Privacy Auditing in a Mixed McKesson Application Environment

Transcription

1 Privacy Auditing in a Mixed McKesson Application Environment Presentation materials in-line below The webinar replay link is available here June 11 th, 2009 FairWarning Trust but Verify info@fairwarningaudit.com x115 U.S.A.

2 Agenda Columbus Regional Hospital Audrey Tyree, Manager of Information Security and Columbus Regional Hospital Security Officer FairWarning Customer Results Valerie Blount, FairWarning VP of Customer Operations McKesson John Anderson, Director of Product Management Webinar Feedback Survey

3 Automated Privacy Auditing A Practical Case Study Audrey Seward Tyree, BS, CHSP, CHC Manager of Information Security and Business Continuity Columbus Regional Hospital 2400 East 17th Street Columbus, Indiana 47201

4 About Columbus Regional Hospital $160M Revenue 1,700 Employees 225 bed inpatient hospital in Columbus, Indiana also serving Indianapolis, Cincinnati and Louisville JCAHO Stroke Center Designation HFAP Accredited Chest Pain Center Designation Magnet for Nursing Designation Most Wired 100 Award Winner AHA McKesson Quest for Quality Winner Thomson Reuters 100 Top Hospitals Award Best Places to Work in Indiana by Indiana Chamber of Commerce Our vision is to be the best in the country at everything we do Visit us at 2

5 Why privacy auditing Drivers and Benefits HIPAA Security Standards Administrative Safeguard -Security Management Process (a)(1) Information System Activity Review(R) Technical Safeguard - Audit Controls (b)(R) Mitigate risk of disclosures Behavior Accountability Centralize auditing of critical systems Automate standard auditing for exceptions Pre-FW Processes and Associated Risks Manual process of reviewing access Increasing number of systems and users 3

6 Why FairWarning? Two Vendor Integration of auditing Growth and easy integration Vendor independence Selection Decision Desire to Meet Our Needs Enthusiasm and Professionalism Multiple Conference Calls and Webinars Recommendations from Customers Cost 4

7 Project Overview Project Description Assess compliance with audit requirement for all systems storing or using electronic PHI (protected health information) Project Scope Implement audit solution for critical systems without adequate audit tools Integrate critical clinical systems for a Single audit source Timeline July 2007 Start working with FairWarning team on Phase 1 January 2008 Completed Phase 1 Integration of 5 systems Phase 2 Integration of 20 additional systems over next months Jun 08 Nov 08 dedicated to flood recovery Rebuild FW November 2008 March 2009 to pre-flood status 5

8 6 Estimated Resource Matrix (Based on Integration of 25 Systems)

9 System Architecture McKesson STAR Application Audit Logs Server #3 Physician Portal Audit Logs SAN Encrypted Archived Audit Logs STAR PatientCare STAR Clinicals Radiology, Pharmacy, Laboratory STAR Financials Server #1 Server #2 Cerner Audit Logs SAN Fiber X STAR Audit Server ChartMaxx Audit Logs Privacy Officer FairWarning Users FairWarning Admin Horizon Clinicals Audit Logs Security Officer Multi-U configurations available Browser based user access Role based access control Privacy, risk, security Browser based admin Shell access optional Appliance access via Customer VPN FairWarning Administration Periodic fine-tuning Support & Maintenance 7

10 Challenges Employee/User information Name, Role, Department, and user names for each system Activity must be accountable to one person Users may not be employed by CRH Physicians Students Interns Temps Contractors Reviewers Volunteers Others No centralized method of tracking non-crh employees 8

11 Results Compliance with HIPAA audit requirements Mitigate risk of disclosures Comprehensive method of reviewing User accountability Quicker turn around time on investigations and follow-up 9

12 Questions? Thank You!

13 About current FairWarning customers: Reference-able customers in every region of North America and every major EHR vendor 45% of our customers are recognized as industry leaders: 100 Most Wired, Verispan 100, U.S. News Top 20, Malcolm Baldrige Awards U.S. HHS OIG HIPAA audited customers Canadian customer adoptions FairWarning experienced 184% Revenue growth in 2008 and 191% Q Revenue growth due to customer adoption and broad customer references. Recent survey of FairWarning customers FairWarning Customer Results Hyperlinks included in the text for presentation distribution after this webinar.

