WEBVTT
00:00:08.224 --> 00:00:35.457
Thank you.
00:00:35.457 --> 00:00:37.658
Welcome to another episode of Merger.
00:00:37.658 --> 00:00:43.287
She Wrote, I'm Paloma Goggins with Nocturne Illegal, and today I am hosting Paige Hansen.
00:00:43.287 --> 00:00:47.704
She is the co-founder of Secure Labs and a cyber safety expert.
00:00:47.704 --> 00:00:54.466
She is a renowned authority in consumer and digital safety with nearly two decades of experience in identity management.
00:00:54.466 --> 00:01:00.968
She is a frequent speaker at nationwide events raising awareness about identity theft and related issues.
00:01:00.968 --> 00:01:03.060
Thank you so much, paige, for being on today.
00:01:03.060 --> 00:01:04.143
Thanks for having me.
00:01:04.143 --> 00:01:07.028
So we'll just dive right into the questions.
00:01:07.028 --> 00:01:08.751
I think from.
00:01:08.751 --> 00:01:10.694
Let's take it from the top.
00:01:10.694 --> 00:01:15.510
Let's say you are a business that's doing really well, you're scaling.
00:01:15.510 --> 00:01:18.823
You're thinking at some point in the future of exiting.
00:01:18.823 --> 00:01:20.087
You know what?
00:01:20.087 --> 00:01:22.572
I have my list of questions here that I have for Paige.
00:01:22.572 --> 00:01:27.227
So if you're watching this podcast instead of listening, you'll see me look down from time to time.
00:01:27.227 --> 00:01:33.787
So what would you say is the most common cyber threats that a scaling company can focus?
00:01:33.787 --> 00:01:36.468
And if you want to be industry specific, go ahead.
00:01:36.468 --> 00:01:38.147
Otherwise, generalities work too.
00:01:38.879 --> 00:01:41.349
Yeah well, I think, generally it just depends on your size.
00:01:41.349 --> 00:01:56.647
If you're a smaller company, you have to think of it more as threats that are happening to your employees, so phishing emails, multi-factor authentication, intruders trying to get in kind of the high level, low hanging fruit.
00:01:56.647 --> 00:02:10.542
If you're a larger company, that's when you get more of a third party risk and you have other factors Because, if you think about it, the larger the company, the more systems you're going to have in place, the more vendors you're going to be using.
00:02:10.762 --> 00:02:30.780
Therefore, your risk is greater so true, yeah, I think the layering of complexity is one of those pieces that people forget, right, the more you grow and the more complicated your systems become, the more you have that chance for loopholes or areas where someone could sneak in and get into a system.
00:02:30.780 --> 00:02:39.754
I want to back up a moment, because you talked about what a smaller business might be dealing with when it comes to phishing.
00:02:39.754 --> 00:02:43.350
I feel like that is universally both big and small company.
00:02:43.350 --> 00:02:46.419
If you've worked in corporate America, you've seen the phishing test.
00:02:46.419 --> 00:02:47.784
You've failed the phishing test.
00:02:47.866 --> 00:02:48.328
Oh, absolutely.
00:02:49.301 --> 00:02:50.004
The better phrase.
00:02:50.004 --> 00:03:08.604
But you know, I think a lot of people who are running smaller you know, family owned and operated businesses, aren't necessarily thinking about implementing phishing type traps to teach their employees hey, don't click on things without checking them out.
00:03:08.604 --> 00:03:10.247
You know what are some first steps.
00:03:10.247 --> 00:03:16.932
Let's say you're operating a business and it's been really successful all these years, but you've never really even thought about cybersecurity.
00:03:16.932 --> 00:03:17.921
Where do you start?
00:03:18.323 --> 00:03:27.908
Well, I'll acknowledge that usually cybersecurity is an afterthought, and it I mean you're thinking about building your business and your client base and just everything around building your business.
00:03:28.520 --> 00:03:31.341
Usually and generally, cybersecurity isn't like you know what.
