Law Firm HIPAA Compliance: Why Your Practice May Need It

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) has outlined the information that must be protected by individuals and professionals that have access to it. Although not all law firms typically deal with patient information or EHRs on a daily basis, there are times when they will come into contact with information protected under HIPAA. If you find that your practice frequently reviews EHRs or PHI, then it could be a good idea for your law firm to ensure it is compliant with HIPAA.

What Does HIPAA Compliance Require of Your Law Firm?

HIPAA does have provisions for business associates such as law firms that come into contact with protected information. According to the law, business associates are responsible for information insofar as privacy, security, and breach notification requirements. Although they have a legal obligation and a duty to their clients, most law firms are not prepared to protect the information they obtain. Typically, they lack the cybersecurity capabilities or the knowledge of HIPAA to ensure they remain in compliance. Both of these issues can be swiftly ameliorated by working with the proper managed services providers.

What Elements of Your Law Firm Are Most Important to Protect?

As mentioned, law firms labeled as business associates are required to provide privacy, security, and breach notifications under HIPAA. How can a law firm stay prepared to deliver these outcomes? First, it is critical for law firms to identify the strengths and weaknesses of their system by performing a security audit. A third-party auditor that is HIPAA compliant would serve just as well.

The results of the audit will make suggestions regarding the law firm in several ways. Most often, increased security will be the primary change required for HIPAA compliance. Administrative safeguards, updating network access credentials, limiting the number of people in contact with EHRs, and threat monitoring should all be implemented to ensure only the required people have access to this valuable data from an internal perspective.

For external threats, cybersecurity audits should lead to new readiness plans, increased network security, and various plans to detect and thwart malware. Providing security internally and externally prepares a law firm for dealing with the unique challenges posed by being trusted with data covered by HIPAA.

Obtaining HIPAA Compliance for a Law Firm

Compliance with HIPAA is mandatory, but there are several means to get into compliance with HIPAA. The easiest is to work with a managed services provider like WheelHouse IT. The company can perform HIPAA compliance and security services, bundling your needs into one package. That way, your law firm can have the current status of HIPAA compliance examined by experts and then fix the issues as they’re discovered. This is the simplest, safest course to ensure compliance.

More law firms are discovering that they should be compliant with HIPAA in the present day. While many of them do not possess the tools to handle patient data, it’s possible to quickly and easily update the systems in one’s firms. Managed services can bring a firm into compliance and secure the internal and external elements of the organization, allowing it to operate with confidence. Find out if your firm needs compliance with the HIPAA Compliance for Law Firms Checklist from WheelHouse IT.

HIPAA Compliance for Law Firms Checklist

Remote Hosted Desktops and Security – How to Protect Yourself and your Data

Remote Hosted Desktops and Security - How to Protect Yourself and your Data

With so many people working at home, remote hosted desktops are particularly useful. They can allow an employee to access everything they could in the office smoothly. However, they are also open to potential abuse and vulnerabilities in remote desktop protocols are significant and growing.

Here are some tips on how to protect yourself when you have employees using remote desktops:

Limit Devices

The best practice for remote desktop is to issue the employee a company-owned laptop and allow only that device access to the remote desktop. This means you control the security software on the laptop and can prevent employees from installing personal software that might cause problems. You can also use this as an extra layer of security by enforcing a password on the device.

In general, users can be easily discouraged from using phones and tablets for remote desktop specifically, as it seldom works well and they have alternative methods for things like quick email checks.

You can also restrict access to only locations where your employees are likely to be. Locking to specific IPs is possible, but can cause problems; for example, even if your employee only ever works from their home, rebooting their network router will change their computer’s IP and lock them out. However, you can restrict by geography, disallowing connections from overseas.

Control User Permissions

Many companies are careless about granting permissions to users, and give employees carte blanche access. Compartmentalizing user permissions and allowing them access only to the files they actually need can go a long way towards ensuring that a hacker can’t get to all of your data from one compromised account.

Obviously you need to make sure you don’t negatively impact productivity, but making HR files read only, for example, can be useful in protecting from malicious actors.

Enable Two-Factor Authentication

Two-factor authentication is good practice for all accounts. One good way is to use token-generating software that texts a code to the employee’s cell phone. These codes can only be used once, so are unlikely to be compromised.

You should also limit login attempts so as to prevent brute force attacks and encourage the use of good password hygiene. Passphrases are better than passwords as they are easier to remember.

Monitor Suspicious Activity

One concern with remote work is that supervisors can no longer do random check on employees in their offices or cubicles. However, it is possible to keep at least a basic check on odd behavior. Obviously, you should not micromanage people, which reduces engagement and productivity. Things you can monitor, though, include connection attempts from odd locations or at times when the employee concerned does not normally work. VPN systems can generally spot unusually high network activity, which can also be a red flag.

Use Encryption

Requiring files to be encrypted during remote work can improve security on top of using a VPN. The files cannot be read in transit even if an employee forgets to connect their VPN or turns it off because the system is so slow they are unable to work, both of which have been known to happen.

