Primary EHR
Non-U.S.
Small System
Regional System
Large Enterprise System
FairWarning Technologies
Trending News & Insights
Chief Technology Officer/CIO
Business Systems Admin/Salesforce Admin
AI/Machine Learning
Cloud Compliance
Healthcare Data Security
Drug Diversion
HIPAA/OCR
Privileged Users
Salesforce Security
Salesforce Shield
Patient Privacy Monitoring
Home » FairWarning Articles » Memorial Healthcare's 10 Steps to a Holistic Patient Privacy Program
Memorial Healthcare's 10 Steps to a Holistic Patient Privacy Program
November 7, 2018 Christina Lembo
Memorial Healthcare System (MHS) is a longtime leader in high-quality healthcare services for South Florida residents. With over 13,000 employees, 1,800 beds, and 2,500 physicians, MHS is one of the largest public healthcare systems in the nation. It's also highly regarded for its exceptional patient and family-centered care and its patient privacy program.
Patient privacy has always been a priority for MHS, but in 2012, the organization detected that a former employee of a third-party entity had accessed patient data, compromising the privacy of 80,000 patients. In response, MHS notified the Office of Civil Rights (OCR) — and immediately began its journey toward world-class patient privacy.
Richard Leon, MHS's Chief Information Security Officer, outlined his 10-point plan for data privacy, which led to the patient privacy excellence MHS boasts today.
Memorial Healthcare System's 10-Point Plan for a Better Patient Privacy Program:
#1. Create a Process for Automated Periodic Access Review
MHS implemented a quarterly automatic periodic access review process for employees, physicians, students, and vendors in their EHR and cloud applications. Furthermore, MHS has implemented a monthly automated access review process for non-employee physicians, office staff, ACO, and population health organizations. This helps ensure that only permitted users have access to their EHR and that users who no longer need access be deprovisioned. Leon described how FairWarning painted the full picture of access to their applications to reduce risk of non-permitted users, users who need training, or those who need sanctioning for inappropriate activities.
"FairWarning provided the data to understand workflows, pinpoint workforce data access and privacy challenges, and guide training," Leon said.
#2. Gain Full Visibility of User Identity Data
In a study of 1 million users, FairWarning learned that, on average, 26 percent of a healthcare organization's users are poorly known or unknown. This creates extreme security risk, as even if you catch those engaging in inappropriate activity, you may have no way of knowing who to address, train, or sanction. MHS leveraged FairWarning's patented Dynamic Identity Intelligence technology to correlate user information in its EHR with the data in Lawson, PeopleSoft, and Active Directory. With the resulting data from Active Directory, MHS now has full visibility into the activity of both employees and contracted workers like affiliated physicians.
"Tracking access to our integrated Epic EHR by employed and affiliated physicians, as well as outside case reviewers and third parties, was essential, and we knew it would require more than just looking at logs for true cross-system transparency," said Leon.
8 Essential Steps to Prepare for an OCR Audit
#3. Create a Dedicated Privacy Department
MHS has hired a Corporate Director of Privacy to build on their program. This will allow MHS to grow while navigating new and existing regulatory compliance to ensure the privacy and security of their patients' data.
#4. Define Access Requests for Physicians and Their Staff
MHS now has a strict and binding Enterprise Systems Access Policy, with defined sanctions for policy violations. Every new organization it works with must identify the organization leaders who will be responsible for monthly verification. They ensure that users only have access to the data they need to perform their job. They answer questions like : "Do users still need access?" "Have workflows or projects changed?" "Can user permissions be rolled back to reduce risk?"
"Those entities are bound to a monthly access verification process and a yearly re-certification process," he said.
#5. Track Vendor Access and Business Associate Agreements
MHS has focused on comprehensively vetting all vendors including a privacy and security checklist review before they obtain access. In doing so, they can help reduce risk of data breaches and hold business associated accountable for the privacy and security of their data.
"When it comes to PHI, we say, 'No BAA, no access,'" Leon said.
#6. Dedicate a System Access Team to Provision and De-Provision Users
MHS now has a dedicated System Access Team that manages all automated and manual provisioning processes. The team also manages the periodic access review process.