00:03:31.341 --> 00:03:34.471
Let's pause and fish test our employees.
00:03:34.471 --> 00:04:14.122
So let's acknowledge that that's a thing, and that is the clients that I deal with are small to medium-sized businesses and so, taking a step back and realizing these fraudsters are working in scam compounds 24-7, trying to find a hole, trying to find a way in, so not only us as consumers have to have our guard up, but as a business, and especially a profitable business, where you may have loopholes in your invoicing, the way you invoice, and there might not be controls in place, where you have multiple people authenticating invoices or outreach and things like that.
00:04:14.122 --> 00:04:30.228
That's a problem and as you whether you're growing or you're really small you have to know that that's a priority, because one potential you know invoice that you pay or ransomware in your organization.
00:04:30.228 --> 00:04:39.980
60% of small businesses, according to the National Cybersecurity Alliance, do not recover when they've had a cyber incident, and that's a big problem.
00:04:39.980 --> 00:04:41.483
That's that's crazy.
00:04:42.605 --> 00:05:06.053
I mean you know, you hear about in the news organizations that have had and especially in the medical world, right, but you hear of these organizations that have had someone breach their infrastructure and then they get locked out of their computer systems or they get locked out of their records and are held essentially for ransom.
00:05:06.053 --> 00:05:13.327
And you hear about these companies that make the decision to pay the ransom and get their things back.
00:05:13.327 --> 00:05:21.666
And the crazy part is what, if you pay the ransom and you don't get your things back, right, I mean it's not like it's a guarantee.
00:05:21.687 --> 00:05:22.951
It's not a guarantee.
00:05:22.951 --> 00:05:26.867
You're definitely taking a chance and the FBI will say do not pay the ransom.
00:05:26.867 --> 00:05:36.608
And I think a lot of businesses segment themselves and they think, okay, we've got to get a, whatever the reason is, whether they want to get their data back or they don't want the news to break that they had a data breach.
00:05:36.608 --> 00:05:38.882
But it all depends on the end goal.
00:05:38.882 --> 00:05:39.583
So here you are.
00:05:39.583 --> 00:05:46.132
Okay, maybe you do go to the FBI for help, but you need to get on it right away.
00:05:46.132 --> 00:05:49.375
It's not a oh, let's figure this out over the weekend by ourselves.
00:05:49.375 --> 00:06:00.740
No, you need to involve them right away because, depending on their data, that they've stolen or have access to, it really depends.
00:06:01.240 --> 00:06:02.706
Now, who knows what's going to happen?
00:06:02.706 --> 00:06:04.603
You know, is it client data, is it payment data?
00:06:04.603 --> 00:06:13.725
But that's also a really important note to say what controls do you have in place internally?
00:06:13.725 --> 00:06:17.314
Do you have a control where you back up your company's data every year, every quarter, every month?
00:06:17.314 --> 00:06:24.706
Is it air-gapped or segmented, so it's not on the same network as the rest of your data that could potentially be compromised?
00:06:24.706 --> 00:06:29.572
These are all things that you go through if you're following a cybersecurity framework.
00:06:29.572 --> 00:06:31.266
So there's a NIST cybersecurity framework.
00:06:31.266 --> 00:06:35.980
There is a SOC 2 cybersecurity framework that helps with privacy and security.
00:06:35.980 --> 00:06:47.362
These sort of things help as almost like a checklist of things that baseline you should be doing as an organization things that baseline you should be doing as an organization.
00:06:47.382 --> 00:07:05.754
I want to go back to what you were saying just a little bit before about how the data that's breached I mean, I think in a lot of the perspective of the business owner is not necessarily thinking about breach, in that it can fall into two separate buckets that have two sort of separate impacts to the business.
00:07:05.754 --> 00:07:23.846
One is, you know, like you were talking about the integrity of invoicing and sort of chain of custody, right, as you might discuss, like how you know invoice is sent to someone and is paid, and is there the potential for someone to duplicate or make that process look very, very similar?
