Untangled Solutions

Partner announces new secure mobile interface for healthcare systems

jsmith — Wed, 18 Jan 2012 21:05:02 +0000

EchoBase, a provider of “mobile interface” solutions for the healthcare industry, has announced a new integration with Gazzang to power secure access to clinical systems — providing physicians and clinicians mobile access to things like patient medical records and other internal systems while limiting the risk of sensitive data breach or exposure.

Through its “Resonate” solution, echoBase provides a single mobile interface to electronic medical record, practice management, clinical and financial systems that allows clinicians to interact with electronic patient data in real-time, with or without an Internet connection. The solution currently works on both Apple iPads and iPhones/iPod Touches.

Gazzang’s solution, dubbed “ezNcrypt,” provides high performance, transparent data encryption for Linux, MySQL and other open source applications and services without requiring changes to the existing database or application code. It also ensures critical compliance with regulatory mandates including HIPAA, HITECH and Meaningful Use guidelines. Working together, both echoBase and Gazzang provide an end-to-end, secure solution for clinicians to access and manipulate sensitive data from internal systems, without the worry of costly regulatory violations or fear of data breaches — which has become a major issue lately.

“Security of patient information is an absolute requirement for our customers. You can’t handle this information ‘casually’ when people’s health and medical care is at stake,” said Brent Miller, President of echoBase. “That’s why we turned to Gazzang to provide an impeded layer of infrastructure for all of our mobile interface offerings. Gazzang’s ezNcrypt solution was easy to implement and integrate as the critical security fabric for our Resonate solution.”

From article on 12/29/11: http://mhealthwatch.com/echobase-debuts-secure-mobile-interface-for-healthcare-systems-using-gazzang-encryption-18480/

First episode of Untangling Healthcare IT Podcast

jsmith — Tue, 01 Nov 2011 23:50:51 +0000

It’s our first episode! We jump right into things with Jason LeDuc to discuss how a medical office can cost-effectively perform a security and privacy assessment that not only is required by Meaningful Use, but also a great way to get a handle on new requirements enacted by HIPAA/HITECH.

Listen HERE

TRICARE Breach Affects 4.9 Million

jsmith — Fri, 30 Sep 2011 16:58:27 +0000

Incident Involves Theft of Backup Tapes
September 29, 2011 – Howard Anderson, Executive Editor, HealthcareInfoSecurity.com

About 4.9 million patients treated in San Antonio area military treatment facilities since 1992 have been affected by a health information breach involving the theft of backup tapes for electronic health records, federal officials say. If the numbers hold up, this would be the largest breach reported since the HIPAA breach notification rule, mandated under the HITECH Act, took effect in September 2009.

The Defense Department’s TRICARE healthcare program, which serves active-duty troops and their dependents, as well as military retirees, says one of its business associates, Science Applications International Corp., reported the breach Sept. 14. The tapes were stolen from the car of an SAIC employee who was responsible for transporting the tapes between federal facilities in San Antonio “pursuant to contract requirements,” an SAIC spokesman says.

“There is no indication that the data has been accessed by unauthorized persons,” the SAIC spokesman says. SAIC is working with the local police department, Defense Criminal Investigative Services and a private investigator to attempt to recover the tapes, the spokesman adds.

Information on the breached tapes may have included Social Security numbers, names, addresses, phone numbers and some personal health data, such as clinical notes, lab tests and prescriptions, according to a TRICARE statement. The tapes did not contain any financial data.

“Some personal information was encrypted prior to being backed up on the tapes,” the SAIC spokesman says. “However, the operating system used by the government facility to perform the backup onto the tape was not capable of encrypting data in a manner that was compliant with a particular federal standard. The government facility was seeking a compliant encryption solution that would work with the operating system when the backup tapes were taken.”

TRICARE “does not have a policy” on encryption of backup tapes, a TRICARE spokesman says.

Under the HIPAA breach notification rule, breaches of information encrypted in compliance with a federal standard do not have to be reported.

“The risk of harm from loss of the tapes is judged to be low since retrieving the data on the tapes requires knowledge of and access to specific hardware and software, and knowledge of the system and data structure,” according to SAIC.

Reviewing Data Protection

Both SAIC and TRICARE are “reviewing current data protection security policies and procedures to prevent similar breaches in the future,” according to the TRICARE statement.

TRICARE and SAIC also are working together to identify all beneficiaries whose information may have been involved. “Individual notifications have not begun,” a TRICARE spokesman says. “That determination will be made based on the results of the ongoing investigation.”