Use AES 128 and/or AES 256 as the gold standard to protect your data.

Choose a Good Provider

Finally, make sure that the provider handling your servers is using up-to-date security methods. Ask about firewalls and rolling or incremental backups. Also make sure they have a good record in terms of uptime; it’s even harder for remote workers to continue to operate when the network is down, and if they are using virtual desktop they may not be able to access any of their files and may not be able to store stuff locally.

If you have employees using remote hosted desktop or similar protocols and need advice on how to keep things secure, protect your data, and sustain productivity, contact Bluwater Technologies today.

Email Account Attacks & Takeovers by Cyber Criminals

Cyber Criminals

If organizations thought that cyber criminals have mainly moved on from email exploits to other more lucrative points of attack, they are unfortunately, mistaken. In fact, email exploits remain a significant contribution to account takeover attacks. This article will discuss some of the stats surrounding email attacks, ways in which cyber hackers like to exploit email users, and it will also outline some steps organizations can take to combat this persistent security threat.

The Stats 

When hackers do attack email accounts, 78% of them do so without the help of any applications outside of email. This overwhelming percentage shows that the use of email alone remains a powerful potential source of unwanted cyber attacks. Another interesting statistic centers around the length of time that hackers stay undetected while exploiting an email account(s). Researchers show that data thieves were able to linger undetected for an entire week in over one-third of all hacked email accounts. For organizations working with confidential data, this is particularly disturbing, as a week’s worth of email correspondence is often significant.

Other email hacking attempt stats include:

  • 31% of email hackers focus solely on compromising email accounts.
  • 20% of single email attacks affect other email accounts, including personal accounts. 

 If one thinks it is comforting to learn that only 31% of hackers are interested in gaining access to an email account and assume that’s the end of their exploit, it is a false assumption. While the stats show that some hackers do only focus on gaining access to the accounts, their next step often involves selling the information they observed to other cyber criminals, who then use the data for blackmail or other criminal purposes. Of course the other stat which shows that 20% of successful email exploits also involve the exploitation of multiple user accounts, means hackers are gaining access to a password for one account and are able to use that same password to exploit multiple accounts.

How They Do It

We’ve already learned that it’s not uncommon for hackers to gain access to multiple accounts, merely by trying to re-use an employee’s password.  Some hackers will research a company to find details about employees who hold significant positions within the organization. They then impersonate a person in power by sending an email to a first-line employee, who in turn gives up confidential corporate information, since they assume they’re interacting with a corporate representative in a position of significant responsibility. 

Hackers may also do online research, looking for clues about a company such as what clients they serve and/or what vendors with which they interact. They then use this information to impersonate employees from these companies and send spear-phishing emails to key members within a targeted organization.

Data thieves may also employ brand impersonation tactics throughout an email and send it to unsuspecting employees. When the employees open up the email it looks like it is from a trusted source such as Microsoft, Apple, or Google. The body of the mail may state the employee needs to reset their password with the specific company, only to steal the employee’s “new password” after they click on the reset link.

How to Combat Attackers 

Certainly, training staff members on how to spot phishing and other hacking attempts, should be part of every organization’s strategy to combat exploits. Computer security specialists have multiple tools at their disposal to help them with early detection and mitigation of compromised emails. Computer security professionals also use software apps that include forensic tools, advanced detection techniques, and incident-response resolutions.

Summary

If the thought of trying to ward off data thieves and hackers seems daunting, there is help available. Third-party computer security specialists are thoroughly trained in providing comprehensive security packages for all sizes and types of organizations. If you would like to know more about how to develop a complete strategy to thwart off security exploits, including how to effectively secure an organization’s email accounts, please contact us.

7 Basic Network Security Tips for Small Businesses

7 Basic Network Security Tips for Small Businesses

Some small businesses might think it’s reasonable to assume that hackers and data thieves only go after large targets. Of course these same criminals are well aware of this assumption, which is precisely why they know small businesses are often ripe for exploitation. According to CNBC, in 2019 small businesses were the targets of 43% of all cyberattacks, and more than half of them suffered some type of breach within the previous 12-month period.

Thankfully, there are some basic strategies that small businesses can employ to help them reduce their risk of ever having to experience a cyber attack.

Strong Passwords

Using a strong password is such a simple way to discourage hackers, yet many people still avoid using them.  Employers can enforce the use of strong passwords by requiring their systems to only accept passwords that consist of a combination of letters, special characters and/or numbers, and are at least 8 characters long. For even better protection, enforcing the use of  two-factor authentication provides another layer of security as it requires those attempting to log in to identify themselves by entering a code sent to their phone or email.

Secure the Corporate Wi-Fi

Businesses should always secure their Wi-Fi signal by requiring users to enter a password before gaining access. Leaving a Wi-Fi signal unsecured is simply another point of entry that leaves corporate software and data at risk for exploitation. 