00:07:23.846 --> 00:07:28.303
So a client sees it, pays, it doesn't realize they just paid someone else.
00:07:28.303 --> 00:07:43.733
But that's something that impacts the bottom line of the business, whereas what you were talking about just a few minutes ago, where the breach of data is client information, you know, maybe it's social security numbers, maybe it's health information.
00:07:43.733 --> 00:07:51.887
I mean, sometimes I feel like when you talk with people about cybersecurity, they're thinking about only one of those buckets, right, right.
00:07:52.288 --> 00:07:53.793
It is, and that's the thing.
00:07:53.793 --> 00:07:55.507
It's not just one thing.
00:07:55.507 --> 00:07:57.766
I get asked all the time what's the one thing?
00:07:57.766 --> 00:07:58.790
And maybe you'll ask this later.
00:07:58.899 --> 00:08:01.064
What's the one thing a business should do or should think of?
00:08:01.064 --> 00:08:01.906
And it's not.
00:08:01.906 --> 00:08:19.120
It can't be one thing because, to your point, you have access controls within your business operation that need to be tied down, but then you also have the access and the identity management of your client data, your company data, your business IP.
00:08:19.120 --> 00:08:23.987
All of that that I think a lot of people put in the same buckets, but they're not.
00:08:23.987 --> 00:08:30.096
They're ways to be vulnerable and have exposure unwanted exposure at that.
00:08:31.221 --> 00:08:42.831
So if you had to describe for someone who's just starting to look at compliance and cybersecurity, you know obviously there's a lot of ways that you can go about tackling this.
00:08:42.831 --> 00:08:45.921
Is there a place that they should start?
00:08:45.921 --> 00:08:49.307
Is there certain plans and implementation?
00:08:49.307 --> 00:08:51.692
Like, I guess it's such a broad space.
00:08:51.692 --> 00:09:00.086
If you could give more of a concrete like, this is where you could start or this is where it could be easy to start implementing, what would that suggestion be?
00:09:00.347 --> 00:09:01.068
I think, high level.
00:09:01.068 --> 00:09:07.971
If you're looking for a list to follow, implementing a NIST cybersecurity framework would be a really great one.
00:09:07.971 --> 00:09:14.086
To start with, what that means and what that boils down to a couple things Identity and access controls.
00:09:14.086 --> 00:09:16.868
As a business, we want everybody to access something.
00:09:16.868 --> 00:09:17.870
What if so-and-so's out?
00:09:17.870 --> 00:09:31.551
We want to make sure these other five people can access the same system, or one person is in charge of developing our website or whatever it may be, but we want, just in case, we want you to have these other people backed up.
00:09:31.571 --> 00:09:37.419
You have to look and scrutinize very hard your identity and your access controls within your organization.
00:09:37.419 --> 00:09:51.672
There should not be a number of people that don't need access to certain systems or employee data, that don't need access to certain systems or employee data, patient data, business data in general that have access just because it makes life easier.
00:09:51.672 --> 00:09:52.695
We need to scrutinize that.
00:09:52.695 --> 00:09:55.168
But the important thing, too, is audit trails.
00:09:55.168 --> 00:10:20.267
If you're reviewing a policy, if you're reviewing something or you do have access control, you need to have the documentation that you've done so, because in the event of a breach, in the event that you have some sort of audit, they're going to look at timestamps, they're going to look at the audit trail, and that could be the difference between paying an absorbent fine because you're negligent or not as much.
00:10:20.267 --> 00:10:23.961
You will still pay a fine, but not as much because you did have the proper controls in place.
00:10:23.961 --> 00:10:25.004
It just happened to happen.
00:10:26.167 --> 00:11:08.033
I think that that highlights another good thing, which is that a lot of people think of data security, data privacy, as sort of this potential I would say pitfall of their business from a financial standpoint, from their reputation standpoint, but a lot of people don't think about the fines, the potential for getting in trouble, right For failing to do what is necessary to protect your client information, and so I think it's really important to highlight that there's this you know, yes, you could impact your bottom line.