SAIC and TRICARE have not yet determined whether any patients affected by the breach will be offered free credit protection services, the TRICARE spokesman says. “That will be determined based on the results of the ongoing investigation, when a more accurate estimation of the risk to our beneficiares will be possible,” he adds.

Those affected by the breach, according to the TRICARE statement, were patients who received care (including the filling of pharmacy prescriptions) from 1992 through Sept. 7, 2011, at San Antonio area military treatment facilities, and others whose laboratory workups were processed in these facilities even though the patients were receiving treatment elsewhere.

A brief statement on the SAIC website acknowledges that the company has set up an “incident response call center,” but provides no further details beyond a link to TRICARE’s statement.

TRICARE hired SAIC to handle “the storage of some TRICARE health information,” the TRICARE spokesman says. “That contract continues.”

The TRICARE incident is one of five affecting more than 1 million individuals that have been reported since the HIPAA breach notification rule took effect (see: Healthcare Breaches: A New Top 5).

Reaction to the Incident

Security consultant Kate Borten, president of The Marblehead Group, says: “What’s particularly distressing about this news is that TRICARE should be encrypting. The organization should have had reasonable controls in place.”

Borten also questions whether the risk of someone accessing the data on the stolen backup tapes is, indeed, low. “The potential gain from almost 5 million records to data mine and sell might be motive enough” for someone to take all the necessary steps to access the data, she says.

Borten notes that more healthcare organizations are dropping the use of tapes and other physical media for backup purposes, shifting to an Internet-based, or cloud computing, backup storage model. “Of course, there are security risks either way,” she notes. But by using the Internet, “there are no more tapes to get lost or stolen.”

All healthcare organizations that use backup tapes must take adequate steps to protect the tapes, says Adam Greene, a former official at the Department of Health and Human Services’ Office for Civil Rights, which enforces the breach notification rule. “In general, it’s important for HIPAA covered entities to ensure that backup tapes are included in their risk analysis and risk management plan,” says Greene, a partner at the law firm Davis Wright Tremaine LLP. “If encryption is not feasible, covered entities should focus on strong administrative and physical safeguards, such as clear procedures that ensure that backup tapes are locked up at all times.”

Greene notes that when business associates maintain backup tapes, healthcare organizations need to thoroughly investigate how the tapes are safeguarded to help avert large potential breaches.

http://www.healthcareinfosecurity.com/articles.php?art_id=4105&opg=1

PwC: Health industry under-prepared to protect privacy

jsmith — Fri, 23 Sep 2011 00:31:04 +0000

By Mike Miliard, Managing Editor

Created 09/22/2011

NEW YORK – Most health organizations are under-prepared to protect patient privacy and secure personal health information as new uses for digital health data emerge and access to confidential patient information expands, according to a new report from PwC’s Health Research Institute.

Old privacy and security controls no longer suffice to comply with existing privacy laws and patient consent agreements, say to PwC officials – who emphasize that health organizations need to update practices and adopt a more integrated approach to ensure that patient information doesn’t fall into the wrong hands.

The report, titled “Old data learns new tricks: Managing patient privacy and security on a new data-sharing playground,” shows how existing privacy and security controls have not kept pace with new realities in healthcare: increased access to information in electronic health records; greater data collaboration with external partners and business associations; the emergence of new uses for digital health information to improve the quality and cost of care; and the rise of social media and mobile technology to better and more efficiently manage patient health.

A recent nationwide PwC Health Research Institute survey of 600 executives from US hospitals and physician organizations, health insurers, and pharmaceutical and life sciences companies found:

Theft accounted for 66 percent of total reported health data breaches over the past two years. Also, medical identity theft appears to be on the rise. Over one third (36 percent) of provider organizations (hospitals and physician groups) confirmed that they have experienced patients seeking services using somebody else’s name and identification.
More than half (55 percent) of health organizations surveyed have not addressed privacy and security issues associated with the use of mobile devices, and less than one-quarter have addressed privacy and security implications of social media.
More than half (54 percent) of health organizations surveyed reported at least one issue with information privacy and security over the past two years.
The most frequently reported issue among providers was the improper use of protected health information by an internal party. Over the past two years, 40 percent of providers reported an incident of improper internal use of protected health information.
The most frequently reported issue among health insurers and pharmaceutical and life science companies was the improper transfer of files containing personal health information to unauthorized parties. Over the past two years, one in five (21 percent) pharmaceutical and life sciences companies and one in four (25 percent) of health insurers improperly transferred files containing protected health information.

