Category: IT Security

Preparing for the Cost of a Data Breach

by Jim Conwell, posted in Business Practices, Cloud and IT Consultants, Cloud Computing, data center, IT Security, protecting cloud resources

Cost-of-Breach

One of the biggest challenges, particularly for small and medium businesses (SMB), is trying to anticipate and budget for the cost of a data breach. While larger, often publicly owned, corporations can sustain huge financial losses to litigation or regulatory penalties, organizations with less than $100 million in revenue cannot. Even with the leadership of the SMB becoming aware of the inevitability of an attack, they don’t understand what the potential costs could be and how to prepare for them. This may cause them to task their Chief Information Officer (CIO) or Chief Information Security Officer (CISO) to estimate the cost of a breach for budgetary purposes. The CISO, understanding that addressing the breach issue starts with IT governance, may attempt to educate their company’s leadership on the tools necessary to help to prevent a breach. Both leaders face a difficult decision: what monies are put aside for data security and do we focus on prevention or recovery? Most would agree the answer is a combination of the two: for this exercise I will focus on the components of cost once the data breach has occurred. The four primary silos of cost are response and notification, litigation, regulatory fines and the negative impact to reputation. When the affected enterprise forecasts costs for a potential breach, it not only gives the company an idea of the financial burden it will incur but it also helps those affected to consider documenting the steps to take in the event a breach is discovered.

Notification, the first cost incurred, is the easiest to forecast. Most businesses have a good idea of who their customers are and how best to notify them. A good social media presence can simplify this as well as reduce total costs. After the breach is discovered, the first task is to try to discover which customers were affected. Once that is determined, the business needs to decide the best way to notify them. US Mail, email or social media are the most common methods. The most efficient process for each must be determined. Many states have laws around breach notification and timing, which need to be considered and understood as a part of the process. The larger the organization, and the associated breach, the more complicated this process becomes. In a recent breach of a large healthcare organization, deciding how to contact the affected customers took longer than it should have because the company wasn’t prepared for a breach of the magnitude they faced. The breach affected tens of millions of customers. It was decided that a conventional mail notification was required at a cost of several million dollars!

Litigation and regulatory penalties are similar and can be prepared for in the same way. While regulatory penalties can be better estimated up front, both costs can get out of control quickly. The best way to prepare for these types of costs are with Data Breach Insurance, also known as Cyber Liability Insurance. Cyber Liability Insurance provides coverage for the loss of both first-party and third-party data. This means that whether the data breach happens directly to your company or to a company whose data you are working with, the coverage will be in effect. While most of the time Cyber Liability Insurance is considered for the larger expenses, like lawsuits and regulatory penalties, the right plan can be used for all four types of aforementioned costs: notification, litigation, regulatory fines and damage to reputation.

The hardest to define, and many times the costliest, is the damage to the breached company’s reputation. In a recent study, the three occurrences that have the greatest impact on brand reputation are data breaches, inadequate customer service, and environmental disasters. Of these, the survey found that data breaches have the most negative impact on reputation. If the affected company is in the IT industry, and specifically IT security, the effects are likely to be devastating to the organization. The only trend that seems to be softening that damage is that breaches have become so common that people are more likely to disregard the notification. Greater frequency certainly is occurring, but it isn’t anything the affected company can include in their plan. What you must include in your plan is the message you will communicate with the public to lessen the negative consequences. This should include how you fixed the problem and how you plan to prevent additional breaches in the future. In a recent healthcare breach, the organization partnered with a well-known security platform to better protect patient records going forward.

Considering these four primary areas affected is critical to helping leadership determine the costs associated with a data breach. If you have any questions about determining the cost for your business, contact us today.

Contact us so we can learn more about the IT challenges with your organization.