9 Quotes About Creating a Drug Diversion Program at Your Healthcare Facility
#7. Adopt a Zero Tolerance Policy for Privacy Violations
MHS adopted a zero-tolerance policy for privacy violations. Zero-tolerance may not work for other organizations, but this was the right choice for MHS. Through the privacy program, all violations are investigated – and employees have been terminated.
"That was a challenge," Leon said. "We had to have discussions around impacting the rights of employees."
#8. Develop a Laser Focus on IT Security
Leon has worn many IT hats at MHS; now, as CISO, he explains, he is laser focused on privacy and security. He also has a manger of IT security.
#9. Partner with Vendors to Create a World-Class Privacy Program
After a lengthy and thorough vetting process, MHS in 2017 chose FairWarning as its partner in patient privacy monitoring. Shortly after implementing the Patient Privacy Intelligence platform, MHS began to see real results in the number of incidents occurring and the overall culture of privacy, compliance, and security. The health system now gets detailed reporting when users access or print PHI, as well as information on who accessed the information, what they accessed, and why they may have done it.
"FairWarning gave us a 360-degree understanding of potential risks and the ability to build privacy rules around them, which positions us for future implementation uses of the platform," Leon said.
MHS is planning to expand its use of FairWarning into accountable care organization (ACO) activities. "We're currently working with two ACOs in fairly new arrangements," explained Leon. "ACOs don't necessarily have definitive patient populations, so we'll need to make sure that all PHI access is authorized and above board without any patient-pilfering attempts, which is a major concern for us."
#10. Save Time with Managed Privacy Services
To help save time and dedicate more resources to all aspects of their patient privacy program, MHS partnered with FairWarning's Managed Privacy Services, a team of certified privacy analysts that acts as an extension of Leon's team. Leon is especially excited about the reduction of false positives thanks to MPS's work.
"The 90 percent reduction in false positive alerts through the use of FairWarning's Managed Privacy Services have saved us the time equivalent of two more FTEs (full-time employees) to handle the past quantity of false alerts," Leon said
Today, the MHS journey to continually improve patient care and privacy goes on. With the agility and flexibility offered by the FairWarning Patient Privacy Intelligence platform and Managed Privacy Services as a foundation, MHS has designed a roadmap for proactively mitigating risks and continually developing a culture dedicated to patient privacy. This will enable them to continue to improve patient care as their organization continues to grow.
Request a Demo!
California Consumer Privacy Act of 2018: Everything You Need to Know About the New California Data Protection Law
Healthcare AI Use Cases: 5 Examples Where Artificial Intelligence Has Empowered Care Providers
5 Common Social Engineering Tactics and How to Identify Them
IBM Released Its 2018 Data Breach Study -- and Financial Services and Healthcare Organizations are Taking Note to Maintain Customer Trust
User Activity Monitoring in Salesforce: 5 Lessons Learned for a Stronger Data Governance Program
FairWarning Blog,Uncategorized
Top 3 Healthcare IT Challenges Children's Hospitals Face
Insider Threat Mitigation: 5 Best Practices from Cybersecurity Experts
GDPR and HIPAA Compliance: What are the Differences and How Can I Work Towards Compliance?
Healthcare providers and payors in the United States are no strangers to protecting sensitive data under HI...
OCR October Newsletter: How Care Providers Can Join the Fight Against the Opioid Crisis in Healthcare
This week, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published i...
Children's hospitals are renowned for the expert care they provide. But because of the specialized nature of their services and the vulnerability of their patients, they face unique healthcare IT...
Cybersecurity experts Jeffrey DiMuro, Salesforce's Chief Security and Compliance Architect for Financial Service Industry Team, and Josh Hofer, Stearns Bank's Chief Risk and Information Security...
Monthly Healthcare News Roundup: Class Action Lawsuit Against Google, Denial of Drug Diversion at Practitioners' Own Facilities, and More
Every month, we compile the most compelling healthcare privacy and security related news stories. Below, you'll learn more about a class action lawsuit against Google, how healthcare executives...
Monthly Cloud Security Roundup: NASA Security Hack, Chaos in Silicon Valley, and More
Each month, we'll bring you some of the most compelling cloud and Salesforce security-related stories from the last four weeks. In this post, we discuss a NASA security hack, Maine's internet...