00:11:08.033 --> 00:11:25.355
You could impact your bottom line even further by getting fined, but also, what are the ramifications for your reputation as a business, even if you survive financially, if your clients then you know no longer, you know their social security number's out on the dark web.
00:11:25.355 --> 00:11:27.687
What are the implications for them?
00:11:27.687 --> 00:11:28.903
What are your obligations?
00:11:28.903 --> 00:11:30.609
You know, after the breach occurs.
00:11:31.009 --> 00:11:33.043
Right, well, one your reputation.
00:11:33.043 --> 00:11:38.614
Now that could take years or it could totally tank, and now you no longer have a business.
00:11:38.614 --> 00:11:41.207
There are businesses that recover from that.
00:11:41.207 --> 00:11:53.653
They put out the right statement and they offer the data or the identity protection and services like that, but when it comes to you know, as a business, what do you do?
00:11:53.653 --> 00:12:01.510
It depends on the data that was breached, it depends on your industry, it depends on the threshold within your state.
00:12:01.510 --> 00:12:06.022
All of that matters, and so it's going to be situational, couldn't?
00:12:06.042 --> 00:12:06.523
agree more.
00:12:06.523 --> 00:12:12.970
I think we've probably covered enough of why you should be afraid enough to do cybersecurity as a business.
00:12:12.970 --> 00:12:14.980
Well, I actually do want to add something.
00:12:15.000 --> 00:12:17.226
Yeah, please, so one you know, oftentimes we'll get.
00:12:17.226 --> 00:12:18.650
Well, we have cyber risk insurance.
00:12:18.650 --> 00:12:19.442
Have you heard this?
00:12:19.442 --> 00:12:20.485
We have cyber risk insurance.
00:12:20.485 --> 00:12:20.886
We're fine.
00:12:21.368 --> 00:12:29.761
But actually, did you know, in order to be paid out on said cyber risk insurance, in the event something happens, you have to have the controls in place, meaning there's requirements.
00:12:29.761 --> 00:12:32.971
You can't just have cyber risk insurance and then say, okay, we're good.
00:12:32.971 --> 00:12:39.873
I mean, it would be like, if I make the jump here, it's your own personal home insurance.
00:12:39.873 --> 00:12:46.011
If you say to your provider, I have three fire alarms or smoke detectors, I have three of them.
00:12:46.011 --> 00:12:47.626
And they say, okay, we'll mark you down there.
00:12:47.626 --> 00:12:48.572
Okay, this is your premium.
00:12:48.854 --> 00:12:50.703
But then you have, unfortunately, you have a fire.
00:12:50.703 --> 00:12:54.220
Now, all of a sudden, they're going to say, well, how many smoke detectors did you have?
00:12:54.220 --> 00:12:55.081
Oh, you didn't have any.
00:12:55.081 --> 00:12:58.504
Oh well, we're not going to pay you out, or you're, it's going to be nothing.
00:12:58.504 --> 00:13:02.429
And so the same things you have to think about, just the same thing applies to your business.
00:13:02.429 --> 00:13:19.740
If you say, yes, we have multi-factor authentication and we segment our data and we do these 10 things that are required, but then it comes back when they do an investigation and audit that you don't, well, now you're in the bucket of larger fines and you're not being paid out on something that you were going to rely on to help you recover.
00:13:20.722 --> 00:13:26.274
It's so true I think that's missed on a lot of people is you have to make an effort.
00:13:26.274 --> 00:13:45.019
It works even in the M&A world from a merger and acquisition, reps and warranties insurance perspective, which, for anybody who's unfamiliar reps and warranty insurance, essentially helps protect you against the failure of a seller to disclose important items and you only find them out post-closing.
00:13:45.019 --> 00:14:03.932
And it's very expensive and and it it's it's kind of one of those insurances that if you're not doing your due diligence in the process and you're being lazy and you're not turning every stone over and in kind of doing your part, the insurance just like the cyber security insurance won't cover.
