Responding to Skyrocketing Cyber Attacks Managing Risk, Responding - PowerPoint PPT Presentation

Presenting a live 90-minute webinar with interactive Q&A Data Breaches in Healthcare: Responding to Skyrocketing Cyber Attacks Managing Risk, Responding to Breaches and OCR Investigations, Minimizing HIPAA Liability THURSDAY, MARCH 24, 2016 1pm Eastern | 12pm Central | 11am Mountain | 10am Pacific Today’s faculty features: Joshua Carlson, Principal, Joshua Carlson, P.A. , Minneapolis Richard DeNatale, Partner, Jones Day , San Francisco Todd S. McClelland, Partner, Jones Day , Atlanta The audio portion of the conference may be accessed via the telephone or by using your computer's speakers. Please refer to the instructions emailed to registrants for additional information. If you have any questions, please contact Customer Service at 1-800-926-7926 ext. 10 .

Tips for Optimal Quality FOR LIVE EVENT ONLY Sound Quality If you are listening via your computer speakers, please note that the quality of your sound will vary depending on the speed and quality of your internet connection. If the sound quality is not satisfactory, you may listen via the phone: dial 1-866-927-5568 and enter your PIN when prompted. Otherwise, please send us a chat or e-mail sound@straffordpub.com immediately so we can address the problem. If you dialed in and have any difficulties during the call, press *0 for assistance. Viewing Quality To maximize your screen, press the F11 key on your keyboard. To exit full screen, press the F11 key again.

Continuing Education Credits FOR LIVE EVENT ONLY In order for us to process your continuing education credit, you must confirm your participation in this webinar by completing and submitting the Attendance Affirmation/Evaluation after the webinar. A link to the Attendance Affirmation/Evaluation will be in the thank you email that you will receive immediately following the program. For additional information about continuing education, call us at 1-800-926-7926 ext. 35.

Program Materials FOR LIVE EVENT ONLY If you have not printed the conference materials for this program, please complete the following steps: Click on the ^ symbol next to “Conference Materials” in the middle of the left - hand column on your screen. Click on the tab labeled “Handouts” that appears, and there you will see a PDF of the slides for today's program. Double click on the PDF and a separate page will open. Print the slides by clicking on the printer icon.

Data Breaches in Healthcare: Responding to Threat of Cyber Attacks March 24, 2016 Richard DeNatale Todd McClelland

Introduction Numerous factors have combined to create a “perfect storm” of cybersecurity risk in the healthcare sector • External factors • Targeted by cyber criminals • Targeted by state actors • Black market for PHI • Systemic factors • Multiple points of entry create vulnerabilities • Culture of open information exchange creates security challenges • Some companies slow to invest in IT infrastructure and security 6

Introduction Numerous factors have combined to create a “perfect storm” • Legal/regulatory factors • Highly regulated industry • Mandatory disclosure requirements • Regulators becoming more focused on enforcement • Aggressive and experienced plaintiffs’ class action counsel • Legal landscape may be shifting in favor of plaintiffs on standing and damages issues 7

Source: Verizon DBIR 2013-2015 8

Topics I. Breach Preparedness Strategies A. Cyber risk assessments B. Vendor management C. Cyber Insurance II. Responding to the Breach A. Effective response planning B. PHI reporting and notice obligations C. Damage mitigation D. Pursuing insurance recovery III. Responding to an OCR investigation A. HIPAA and regulatory compliance B. Interacting with regulators C. Establishing investigation parameters D. Data protection 9

Cyber Risk Assessments 10

Key HIPAA Assessment Activities • Assessments are required under the HIPAA Security Rule. For example: • 164.308(a)(1)(ii)(A) – Conduct a risk analysis • 164.308(a)(1)(ii)(B) – Implement a risk management program • 164.308(a)(8) – Periodic evaluation 11

Key Assessment Activities  Risks and risk management program  Identify ePHI data flows and changes to systems  Compliance gap analysis and mitigation recommendations  Review Incident Response Plan(s)  Review applicable security policies and procedures  Meet key information security stakeholders  Review insurance policies  Review key vendor contracts and investigate “Shadow IT”  Data governance program review 12

Questions your risk assessment should help you answer  Who has access to your data?  Where do you process, store, create or receive ePHI?  Who is responsible for your information security program, especially w/r/t ePHI?  What are your “use cases”? What ePHI do you create or receive? How is it  Is your data appropriately secured? used?  Are information/systems monitored?  What are the threats (internal and  What is the impact if information is lost, external) to your ePHI? accessed or compromised?  Is your data identified and classified?  Are you prepared for a breach?  Is someone reviewing your logs? How  How do you dispose of your data? often?  Are you storing documentation related to  Who within your organization knows your security program? the answers to these questions ? 13

Vendor Management 14

Due Diligence • Increasing due diligence • Senior management is becoming more aware of third party exposure • In large part arising from potential legal exposure and enforcement actions • Contracting parties are becoming more inquisitive • Questionnaires • Breach history • Security Walk-throughs • Third party audit/assessment review • Substantiate due diligence was conducted • Spend is not the right metric for determining which deals get scrutinized. 15

Contracts  Privacy and security issues continue to be contentious in vendor contracts:  HIPAA compliance  Risk apportionment, insurance  Privacy and security representations, warranties and commitments  Breach notification  Audit rights  Changes / Governance  Cloud 16

Audits • Common after breach disclosures • Increasing actions against those who fail to regularly review their third party vendors • Customer/Vendor Tensions: • Frequency • Cost • Who conducts the audit • What level of access • Scope • Cloud services 17

Expectations for 2016+  Continuing push for risk assessment formalization that will include third party vendors.  More enforcement actions  More risk for companies that outsource their data processing activities  Growing complications with breach response, especially cloud. 18

Quick Hits  CISOs and counsel need to work more closely together when contracting with vendors.  Vendor day.  Stay tuned to laws that will affect vendor relationships.  Update dated vendor contracts to address privacy and security issues. 19

Cyber Insurance 20

Cyber Insurance  Insurance coverage has become a critical part of breach preparedness.  Three major shifts in U.S. insurance market over past decade:  New categories of emerging cyber risk Development of new cyber policy forms   Exclusion of cyber/internet exposures from traditional policies  CGL Policies - Personal Injury Coverage • Traditionally covered “publication, in any manner, of material that violates a person’s right of privacy” – including claims involving electronic data transmitted over the internet • As of April 1, 2014, new exclusion added to standard ISO form barring coverage for data breach claims 21

Cyber Insurance Cyber Insurance policies cover five major categories of costs 1.Third-party liability coverage for claims and lawsuits  Arising out of security breach, disclosure of PII/PHI, violation of company privacy policy  Covers cost of defense, settlement, or judgment 2.Regulatory coverage for government claims and investigations  Covers cost of defense, fines, or penalties o Make sure definition of “Claim” includes OCR investigations 22

Cyber Insurance 3. Event Management/Data Breach Response coverage  Covers cost of post-breach forensic and legal investigations 4. Privacy Notification Coverage  Covers cost of breach notice to affected individuals (customers, patients)  May cover credit monitoring or identity theft protection for affected individuals 5. First Party Coverage, akin to property insurance  Covers cost of restoring data and systems  Business interruption coverage for lost revenue 23

Cyber Insurance • Legal fees for breach response Response • Forensic investigation Costs • Breach Notice • ID protection/credit monitoring • Class action defense costs and settlement • Defense of government proceedings Legal Claims • Government fines/penalties • Card brand claims & assessments • Restoration of data Business • Lost revenue/business interruption Losses • Extra expenses • Loss of goodwill / customer confidence 24