14 FairWarning Customer Results In a recent FairWarning customer survey, 100% of the respondents said Yes, FairWarning s privacy auditing capabilities had successfully streamlined their investigation, compliance and audit processes for producing patient-user privacy reports (internal audit, external audit, investigations, etc.). Fifty-seven percent (57%) of the same respondents indicated they have been involved in a court case or legal proceeding in which they utilized FairWarning s privacy auditing and investigative capabilities.

15 FairWarning Customer Results When it comes to proactive privacy monitoring, 83% of the FairWarning customer survey respondents reported having used FairWarning s privacy monitoring capabilities to detect and deter privacy breaches, avoiding costs associated with a privacy breach. Of the remaining respondents to this question, all reported they would have escalated FairWarning solution to production after purchasing in retrospect to avoid those costs.

16 FairWarning Customer Results Regarding sanctioning and training, 100% of FairWarning customer respondents said they take the results from the FairWarning solution and tie it to their sanctioning and/or education processes in order to reprimand current and deter future violations. Ninety percent (90%) have disciplined or sanctioned employees and/or physicians based on FairWarning solution results.

17 FairWarning Customer Results With a 10X reduction in privacy audit review time as a result of the FairWarning solution implementation, organizations are able to refocus on training, education, research, and programs for compliance, privacy and security across the organization.

18 One FairWarning customer Privacy Officer said, FairWarning Customer Results FairWarning s presence in our environment ensures we ve met qualifications required by HIPAA as well as the new ARRA-HITECH Act. Within days of this legislation becoming law, FairWarning was planning for both Accounting of Disclosures and FTC Red Flags Rule mechanisms in the solution. That s thinking ahead, and part of what makes FairWarning so valuable. FairWarning is supported by industry and governmental experts links are published to expert testimonial on OIG audits, systematic HIPAA audits, and mitigating privacy and non-compliance risks in healthcare organizations.

19 FairWarning Kurt Long, Founder Shane Whitlatch, SVP Sales Operations & Alliances Valerie Blount, VP of Customer Operations

20 FairWarning Privacy Surveillance John Anderson June 11, 2009 Director, Product Management

21 FairWarning Privacy Surveillance Information Tension Caregiver Organization Speed & Access Protection & Security

22 FairWarning Privacy Surveillance Privacy Incidents (1H2008) New York-Presbyterian Medical Center* - New York City, New York Patients names, phone numbers, and in some cases social security numbers were stolen by an admissions department employee and sold to organized crime groups focused on identity theft. [Name redacted] was arrested. UCLA Medical Center* - Los Angeles, California An employee accessed actress Farah Fawcett s cancer treatment records. The employee was fired, because treatment details were leaked to the Enquirer and the Globe. Another story reported that the employee snooped on 61 patients files, all told. (Note: all counted as 1 incident with multiple affected/victims). She was indicted and charged with obtaining and selling information to an unnamed media outlet. Three UCLA facilities were cited by the California Dept. of Public Health. 14 more employees were subsequently cited. Healthcare privacy incidents damage patient lives and harm the trust they have in our healthcare institutions. *Source of Information:

23 FairWarning Privacy Surveillance Appliance-based Solution Healthcare-focused privacy auditing solution which provides Compliance automation Policy-based filtering & alerting Ad hoc reporting Audit support for both patient & user investigations Master audit repository Multi-U configurations available The solution is non-invasive and is capable of scaling with the needs of the institution

24 FairWarning Privacy Surveillance McKesson Applications Support STAR Star Audit Pathways Healthcare Scheduling Horizon Clinical Infrastructure Horizon Patient Folder Horizon Meds Manager Horizon Expert Documentation Horizon Lab Horizon Care Record Horizon Emergency Care Horizon Surgical Manager Horizon Medical Imaging (PACS) Horizon Radiology Manager HealthQuest Series Horizon Physician Portal Customer Alignment: The solution spans more than just McKesson applications

25 FairWarning Privacy Surveillance McKesson QuickStart Service McKesson Applications Only Three versions Up to 8 Audit Sources 9-15 Audit Sources 16+ Audit Sources Services descriptions and pricing to be finalized by 7/1/09