00:14:03.932 --> 00:14:07.086
And got to see that live in person with you.
00:14:07.086 --> 00:14:19.489
You know a business that had went through the underwriting process, bought the expensive insurance, found out pounds receivable wasn't going to be paid, that they paid for as part of the purchase price, and I mean it's wild.
00:14:19.489 --> 00:14:49.163
So I think that's a really great point to underline is that you have to do the work to make sure that you are protecting your business in a way that the insurance can then come in and say you did as much as you possibly could to essentially bolster what we've come in to protect you against Exactly One hundred percent, against Exactly 100%.
00:14:49.163 --> 00:14:54.701
So I think this can dovetail into a really nice kind of segue into a different conversation, which is we talked a little bit about implementation and how important that is.
00:14:55.283 --> 00:15:04.885
I think the other piece of this is when a business is ready to sell let's say they're three, five years out they're starting to look to get organized, get their things.
00:15:04.885 --> 00:15:06.849
That, you know, I always say fair is in order.
00:15:06.849 --> 00:15:09.091
You know what is.
00:15:09.091 --> 00:15:29.828
How can someone just kind of taking even a step further back someone who's going to go through diligence, which is really the process of the buyer really inspecting everything about their business, what can a potential business that's going to sell do to really, I think, make the diligence process easier, right, what are you talked about?
00:15:29.828 --> 00:15:34.624
The list, yes, what else can from a records perspective?
00:15:34.624 --> 00:15:51.472
And obviously you know there's going to be reps and warranties in the document that says you know we've maintained, you know, certain security, you know thresholds and obligations or procedures or whatever it may be, and that's great, fine and dandy, but what does that look like on paper?
00:15:51.472 --> 00:15:52.562
First, you know what.
00:15:52.562 --> 00:15:56.201
Describe what that would look like if someone had to turn over records to prove it.
00:15:57.123 --> 00:16:13.828
I think, first, if you were to get, let's say, go for your SOC 2 attestation, if you have that report, that might be enough to say I have this report, I'm attesting to the fact that I have the proper security and privacy controls in place and will be reviewed on a yearly basis.
00:16:14.309 --> 00:16:31.221
But then you should be taking it a step further and asking the company to provide then the documentation for each of those controls, so when you're audited, depending on the auditing company, they could audit the entire control set, meaning that they're looking at every single document supply.
00:16:31.221 --> 00:16:39.969
But then others they do a sample of things when it comes to risk management, your access controls, your HR, legal practices, your policies.
00:16:39.969 --> 00:17:09.852
But if you're really doing your diligence, you are going to look at every single document yourself and do almost your own audit to make sure that that in fact is happening, because there's a range of credible audit companies, auditors, and so you want to make sure, if it's really something that you want to look into, that you you're doing it yourself and not just asking just for the the per se, which is a really great start, don't get me wrong but doing that extra step of looking at the documentation.
00:17:11.180 --> 00:17:19.443
So, going back to, I want, for anybody who's not familiar with SOC 2, can you give us, like the basic 101 of what SOC 2 is?
00:17:19.663 --> 00:17:27.690
Yeah, soc 2 is telling the business world that we take privacy and security seriously within our company.
00:17:27.690 --> 00:17:32.111
Here is what we do and there's a list depending on there's trust service criteria.
00:17:32.111 --> 00:17:34.442
There's five different trust service criteria.
00:17:34.442 --> 00:17:41.695
Most businesses will do at least security the first time and they'll say, yes, I am taking the proper steps.
00:17:41.695 --> 00:17:47.488
And here's the documentation that I take seriously that not only the security of my employees but my data as well.
00:17:47.488 --> 00:17:58.593
And then they'll start to expand over time and they'll start looking at policies of the hiring processes and integrity and there's more to it if you want to provide that.
00:17:58.593 --> 00:18:02.269
But really it's saying we take this seriously.
00:18:02.269 --> 00:18:03.685
Here's the documents to prove it.