“Although paper-based health information breaches must now be disclosed under the breach notification provision under the HITECH Act, electronic data breaches occur three times more frequently and affect 25 times more people when they occur,” said James Koenig, director and co-leader, Health Information Privacy and Security Practice, PwC. “Most breaches are not the result of IT hackers, but rather reflect the increase in the risks of the knowledgeable insider related to identity theft and simple human error – loss of a computer or device, lack of knowledge or unintended unauthorized disclosure.”

Continued on next page.

A culture of confidentiality
PwC’s research found considerable concern for the “knowledgeable insider.” On average, improper use of personal health information by an internal party was the leading privacy/security issue experienced by healthcare organizations over the last two years. Because of lack of awareness or training, breaches can result easily and with greater probability from mishandling of paper documents, people talking in the elevator, or comments made via social media channels. In addition, risks of data breaches and the complexity of consent agreements rises when information is shared with business associates, the source of more than half of reported health data breaches affecting more than 11 million people since 2009.

PwC’s survey found:

More than half of healthcare organizations allow access to social networking while at work; less than half have a policy covering the use of social media outside of work.
Less than half (37 percent) of health organizations surveyed incorporate approved uses of mobile devices and social media as part of company privacy training.
Only 58 percent of providers and 41 percent of health insurers say they include the appropriate use of electronic health records (EHR) as part of employee privacy training.
Only 36 percent of health organizations perform a pre-contract assessment of their business associates such as business partners and vendors, and just 26 percent conduct post-contract compliance assessments.

Opportunities and risks
Digitized health data is becoming one of the most highly valued assets in the health industry, and, according to PwC, all kinds of organizations are now converging around the shared use of the information to enable new care delivery models such as accountable care organizations, outcomes-based reimbursement and the advance of wellness, preventive and personalized care.

Organizations also are discovering the potential in secondary uses of the information beyond treating patients, such as in clinical studies, post-market surveillance of drugs and the development of new products and services to better understand patient health and behaviors. Yet PwC found that while many organizations are sharing information, the complexity of consent further increases and few organizations have established proper restrictions and consent agreements to control proper access. PwC’s research found that:

Only 17 percent of providers, 19 percent of payers and 22 percent of pharmaceutical/life sciences companies have a process in place to manage patients’ consent for how their information can be used.
Nearly three quarters (74 percent) of healthcare organizations surveyed said they already do or intend to seek secondary uses for health data; however, less than half have addressed or are in the process of addressing related privacy and security issues.
Sixty-one percent of pharmaceutical and life sciences companies, 40 percent of health insurers and 38 percent of providers currently share information externally. Of those organizations that share data externally, only two in five pharmaceutical and life sciences companies (43 percent) and one in four insurers (25 percent) and providers (26 percent) have identified contractual, policy or legal restrictions on how the data can be used.

A new approach
PwC’s research found that the recent increase in breach enforcement actions have prompted health organizations to focus more on privacy and security, and that there is growing recognition of privacy and security compliance as central to maintaining a trusted brand.

“To protect patient trust and their own brand reputation, organizations need to go beyond minimum regulatory requirements and adopt an integrated approach that combines privacy, security and compliance within a culture where all employees see themselves as champions of confidentiality and where privacy is part of the patient experience,” said Peter Harries, principal and co-leader, Health Information Privacy and Security Practice, PwC.

Organizations with integrated approaches to privacy and security say they have realized the benefits, including a significant increase in data security and a slight decrease in the number of privacy/security issues, depending on the extent of their integration. PwC found that health insurers were more likely than providers and pharmaceutical/life sciences companies to have integrated their approach to a great extent.

A full copy of PwC’s report can be found here.

Source URL: http://www.healthcareitnews.com/news/pwc-health-industry-under-prepared-protect-privacy

Untangled Solutions Featured In MSPmentor Article

jsmith — Mon, 19 Sep 2011 20:22:12 +0000

How to Master Consultative Value-based Selling

Posted September 19th, 2011 by Ted Roller

As a managed IT services provider, it’s important for your team to have strategic consulting skills and effective processes, which ultimately lift sales. Think about the following words: Proficiency. Expertise. Talent. Skill. Art. Knowledge is power. Working with the most knowledgeable and talented people on the planet is a great way to relieve stress, move your business forward, and sleep well at night. As a business owner, working with experts whose expertise and integrity you trust is a truly magical experience. Check the box, move on to the next problem. These guys have my back.