.Jim Conwell (513) 227-4131      jim.conwell@outlook.com      www.twoearsonemouth.net

From Meaningful Use to MACRA or… When the MIPS comes Down?!

by Jim Conwell, posted in Business Practices, Cloud and IT Consultants, Cloud Computing, healthcare IT regulation, IT Regulation, IT Security

mips_

Most of us who have been in the business of healthcare for 5 years or more are familiar with the term “Meaningful Use.” For others, let me define “Meaningful Use” at it will serve as the basis for this blog. Meaningful Use was a program implemented by the governmental agency, “Centers for Medicare and Medicaid Services” (CMS) to measure and reward medical practices for the use of Electronic Health Record (EHR) technology. EHR is the software a medical practice uses to manage its business and store all Protected Health Information (PHI). I believe Meaningful Use was a success. It brought a much greater awareness to EHR technologies, and pushed practices small and large to evolve, and store their PHI electronically. Storing information electronically in turn allowed medical practices to provide a better level of service, care coordination and sensitive data security to its patients.

You may have noted I used 3 three letter acronyms (TLAs) in the first paragraph. This comes with working with information technology and is multiplied by government bureaucracy.   There are plenty more to come, so I will document the rest up front, right now! 

1.    MACRA- Medicare Access and Chip Reauthorization Act

2.    QPP- Quality Payment Program

3.    APM- Alternative Payment Model

4.    MIPS- Merit-Based Incentive Payment System

5.    EC- Eligible Clinician

The next year brings the sequel to Meaningful Use, MACRA and the payment system within it: MIPS. The QPP final rules were posted on November 2, 2017 giving participants two months before reporting starts on January 1, 2018. Nearly all healthcare providers, physicians, physician assistants and nurses must participate. The scoring for MIPS will be based on a point system, look for future BLOG’s to take a deeper dive on MIPS including the point system.

A practice that bills Medicare Part B* claims in an amount less than $90,000 or has fewer than 2,000 Medicare claims is not required to participate. The smaller practices that do report receive some breaks; groups from 1-15 clinicians get an automatic 5 points, even if completing the minimum amount of reporting. Groups of 1-10 clinicians can team up with other smaller groups to combine reporting, regardless of location or specialty. This will allow some “rock-star” practices to report with lesser groups allowing all to benefit from the payment program.

MIPS reporting for 2018 will be divided into 4 categories, each of which will have a different weighting. Additionally, the weighting percentages are set to change in years 2019 and 2020. The following are the four reporting categories and their weights:

  1. Quality (60%) – The practice selects at least 6 measurement criteria to report on from a choice of over 300. Some are general categories and some are for specialty practices. For example, a cardiologist may report on measurements for controlling high blood pressure among all their patients. Quality is the only category that must be reported on for the entire year.
  2. Advancing Care Information (25%) – ACI includes all the measurements that were a part of Meaningful Use. It measures how the practice promoted patient engagement (patient portal) and exchanged information using EHR technology.
  3. Improvement Activities (15%) – The primary focus on Improvement Activities will be on care coordination, which is the ability to work seamlessly with other providers. Additionally, providers will have a list of over 900 categories and 9 sub-categories to report on.
  4. Cost (no mandated reporting in 2018) – This information will be based on data from Medicare claims received.

MIPS reporting options for 2018 

  • Option 1 – Submit “some data”- Quality is the only data that must be reported for the entire year. Enough data for 15 points must be reported.
  • Option 2 – Quality full year – Submit Quality full year, Advancing Care Information and Improvement Activities for 90 days.
  • Option 3 – All categories full year- Cost not reported in 2018

A practice can pick any of the options they choose, most likely it will be driven by their understanding of the program and the resources they assign to it.

More will be revealed on MACRA, MIPS and the best practices for reporting in the coming months. Due to the consequences of failing to report, and the urgency of a short preparation period, many healthcare organizations will need assistance with reporting. MIPS has much greater consequences than Meaningful Use.