00:18:03.685 --> 00:18:09.173
We've been audited by an external auditor that, in fact, that we do that and approve.
00:18:10.836 --> 00:18:18.849
So I'm going to play a little devil's advocate, just because I know business owners are busy, they struggle, they want.
00:18:18.849 --> 00:18:28.865
There's lots of things they have on their want list and the things that they actually check off are the most obviously critical right, the things that keep the business cash flowing, that operational right.
00:18:28.865 --> 00:18:51.763
So if someone, let's say, they put the SOC 2 on their wish list but it's something that they never actually go through and obtain, is there something they can do that in the meantime they can essentially document and protect themselves in a less certified fashion, but something that could hold up, say in the diligence process, where it's less formal?
00:18:51.903 --> 00:18:53.027
Yeah, absolutely you can do.
00:18:53.027 --> 00:19:01.038
You can either have an internal audit so you have hired somebody internally to that's maybe that's their job to document all of those.
00:19:01.038 --> 00:19:26.199
I I lean towards the NIST cybersecurity framework just because it is dealing with the security and privacy of the controls that you're that you're implementing throughout your organization, or you can hire a third party to come in and gather that information with the help of somebody internally, because the reality is a lot of these businesses don't usually have an entire compliance team or compliance department, or the operations person is wearing so many hats.
00:19:26.199 --> 00:19:44.385
The thought of juggling that as well is very daunting, and so usually hiring a third party to help build that is generally the route that organizations go, and it's less expensive and an overhead of hiring somebody internally to be able to provide that documentation.
00:19:44.846 --> 00:19:45.167
Of course.
00:19:45.167 --> 00:19:46.431
Yeah, I could see that.
00:19:46.431 --> 00:19:49.182
Yeah, no, I think that's really great.
00:19:49.182 --> 00:19:53.365
I'm going to ask a question that I think I know the answer to already.
00:19:53.365 --> 00:20:03.589
I'm going to ask a question that I think I know the answer to already, but is there any business that is too small to create some sort of internal policy around cybersecurity or data privacy?
00:20:03.589 --> 00:20:04.798
What do you think the answer is?
00:20:05.339 --> 00:20:07.166
I'm going to say no, okay, you're right.
00:20:07.166 --> 00:20:37.410
You're right Because here's and I and again, I work with a lot of small to medium sized businesses and a lot of small to medium-sized businesses and a lot in the startup community and if you are at least getting access controls right and the identity management pieces right, segmenting your data right, at least from the foundation level of your business, it is going to be massively efficient later down the line when you are ready to get the proper documentation.
00:20:37.410 --> 00:20:40.023
So, building that just from a foundation level is huge.
00:20:40.023 --> 00:20:46.214
And no, there's not a, I'm a business of three people and we are documenting and we have the policy.
00:20:46.214 --> 00:20:54.643
And you might think, oh, we're just over here in the corner doing these things when it comes to compliance, but no, no, we're, as a company, documenting all of that as well, because we understand the importance of that.
00:20:54.643 --> 00:20:58.910
And then, in the event, you do grow and be bigger, then great, you've got it.
00:21:03.835 --> 00:21:05.259
You've got a lot of your ducks in a row already.
00:21:05.259 --> 00:21:05.859
I would expect nothing less.
00:21:05.859 --> 00:21:06.422
Right, I know?
00:21:06.422 --> 00:21:07.545
Right, could you imagine Walking the walk?
00:21:07.545 --> 00:21:08.105
Talking to talk?
00:21:08.105 --> 00:21:36.218
Yeah, so I think that this conversation is actually a really great way to segment into something that we were talking about actually before we started sitting down for the podcast, which is, you know, I think, when you're thinking about businesses that are transitioning into an exit plan, right, someone is planning to sell, preparing for that which we kind of talked about.
00:21:36.218 --> 00:21:37.881
You know, documentation getting a sock to.
00:21:37.881 --> 00:21:43.500
You know some of these options for essentially creating more trust and something that the buyer can hang their hat on.
