By CRAIG MUSGRAVE
Senior Vice President, Information Technology
The Doctors Company

The bar has been raised on HIPAA and ransomware attacks.

Under its guidance released last summer, the Department of Health and Human Services (HHS) now presumes that a ransomware attack compromises electronic protected health information (ePHI) -- unless the HIPAA-covered entity can prove otherwise.

Prior to this new guideline, if you determined on your own that there was no breach, no action was needed on your part. HHS would have to prove that the ransomware attack had compromised ePHI.

But now that burden of proof has changed -- it's now your responsibility to prove that data was not compromised, including patient records, credit card data, and employee records. If you have a breach, or can't prove that you did not, you must complete the HIPAA notification procedures and may face fines. You may also be fined if it's shown that your practice was not HIPAA-compliant before the attack.

Large health care systems and hospitals with sophisticated technology systems may have an easier time meeting this burden of proof. Firewalls can track the traffic of the cyber criminals and record what data they had access to, how long they spent in the system, and what data they extracted. Small practices without sophisticated systems or firewalls may have to hire a forensic computer firm in order to prove that a breach of their systems did not occur.

Ransomware remains a major threat for practices and hospitals. Not only do over 50 percent of all cyber attacks occur in health care, but there have been 4,000 daily ransomware attacks since early 2016, which is a 300-percent increase over the 1,000 daily attacks in 2015. Ransomware attacks exploit technical and human weakness to gain access to a health care organization's system and deny the organization access to its own data.

What you should do to prevent an attack

Encryption use to be the standard method to prevent breaches and protect your practice, but that has also changed. Encryption does not stop ransomware attacks. If a cyber criminal gains access to your system, encryption will not stop the attack. In addition, encryption is no longer sufficient to prove that a breach has not occurred during a ransomware attack. While encryption of all laptops, desktop computers, and mobile devices remains important to overall security, practices and hospitals now need to take additional steps:

Small practices should migrate their systems -- both software applications and data -- to the cloud. Cloud vendors have implemented security measures that most smaller practices won't be able to implement and maintain. Be sure to fully vet your cloud storage vendor:

Are the vendor's security standards appropriate? You have to research each vendor you choose. Make sure the company has a good reputation and solid security policies. You are entrusting the provider to store your information, so the extra time spent researching and comparing providers and their security practices will pay off in the long run.

How much data will you be storing? Many companies charge by the amount of storage you use, so understand what your needs are before choosing a vendor. Ensure the vendor can handle the amount of data you would like to move to the cloud.

Ensure your data is encrypted when being uploaded to or downloaded from the cloud. This is also your responsibility. Make sure your browser or app requires an encrypted connection before you upload or download your data. Also ensure all devices that contain ePHI (laptops, desktops, thumb drives, and centralized storage devices) are encrypted.

Make sure your data is encrypted when stored in the cloud. This is perhaps the most important consideration. Data protected by law, such as medical information or personal identifiers, should never be stored in the cloud unless the storage solution is encrypted. Only selected members of your organization should be able to decrypt the data, and your organization should create policies detailing under what circumstances information can be decrypted. Determining whether the stored data will be encrypted requires a careful review of the specific terms of service within your agreement with the cloud service provider. Many cloud service providers store data on a cloud server with no encryption, meaning anyone who has (or can get) high-level access to that server will be able to read your files.

Understand how access is shared in your cloud folder. Many cloud storage providers allow you to share access to your online folders. Be familiar with the details on how that sharing works. Can the user read-only or can the user edit the file? Will you know who the last person to edit a file was? Awareness of who has access and how is critical to monitoring activity within your stored data.

Understand your options if the cloud provider is hacked or your data is lost. Virtually all cloud service providers require a user to sign an agreement that contains a terms of service provision. In most cases, these agreements provide that the user has very little, if any, remedy if a hack or a loss of data occurs. Pay attention to what rights you have given up and make sure you are comfortable with doing so.

If you cannot store data in the cloud, consider working with a computer forensic firm to strengthen your security and investigating capabilities.

Provide security awareness for all employees. Over 80 percent of attacks are made possible by human error or human involvement. Train staff members to avoid downloading, clicking on links, or running unknown USB on computer systems.

Block the malware at the firewall by using intelligent firewalls to stop the malware from downloading.

Install intrusion detection software to monitor illegal activities on computer networks.

Stop the malware from executing on desktop computers by installing application whitelisting software, anti-virus, or anti-malware.

Perform regular system backups.

Ensure that critical systems and business data are backed up -- even backed up hourly for critical systems.

Test that the backup restore process works.

Perform penetration testing on a regular basis to determine any existing vulnerabilities that should be patched.

The Doctors Company is the FMA's exclusively endorsed medical liability insurance provider, and members are eligible for a 5-percent discount on premiums. Contact Shelly Hakes for more information about this benefit.

Article reprinted from Florida Medical Magazine with permission from the Florida Medical Association.