First, all information submitted for reporting will be public. We will see reported information on CMS websites allowing you to compare providers, like we look at online reviews for traditional business today. Secondly, MIPS does more than just reward compliant practices, it also penalizes non-compliant ones. Meaningful Use was initiated as an experiment to some extent. MIPS seems to be making the transition to a regulation that is here to stay. Healthcare organizations will either need to get on board or face serious consequences.

Given the importance of MIPS to the healthcare industry, and the continued flow of information to this day, we will provide another update to this before year-end. Please look for a deeper dive on MIPS information including components not covered here, like how the points system works and Alternate Payment Methods (APM), that will become more important in the years to come.

*Medicare Part B is the portion of Medicare that pays for ambulatory services such as doctor office visits and prescriptions. Part A applies to hospital stays.

 

To meet and learn more about how MIPS reporting can affect your organization contact me at
 (513) 227-4131 or jim.conwell@outlook.com.

What’s a Managed Service Provider (MSP)?

by Jim Conwell, posted in Business Practices, Cloud and IT Consultants, data center, disaster recovery, IT Regulation, IT Security

 

AAEAAQAAAAAAAAwgAAAAJDAxNmMxNDJhLTM0MWEtNDIwZi1iNDBiLTAwYjVhZTYzMzM4Mw[1]

Most organizations, big and small, have gone through this exercise with Information Technology, as well as other services. “Should I hire a dedicated person, assign it to someone in the organization as an additional responsibility or outsource”? What’s a Managed Service Provider (MSP)?  When posing this question for IT services; size matters! In this exercise, we will assume there are from between 20 to 100 IT users in the organization considering an MSP.

Size Matters

When a company I consult with is near the lower end of this user count many times they will tell me that an employee’s relative; brother, sister or husband does their IT work. I call this type of IT provider a trunker, as their office and tools are in the trunk of their car. A trunker can be a smart way to go, receiving a prompt and personalized service response. However; it is important the trunker has a way to stay current with technology. Also, at least one employee of the organization be aware of all he or she does and documents all passwords and major tasks.

 I’ve seen the same level of service can be achieved with an IT MSP as the organization outgrows the trunker. The MSP will typically have an upfront cost to inspect and become familiar with the IT infrastructure. Then there will be a recurring charge, monthly or quarterly, for help-desk support that is either handled remotely or on the customers site. With few exceptions, organizations of 100 employees or less, are serviced satisfactorily with a remote agreement. When an issue calls for onsite service they will pay the predetermined labor rate. Another factor that is determined up front are Service Level Agreements (SLA’s). SLA’s will define how quickly the MSP will respond. As it was with the trunker mentioned before it’s up to the organization to keep track of the IT provider and their tasks. This can be made easier by the fact that an MSP, because it will engage multiple technicians for one customer, needs to document everything for their own benefit.

Why Use an MSP for My Business?

The MSP is the system I see work most often. So let me answer my original question. Why outsource my I.T?!

1)   Consistency and predictability of service. Based on the MSP’s reputation and the SLA’s provided most organizations experience responsive and high continuity of service. When the agreement ends, they can expect a smooth transition to the new vendor or person. I have witnessed many times when the trunker provider relationship ends poorly. The organization can be put in a position of having no documentation and not even knowing the passwords to access their systems.

2)   Transparency. Most MSP’s, as a part of their service, offer dashboards showing real-time status of devises on the network. Many even offer your business remote access to monitor your network. This is a major cost reduction based the cost to host or maintain monitoring yourself.

3)   Expertise. There is knowledge in numbers. Although you may only see or speak with one person as the face of your IT partner, you’re working with a team with vast experience and knowledge. The technical staff of an MSP will always have greater level of experience and a better knowledge of the trends in technology. This is particularly true in regulated organizations such as in healthcare and financial businesses.

Contact us for a free analysis of your business and what will serve it best.

Jim Conwell     (513) 227-4131     jim.conwell@twoearsonemouth.net http://www.twoearsonemouth.net