Controlling Access

Employees should only have access to data and software on a need-to-know basis. Access to confidential information should be password protected and access to certain software applications should only be given to those required to use the software. Needless to say, a company should protect access to their network, requiring users to identify themselves before allowing access.

Encrypt Confidential Information

Some employees must use portable and removable media as part of their job responsibilities. Especially when working with confidential data, it’s important for companies to ensure that portable data is encrypted to prevent unauthorized access in the event the media becomes lost or is stolen.

Disaster Recovery Planning

Companies should ask themselves if they are fully prepared if a long term power outage should occur, or worse, an event such as a fire, flood, or some other type of natural disaster. If the answer is negative, they are overdue to get serious about developing a disaster recovery plan. Even small businesses are very dependent upon their hardware, software applications, and corporate data to conduct their daily business operations. Preparing a disaster recovery plan in advance means a company will be able to easily replace vital technology if a catastrophic event should occur.

Applying Updates/Performing Backups

Applying the latest software and hardware updates and patches will allow companies to avoid malware and viruses that hackers often attach to outdated systems.  In addition, performing regular backups and making sure they can be easily restored is vital to ensure that a company’s data is secure and readily available.

Educate Employees

Most business owners clearly understand their ability to successfully conduct daily operations is very dependent upon having accurate and secure data to work with. However, sometimes employees may only consider how inconvenient certain security measures may make their daily tasks more challenging. Using a password of “1234” for every application they log into is convenient since it’s very easy to remember, but weak passwords also leave business owners vulnerable to exploitation. This is where training employees on the “why” of security measures is so important. Employers can also train their employees to spot potential issues such as a suspicious email or an unsecured web page asking for confidential information.

Summary 

Companies should not feel discouraged if they find that safely and securely supporting their IT infrastructure is challenging. These types of challenges are precisely why Bluwater Technologies can help.

If you would like more information on how we can provide the technological support and security you need, please contact us.

What Business Owners Should Know About the Twitter #DataBreach

Trending with the #DataBreach

One of the scariest things for business owners to see trending is the word #DataBreach. Over the past few days, Twitter has come forward to apologize for a significant data breach that occurred as a result of a nonsecure browser cache displaying sensitive user information. Although it remains unclear just how many businesses were affected, the compromise is believed to have impacted a large number of companies who utilize the platform for marketing and SEO.

If you were one of the thousands of business owners who received an email from Twitter apologizing for the breach — or if you’ve simply seen the hot topic trending on your dash — you may be anxious to learn the details and understand what you can do to prevent future vulnerabilities. 

Take a deep breath. #DataSecuritySolutions is always trending with Bluwater Technologies.

What Happened?

The core vulnerability responsible for Twitter’s security compromise lies in the way the app and website stores user information. A browser cache allows platforms to remember details about a user and create key analytics. It relies on the process of saving temporary data, such as passwords and credit card information, so the website or app does not need to download this information each time. This allows the website or app to load faster while keeping us connected with our various clients, contacts, and social media platforms.

Unfortunately, Twitter discovered that the confidential billing information of many of its business accounts had been erroneously stored in the browser’s cache. This made the sensitive information visible to potential cyber criminals. Although no exploits have been confirmed, Twitter acknowledged that it was “possible” outside parties could access and view this information.

So what information was exposed? According to the official statement, email addresses, phone numbers and the last four digits of clients’ credit card numbers were the key pieces of data that may have been compromised. 

Who Was Affected?

As previously stated, Twitter has yet to give an official estimate on how many businesses were affected.

This isn’t the first time the tech giant has had issues with data security. In 2018, a site wide bug affected some 330 million users and compromised the password credentials of all business users involved. If this benchmark offers any guess, it’s likely that the current data breach has impacted a broad range of clients.

Non-Twitter users are not thought to be affected. As of May 20th, 2020, the caching issue has been resolved.

What Now?

While news of leaked information is no doubt a terrifying prospect, there’s no need to panic just yet. Modern businesses are more connected than ever through the collaborative powers of social media. That means business owners must prioritize internet security in an increasingly digital world in order to meet the needs of today’s compliance standards.

If your business was affected by the breach, take a moment to review your system information for any indications of a hack. It’s a good idea to call in the professionals and utilize the knowledge of a trained IT consultant to identify any potential threats or vulnerabilities. Ensure all passwords are changed and updated (sentence form passwords are best). If your company has suffered a data loss or been the victim of malicious Ransomware attempts, don’t give in to cyber criminal just yet. Backup and disaster recovery options are available for small and mid-sized businesses.

Once you’ve assessed the damage and come out on top, consider proactive ways to prevent cyber attacks moving forward. Always clear your browser cache at the end of each day or set your browser to automatically clear so that stored information is not visible. Ask your IT consult about curating how your information is transmitted online. VPN’s — or virtual private networks — are a great option for masking and securing your online identity. A robust firewall and a comprehensive network and data security system is the best way to stop cyber criminals in their tracks and protect your valuable information.

Ask our Fort Lauderdale experts for more helpful tips and strategies for making your business #unbreakable.