00:21:43.961 --> 00:21:48.335
But even from the buyer side, you know I represent buyers quite frequently.
00:21:48.335 --> 00:22:03.308
I represent both sides and when a buyer is coming in to purchase something like a medical practice or a practice that touches a medical realm, whether it's HIPAA, a lot of times you know we'll put in there reps and warranties as to.
00:22:03.308 --> 00:22:05.750
You know you've complied with health care laws.
00:22:05.750 --> 00:22:06.872
List all the health care laws.
00:22:06.872 --> 00:22:08.961
You've complied with data privacy requirements.
00:22:08.961 --> 00:22:10.766
You know, make sure HIPAA is included.
00:22:10.766 --> 00:22:22.250
Hipaa is included, but on you know that's great on paper, but then the buyer, during the diligence process, it's their responsibility to say okay, hand over the proof that you're doing this.
00:22:22.250 --> 00:22:32.640
And in some instances, like I've represented, you know buyers that are purchasing, you know hearing aid locations and it is.
00:22:32.640 --> 00:22:37.457
It's still HIPAA, right, it's even though it's not the traditional idea of a doctor's office.
00:22:37.457 --> 00:22:44.378
And you know we've seen the gambit of you know it's a recurring buyer and so we've seen the gambit of here's.
00:22:44.538 --> 00:22:50.198
You know one instance where you know an audiology practice is doing the best it possibly could.
00:22:50.198 --> 00:22:52.480
Everything is documented down to the letter.
00:22:52.480 --> 00:23:00.030
It's got a handbook, a guide, everything is written down, and then we've seen the opposite, which is like everything is an absolute disaster.
00:23:00.030 --> 00:23:05.178
They haven't been doing.
00:23:05.178 --> 00:23:09.153
You know they've been compliant because their software is doing a lot of the legwork for them, but they're not doing anything above and beyond.
00:23:09.173 --> 00:23:26.855
And so you know, paige and I were talking briefly before this podcast about HIPAA and HIPAA compliance and kind of how people tend to think of HIPAA, separate and apart from the cybersecurity and world that requires sort of that data compliance because it's so health specific.
00:23:26.855 --> 00:23:38.766
But there's so many pieces that touch on HIPAA and I think I'd also like to underline just separately that if you're doing business with a company that is obligated to comply with HIPAA.
00:23:38.766 --> 00:23:56.442
You're also likely processing, you know, personally identifiable health information right, so you'll need to have a business associate agreement in order to make that all fully compliant.
00:23:56.442 --> 00:23:58.728
But you know, paige was just saying how the HIPAA rules are sort of in flux.
00:23:58.728 --> 00:23:59.489
They're changing.
00:23:59.489 --> 00:24:01.521
I'd love for you to go into that a little bit.
00:24:01.815 --> 00:24:29.726
Yes, and I do want to acknowledge in your scenarios where you say the business over here has everything buttoned up, great, but I'm going to go ahead and majority of the healthcare practices that we work with or I've heard of in the past it's 95% sit over in this other camp which is, oh, we have the HIPAA compliant software that provides the policies and we're okay, we're HIPAA compliant and it's like well, that's actually that's not the truth.
00:24:29.746 --> 00:24:37.391
It can be further from the truth, but I think there's some education that can happen and for them to fully understand what that means to be HIPAA compliant.
00:24:37.391 --> 00:24:41.922
But to help answer your question is the HIPAA privacy rule changes every year.
00:24:41.922 --> 00:24:47.121
There's usually additions that have usually not a lot of removal or subtractions, but additions.
00:24:47.121 --> 00:24:53.040
This year it's focused on cybersecurity and cybersecurity practices within the HIPAA privacy rule.
00:24:53.040 --> 00:25:11.263
So adding things like, which might seem obvious, but multi-factor authentication, a requirement, required policy documentation, and it has to be not only just policies, but policies and your operations of how you actually implement said policy.
00:25:11.263 --> 00:25:16.384
So you can have the best policy in the world, but if you're not actually following it or doing it well, then it's not really your policy.