As a buyer, the experience is manna from heaven. As an MSP, delivering that experience consistently is the difference between success and failure. The good news is that the ability to deliver that kind of experience is completely achievable. In fact, it is easier to be consistent here than it is with availability and backup. Here are a few things you need to think about.

Develop expertise. I work with Intronis partners Josh Smith and Chris Johnson from Untangled Solutions in California. Several years ago, as the result of some lessons learned from taking part in the MSP Simulator hosted by CompTIA, these guys decided to get strategic and focused about their business. They evaluated their customer base and their own expertise with one goal in mind – to figure out which customers they were helping the most. After quite a bit of research and thought, they focused their business on getting better at delivering healthcare value. Two years later, and these guys are making a killing and are working exclusively in the healthcare space. They deliver more value. They win more jobs and get more referrals. The customers are happier. Not hard to do, just smart.

Study hard. If you choose to find out what you are good at, like my friends at Untangled, the next job is to become the best around at what you do. Assuming you chose to do something that you already enjoy some level of expertise with, spend time figuring out what you don’t know and what problems you cannot solve for your customers and go get that core competency. Certification, vendor training, hands on effort, hiring the right resources and whatever else it takes to establish that level of competency. Make a plan and go do it. Get better than everyone else and enjoy the view from above.

Build effective process. Recently I was on the phone with a Canadian Master MSP who is growing like a weed and signing up resellers on an almost daily basis. As a result of an inability to scale to the mid-market effectively, in addition to razor thin margins, the Master MSP model has been suffering over the last few years. So, I asked him what he was doing that was different – here was his answer. “We are entirely process driven. In fact, process is our primary focus. As a result, we deliver a level of consistency that our predecessors were unable to achieve. Our MSP customers know what to expect from us every time. It makes a huge difference.”

Do what you are good at, invest in getting better at it, and make it reliable and repeatable. I hope that sounds somewhat familiar to everyone. It is really at the core of what most coaches are telling their MSP customers to do. The only thing I would add is to be deliberate about it. Make the way you do these things the focus, not the things themselves. Then, you can pick almost anything and be successful with it.

From article: http://www.mspmentor.net/2011/09/19/how-to-master-consultative-value-based-selling/

Stanford hospital breach shows danger of losing data control

jsmith — Fri, 09 Sep 2011 20:40:33 +0000

September 08, 2011 | Molly Merrill, Associate Editor

PALO ALTO, CA – Patient data lost while in the hands of a business associate becomes “extraordinarily” difficult to track, says one expert, who identified data-centric protection as a way to safeguard information like that recently exposed at Stanford Hospital and Clinics.

The New York Times is reporting that the Stanford breach involved the medical records of 20,000 emergency patients, containing information such as names, diagnosis codes, account numbers, admission and discharge dates and billing charges for patients seen during a six-month period in 2009.

The sensitive information was residing on a website called “Student of Fortune” for almost a year before it was discovered by a patient. Hospital officials are unsure how this data, in the form of a spreadsheet, got on the site, as it was in the care of its billing contractor – identified as Multi-Specialty Collection Services, according to the New York Times.

When sensitive data like this is shared with a business associate, a provider is “essentially buying their capacity to protect that information,” says Geoff Webb, director of product marketing at Credant Technologies in Addison, Texas.

Webb says he would expect that if the billing company was handling this type of sensitive data it would have technical controls in place such as real-time monitoring capabilities, data loss prevention, encryption and post breach analysis and monitoring. (How would anyone know without a Risk Analysis?)

But when data is taken outside an organization’s network, he says it’s critical that there’s data-centric protection as well, which would serve to protect the data even if an employee moved it around.

Webb says healthcare organizations need to “nail” these data control issues now – especially as cloud adoption becomes more prevalent. Indeed, these breaches will look modest compared to what could happen in the future, given the amount of data that can be stored in the cloud, he warns.

http://www.healthcareitnews.com/news/stanford-hospital-breach-shows-danger-losing-data-control?topic=06,08,17,29,18,19

Chris Johnson Named Chairperson for CompTIA Healthcare IT Community

jsmith — Tue, 14 Jun 2011 16:56:30 +0000

FOR IMMEDIATE RELEASE

Los Angeles-based IT managed service provider Untangled Solutions announces the election of main principal Chris Johnson as Chairperson of the Healthcare IT Community for CompTIA, a non-profit association and recognized global leader in IT workforce development.