New Cybercrime-Fighting Unit to Enforce New York Cybersecurity Regulations for Financial Institutions
The Wall Street Journal recently reported that a newly-founded crime-fighting cyber unit will begin enforcing security rules laid forth by New York cybersecurity regulations. The primary role of...
3 Ways Stony Brook Medicine Transformed its Privacy Program Using AI in Healthcare
The goal of any healthcare privacy professional is to protect patients' sensitive information. But with a small privacy team to monitor thousands of EMR users, where do you start? At Stony Brook...
Real-Time Event Monitoring: What's New in Salesforce's Summer 2019 Product Release
Eagerly anticipated by Salesforce users every season, the newest product release for 2019 brings exciting updates for Salesforce's Event Monitoring tool. Primarily used to gain visibility in...
The NIST CSF Framework – What Does it Mean for Healthcare?
NIST, the National Institute of Standards and Technology, is a non-regulatory federal agency of the U.S. Commerce Department. Established in 1901, NIST was designed to promote innovation and...
Insider Threat Awareness: Do You Recognize These 5 Familiar Faces?
Would you recognize these 5 familiar faces of the insider threat? You might be surprised. Test your insider threat awareness with this post!
Top 5 Challenges Academic Medical Centers (AMC) Face
Academic medical centers (AMC) maintain reputations for excellence in research, innovation, and specialized care. But the way AMCs bring practitioners, medical staff, students, and researchers...
Healthcare Privacy News Roundup: The Transformative Effects of AI in Healthcare, the Most Common HIPAA Violations, and More
Every month, we compile the most compelling healthcare privacy and security related news stories. Below, you'll learn more about AI in Healthcare, HIPAA violations you should be aware of, opioid...
Monthly Cloud Security Roundup: The Debut of Salesforce Blockchain, Equifax's $1.4B Breach Costs, and More
Each month, we'll bring you a few of the most compelling cloud and Salesforce security-related stories from the last four weeks. In this post, we discuss the debut of Salesforce Blockchain, zero...
The HHS Announces Changes to HIPAA Violation Fines – What it Means for Healthcare Organizations
The Department of Health and Human Services (HHS) has announced a dramatic change to HIPAA violation fines. Maximum penalties for the lowest-level HIPAA violations have been reduced drastically –...
You Just Bought Shield: Now What? A Salesforce Shield Implementation Guide for Admins
Now that you've chosen Salesforce Shield – a set of point-and-click tools for maximizing your Salesforce security, meeting regulatory compliance, improving CRM usage and adoption, and safeguarding...
Cloud Computing in Healthcare – What are the Benefits and Challenges?
From cutting costs to increasing efficiency, leveraging the cloud drives healthcare to integrate innovative technology to improve patient care. By implementing software like Office 365 and...
The Impact of GDPR One Year Later: The Good, The Bad, and The Future
May 25, 2019 is the first anniversary of the implementation of the EU's General Data Protection Regulation (GDPR). The impact of GDPR was felt across the world – since its introduction, privacy...
4 Ways Healthcare Organizations use Machine Learning for Healthcare Security
Industries across the board are adopting artificial intelligence (AI) and machine learning – by 2025, the market for AI solutions for the healthcare industry are predicted to increase from $1...
5 Questions Banks Should Ask When Evaluating Cloud-Based Security Solutions
When banks move to the cloud, the top challenges are a) security and b) regulatory compliance. Evaluating cloud-based security solutions for financial institutions is something that calls for...
Monthly Healthcare Privacy News Roundup: HIPAA-Compliant Alexa, the top 100 hospitals in the US, and More
Every month, we compile the most compelling healthcare privacy- and security-related news stories. Below, you'll learn more about Amazon Alexa's newly HIPAA-compliant skills, the best hospitals in...
Monthly Cloud Security Roundup: Facebook's FTC Charges, iOS Malvertising Attacks, and More
Each month, we'll bring you some of the most compelling cloud and Salesforce security-related stories from the last four weeks. In this post, we discuss Facebook's FTC charges, iOS malvertising...
Back to Insights & Research
© FairWarning Technologies