate from a news perspective but this planning should have already taken place prior to this date for those in the paths of these deadly storms.
As you listen to this episode, know that we had no idea just how bad things were about to become for the millions of people under the stress of these major natural disasters. Take care in your planning now if you haven't been in these areas, your turn may be next and there is no way you want to be dealing with anything similar without a plan.
What do you have in your disaster recovery plans?
For more info HelpMeWithHIPAA.com/120
Email us at contact@HelpMeWithHIPAA.com
Every time we discuss server security issues it opens a debate about where is the best place to keep your servers. There are three options and we are going to discuss them today. Local hosting vs data center hosting vs cloud servers under HIPAA.
For more details HelpMeWithHIPAA.com/119
email us: contact@helpmewithhipaa.com
The HIPAA legal reference and guidance mentions reasonable and appropriate all over the place. Many times that concept creates confusion. How do you determine what is reasonable or appropriate for any environment?
More at HelpMeWithHIPAA.com/118
Can a doctor have Alexa in OR to play music?
Is it a HIPAA violation for staff to look at their own records or is it an internal policy violation?
I am a small company BA do I really have to do all of HIPAA compliance requirements?
If I know my upstream BA or CE isn't following their HIPAA compliance obligations what am I legally obligated to do?
Why would you make daily copies of your visitor logs?
More info at HelpMeWithHIPAA.com/117
Sometimes following the news lets you find things like security incident investigations with interesting details. But, these cases were different than most. Even better than that, we learned how can a fish tank help hackers! There were just too many parts of these stories that got my attention to pass them up. When something occurs and the investigation uncovers way more to the story than you normally see we should all learn from them.
More details at HelpMeWithHIPAA.com/116
Incident response plans have been a topic of our show several times. But, these days we just can't get enough of a good thing!
Actually, there is a reason we are covering it in this episode. I was reviewing a Business Associate Due Diligence from a software provider. In the questionnaire, we always ask if you have a written incident response plan and trained incident response team. They responded Yes, with a comment of "we have an engineering department".
More info at HelpMeWithHIPAA.com/115