00:25:16.384 --> 00:25:26.509
So those are the sort of things that if an auditor were to come in or you were to be audited, that you would likely fail because you might have certain things in place but it's not to the full gamut.
00:25:26.509 --> 00:25:31.564
So cybersecurity is a big thing happening this year and it needs to.
00:25:31.564 --> 00:25:50.144
It needs to be because the healthcare industry according to the IC3 report, which is the fbi's internet crimes report, health care is usually one or two um on the list when it comes to information that has been exposed, via what vehicle, and it's usually a health care practice that's fascinating uh, it doesn't surprise me though
00:25:50.505 --> 00:25:50.746
it's not.
00:25:50.746 --> 00:25:53.218
No, it's not surprising, and especially when you were go to.
00:25:53.218 --> 00:25:59.902
I know getting kind kind of tactical here, but, like um, you go into the doctor and you're filling out a form and there's a line for your social security number.
00:25:59.902 --> 00:26:03.338
But did you know you actually don't need to provide your social security number?
00:26:03.338 --> 00:26:08.036
Social security numbers are used for tax purposes only, credit related only.
00:26:08.457 --> 00:26:15.608
It's a law now that you can't have medical debt on your credit report, so there is no reason for that line to be there.
00:26:15.608 --> 00:26:21.635
But yet it continues to be there, which means as a healthcare organization you're opening yourself up for more risk.
00:26:21.635 --> 00:26:30.962
Will it potentially get you paid down the line if you're able to, from a credit perspective, go and have a debt collector, go and collect those debts?
00:26:30.962 --> 00:26:32.125
Maybe, maybe.
00:26:32.125 --> 00:26:48.481
But at the same time now you have all this risk that now you have an entire column of social security numbers of people that just give it, just because the line says and that's a risk that you have to really think hard about in your organization and when you're setting up your operations and your intake process.
00:26:49.095 --> 00:27:01.156
Well and that goes back to your original comment about who should have access to the information that's absolutely critical to the operation of the business, which one would argue that you're handing over a paper form.
00:27:01.156 --> 00:27:03.703
How many other people are going to see that paper form?
00:27:03.703 --> 00:27:04.987
Is it going to be stored properly?
00:27:04.987 --> 00:27:09.726
Are there other employees of that business that can access that form unnecessarily?
00:27:09.726 --> 00:27:11.637
They have nothing to do with billing Right.
00:27:11.637 --> 00:27:12.720
Are they seeing it?
00:27:12.779 --> 00:27:13.180
anyway.
00:27:13.180 --> 00:27:32.220
Well, and this is what you have to think through when we come to access control, it's not just access of your online systems, it's also access to your physical copies, because in this scenario, let's say, you are filling out this form at the doctor and you hand it over to the front desk Okay, if they're scanning it in for their online system, what that piece of paper?
00:27:32.220 --> 00:27:34.523
Does it go in a bin that then goes into the shred bin.
00:27:34.523 --> 00:27:35.988
Who has access to this shred bin?
00:27:35.988 --> 00:27:36.709
Who has the keys?
00:27:36.709 --> 00:27:41.358
Is it a janitorial staff or an outside service that then comes and picks it up?
00:27:41.358 --> 00:27:47.105
It's just, it's those sort of things where you think, oh my gosh, do I really have to think of those things?
00:27:47.105 --> 00:27:54.286
You do need to think of those things, and that's where the vulnerabilities end up happening in your organization if you're not thinking through those things.
00:28:01.015 --> 00:28:22.446
As I'm listening to you talk, the one thing that was kind of reverberating in my mind was one way that you could, potentially as a business that's starting to think about this more seriously as all of you should is to sit down and just like when you're trying to automate or make your systems better, you have to first sit down and think about what are my systems?
00:28:22.446 --> 00:28:24.162
Where do things get funneled right?
00:28:24.162 --> 00:28:27.965
Intake how does the intake process from start to finish happen?