CompTIA representatives stated, “The CompTIA Healthcare IT Community addresses the challenges and opportunities in the creation, delivery and service of healthcare-related technologies. This community is focused on creating standards, best practices and educational resources for IT businesses developing a healthcare solutions practice. EMR (electronic medical records), HIPAA (Health Insurance Portability and Accountability Act), and public policy initiatives are key focus areas for this group.”

Chris Johnson responded to the selection by saying, “I am passionate about seeing the healthcare IT community grow. My aim will be to reach out to the partners and vendors that we have built relationships with to help create educational content and participate in our goals of a vendor-neutral community. This is what drives our business successes and gives the healthcare industry a beacon they can set their sights on. Our goal is to create a resource for healthcare providers looking for IT support that will meet or exceed the requirements and regulations in the healthcare community.”

For additional information, contact Joshua Smith at Joshua@UntangledSolutions.com, call 909-563-8575 x102, or visit www.UntangledSolutions.com.

About Company: Untangled Solutions LLC is a Los Angeles-based IT Managed Service Provider (MSP) offering consulting and solutions for business/technology needs in the healthcare sector.

Interview: Offering cloud-managed wireless LAN services (via SearchNetworkingChannel.com)

jsmith — Tue, 05 Apr 2011 21:37:29 +0000

Many small and medium-sized businesses don’t have the on-site IT staff to implement and manage a wireless LAN, but a new offering from PowerCloud Systems enables IT consultancy Untangled Solutions to offer cloud-based wireless LAN. Using PowerCloud, Los Angeles-based Untangled Solutions can drop D-Link wireless Access Points (APs) into a client site and then monitor and manage them remotely from the cloud. Untangled Solutions has provided this cloud-managed wireless LAN service for only a few months, but Untangled strategist Joshua Smith tells SearchNetworkingChannel.com how effective the technology has been so far. Link to full article

CloudCommand Press Release Quotes Untangled Solutions

jsmith — Tue, 21 Dec 2010 20:30:17 +0000

Joshua Smith of Untangled Solutions recently was quoted on his review of the cloud-based wireless network management service CloudCommand™ in a press announcement made by PowerCloud Systems, Inc.. The article announces feedback from IT professionals highlighting how this cloud-based technology is revolutionizing the way VARs profitably deploy and manage wireless networks in the SMB market.

From the article: Untangled Solutions, Los Angeles’ leading IT consultancy for healthcare, has been testing a CloudCommand-powered wireless network, and Joshua M. Smith, one of Untangled’s leading strategists, says: “I’m beyond happy with the performance and really appreciate the SMS alert feature. When there is a network issue, the access point immediately texts our engineer’s cell phone, and he fixes the problem from his desk before the customer even knows something’s wrong.”

Untangled Solutions began implementing this network management service several months ago as part of our full managed services offering. The service allows us to maintain our clients’ networks seamlessly and proactively eliminating downtime.

Press Release:http://www.prnewswire.com/news-releases/cloudcommand-powered-d-link-access-point-earning-raves-from-channel-112236249.html

Learn more about Untangled Solutions’ Managed Services: http://www.untangledsolutions.com/services/

Untangled Solutions partners with eGestalt for HIPAA compliance solution

jsmith — Mon, 13 Dec 2010 22:03:11 +0000

Untangled Solutions has partnered with eGestalt to offer SecureGRC SB to the small medical providers, which is part of our solution in getting medical practices in compliance with HIPAA and the HITECH Act.

eGestalt’s SecureGRC SB is specifically designed for smaller Covered Entity’s (CE), which includes single practitioners and small medical groups in the Healthcare field. This includes Doctors, Dentists, Chiropractors, and Psychologists, Nursing care or any small practice that deals with patient health information (PHI). This service allows simplified HIPAA/HITECH compliance for the private medical practice.

Chris Johnson (CEO, Untangled Solutions) stated, “Healthcare IT solution providers need a tool to help their medical practice clients with conforming to HIPAA and other compliance standards. eGestalt takes the mystery out of the compliance process. eGestalt allows us to automate the audit process and provide tangible evidence of what needs to be addressed and how to address it within a medical practice.”

Download PDF for additional details.

eGestalt Technologies Inc is a world-class, innovation driven, leading provider of cloud computing based Enterprise solutions for Information Security and IT-GRC Management. eGestaltis headquartered in Santa Clara, California, and has offices in US, Asia-Pacific and Middle East.