HEALTHCAREBUSINESS MONTHLYCoding | Billing | Auditing | Compliance | Practice Management
Zoom in on ICD-10-CM Glaucoma: 38 Focus on laterality and the stage of the condition
HIV Status: Who Should Know? 42 HIPAA disclosure regulations can be confusing
Strategy Is Key to a Healthy Future: 50 Lay plans for productive staff and patient-centered care
CHAPTER OF THE YEARMonmouth-Ocean, New Jersey
June2016_HBM.indd 1 20/06/16 5:20 pm
52 Healthcare Business Monthly Coding/Billing Auditing/Compliance Practice Management
By Brian Shrift, CISSP, HCISPP
Information technology (IT) is a critical part of your healthcare or-ganization. To effectively secure its data and systems, your organi-zations IT support must be up to date on the latest trends, technolo-gies, and efficiencies and they must maintain the most current certi-fications. If you arent confident (and, probably, even if you are) that your organizations data is being managed properly, nows the time to examine its infrastructure more closely.
It Wont Happen to MeToo often, I hear clients and business associates say silly things like:
It will never happen to me. Im just a small practice; Ill never get audited for HIPAA
compliance. Ill never be hacked. My email will never be compromised. My server will never fail. Ill never have a fire that will destroy my business. No one will steal my laptop.
Contrary to these misconceptions, IT vulnerabilities and the result-ing loss of data, data breaches, downed systems, and other nightmares occur regularly in organizations of all sizes. The odds against you are too high and the consequences (financial and otherwise) are too seri-ous to assume the worst will never happen.
Backup and Disaster RecoveryA proper backup and disaster recovery plan is vital. If you need a rea-son why, consider this: If your IT systems are down, youre losing rev-enue. Specifics you should examine include:
If you dont address vulnerabilities now, the odds are against you when disaster strikes.
June2016_HBM.indd 52 20/06/16 5:20 pm
www.aapc.com June 2016 53
Backup Plan Have a written plan detailing how your systems are backed up, what is being backed up, how often the backup is occur-ring, and the retention policy of the backup (how long old data is re-tained). A backup that occurs every five minutes is significantly bet-ter than one that occurs each night.Backup Media On what media is the backup being saved? Find out if it is a backup to tape, hard drive, universal serial bus (USB) drive, online backup, etc. Each presents a mix of pros and cons. For instance, if youre backing up to tape or USB drive, is that media then taken offsite? If so (and it should be), be sure the backup data is encrypted. This will protect the integrity of the data in the event its lost or stolen. If youre using an online backup provider, ensure it meets your regulatory needs for security and reliability.If youre backing up to a device that remains onsite, and theres a fire, flood, or other catastrophic event that ruins both your produc-tion data and backup data, will your organization be ruined? Make sure you have a plan B.Mean Time to Recovery (MTTR) This simply means the av-erage time it takes for your systems to be operational again in the event they go down. This is important because if your systems go down, youre immediately losing revenue. Determine how long it will take for IT support to get you back online and whether there will be data loss. If your server crashes, will it take four hours or four days to recover? The difference could mean an organizations sur-vival or failure.
Test Your Backup and Disaster Recovery Solutions You do not have a working backup and disaster recovery plan until it has been tested. Even if your backup reports Success, dont trust it. The only way to ensure success is by testing it.
Questions to Ask an IT Support VendorIf youre thinking about hiring an IT support vendor, talk to other business partners about their IT support solutions and experienc-es. Find out whose services they use, and the pros and cons to those services.If youre ever in doubt about your IT support, or want a second opinion, invite a competitor or outside IT support company to re-view your systems. A peer review may reinforce recommendations
made to a client, or confirm there is nothing further of value they can provide.Remember that you get what you pay for. Its more important to hire someone who wants to work with you and who understands you someone you can trust as a business partner. This is an important partnership because IT is so critical to your organization.If you want to test your IT support, copy a folder or two of docu-ments to an alternate location and time how long it takes them to recover the files. This is a nominal task that should take under 30 minutes to accomplish.
Brian Shrift, CISSP, HCISPP, is president of Precision Business Solutions.
If your IT systems are down, youre losing revenue.
IT Support vs. IT ManagementI describe IT support vs. IT management as Reactive vs. ProActive. Many people or companies providing IT support are simply there to provide support in a time of need. IT support is great, but most organizations need more. Someone providing IT management knows youll need support, but also proactively works in the background to maintain, monitor, and document your IT systems. IT maintenance used to consist of disk defrags and the occasional service pack. Today, there are a number of proactive measures. For example: Up-to-date systems patches protect against the latest vulnerabilities;
Reliable anti-virus and spyware protection further guards against hackers; and
Optimized configurations keep systems running smoothly.
This isnt something thats done once, but repetitively. Just like a regular oil change, if you maintain your systems, they will last longer and perform better. Continuous monitoring is an important proactive measure to prevent downtime, respond to and resolve problems quicker, and prevent revenue loss. IT management should work with the business owner or manager to budget, improve, and plan IT expenditures. Whomever you have in this position should be able to discuss IT with you in language you can understand. You cant make the best business decisions for your organization if you dont understand the information provided to you.
To discuss this article or topic, go to www.aapc.com
June2016_HBM.indd 53 20/06/16 5:20 pm
Click here to load reader