That's one and then two, and I would say that the second challenge is probably more of a challenge than the first one. The first one is more tactical and operational. But two is getting more organizations to recognize the value of the programs and to adapt and leverage those programs.
And that only comes through conversations and education to make sure they understand everything that's included within the programs themselves.
Mike: Yeah. That seems to be you know, the leading question these days and I won't spend a lot of time on the obvious things that I think, you know, a lot of individuals have brought up, such as the shift to work remotely.
Obviously, there's been some new threats and challenges for some organizations that have not been accustomed to that type of environment. In the past, those that are really focused on being in an office every day, and now having to shift to work remotely or work from home, naturally will introduce a number of new threats.
Everything from "do you have the appropriate hardware security configurations at home" from a network perspective, but I'll add a little twist on that, which would be IoT. And it's one thing if you're sitting in an office and you've got your phone with you, and you know, your phone's always listening anyway.
But now all of a sudden, you take that individual, that employee and you drop them within their home. Well, now there's multiple devices and things that are listening, how many people have Alexa, how many people have other types of things within their home, and then things that you don't even think about?
It's so funny, you bring this up, Sierra, because I was talking to a good friend of mine, who's with a large health plan this morning prior to us having this discussion, and he gave the example that he was sitting in his kitchen and he was on a work call, he's in information security, and they were discussing some pretty sensitive topics, right.
And his back door, his slider, was was open on to his patio. We just had it open, letting the air in, and his wife was sitting outside while he's having this conversation. So his wife came inside, close the patio door, interrupted him, and said, I just heard your entire conversation and our neighbor is on the other side of the fence, which means they heard it, too. So it's not just about the environments and the devices, but it's also the activity and the behaviors that can introduce a lot of risks.
But that's not the riskiest thing that I'm concerned with. The riskiness aspect of the new threat is not knowing what we've introduced or let in the door. And what I mean by that is, when you look at organizations impacted by COVID, one of the things that most if not all organizations have had to do is they've had to bring on contract, introduce new business partners into their environment, in order to address COVID.
So, whether that's, you know, we got to use more software, we got to use the cloud more, we got to buy hardware to ship to people's houses. If it's in the healthcare space, we need to get as many ventilators in the doors we possibly can. We need personal protective equipment, right. So all of those things have forced us to create new business relationships, and bring on vendors quicker than we've ever had to before.
And naturally, as part of that process when we think about COVID, and the ultimate risk is to stop the loss of human life, we're going to get those vendors on quicker, right. And we've naturally probably cut some corners and haven't done as much diligence as we've done in the past due to the significance of this issue.
But what worries me is, if we don't go back and close those doors that we opened up, what are those new threats and vulnerabilities that are lurking, sitting there now? Where 6 to 9 months down the line, they can actually show how ugly they can be.
Sierra: Right, and the new threats that you're mentioning, how do you think that these new threats are changing the regulatory and compliance landscape?
Mike: Yeah, so that's another great, great question.
I'll give you a couple [of] different perspectives there. When there's a difference between what I would call, you know, what is the regulatory and compliance landscape and standards and requirements versus enforcement, right. So, I would tell you if there is no relaxing, there's no, you know, public statements that say, the regulations or the requirements are being removed if you will.
The expectation is, and the fact is, they're still there, right? Everyone is expected to be performing appropriate procedures executing appropriate controls have stopgaps in place, etc., in line with all these requirements and matter of fact, when you look at something like HIPAA, you know HIPAA indicators that, you know, you must maintain compliance with the standard, even in times of operating in emergency mode. I mean, it actually says that right as a requirements perspective.
What's changed is the enforcement. So, when you look at entities like the OCR, I mean, the OCR has publicly indicated that we recognize during these times, you need to be able, from an interoperability perspective to share more information openly across health information exchanges, hospital systems, when you look at what happened in New York, you know, back in April.
And so, recognizing that the speed of sharing data definitely, you know, offsets the ability to protect it appropriately, they've indicated that we will relax some enforcement of the standards, although you should be following it still, during these times and recognizing that organizations may have to relax the ability to enforce it. I don't know that I necessarily agree with that.
I think I would say that if you've made appropriate investments and a strong security and privacy program, and solutions and tools, then you should already be in a good position to continue compliance and operation and enforcement even during times like this.
And the last perspective I would give is, when you think about the concept of business continuity plans, right, it's funny back in my PwC days, we would come across those requirements and those controls and we would kind of laugh and say, ah, these things are never really used, you know, let's just make sure that they're doing a tabletop exercise and there's a policy and a procedure in place and they're never going to have to use that or that has certainly changed.
And I think what you will see is you'll see more requirements and regulations standards, relative to business continuity and being able to react to things like a pandemic in the upcoming years.
Sierra: Okay. And do these new threats change how organizations should interact with third parties or vendors?
Mike: Sorry, can you say that again?
Sierra: Yeah, sure. Um, do these new threats that you, you've been discussing change how organizations should interact with third parties or vendors?
Mike: Yeah, good. Good question. I think it definitely does in a couple of different ways.
So as I mentioned before, out of necessity, I think it has changed the onboarding process. process and how we interact with vendors during the onboarding process.
So we may be willing to not have as much transparency and comforts relative to security and privacy upfront. with the understanding that we will go back and revisit it later on, I think that's one beep behavior change that that's happening has been necessary for a lot of organizations.
The future outcome of that, knowing that that's put us in an uncomfortable position because we don't know what we don't know, is I think you'll see more and more, in the future, of organizations unwilling to even enter into a relationship with the third party unless they have those assurances upfront relative to security and privacy.
And I think they're going to start building their directory, if you will, of third parties or business relationships that they can call up in the event that they need them and they're going to build that base off of who has strong security and privacy posture that they can contact at any point in time to engage for necessary services.
I think those will be some behaviors that that change.
Sierra: Okay, great. And my last question, topical questions, are on-site audits going to be a thing of the past with company shifting to a remote-only workforce?
Mike: Oh my, another great one and one that did that we talked about a lot. It's difficult to tell at this point in time. However, I do believe they will come back, but you not see them performed as frequently as they were before. And what I mean by that is today, it's not an option.
Right? So auditors are finding different ways and authoritative bodies that enforce to certain requirements are relaxing their standards we did from a HITRUST perspective, right, right, or recognizing the challenges. We said, "Hey, we're going to provide a waiver for on-site validation procedures", we have to.
So I say from that the auditing organizations, the authoritative sources, and standard bodies are really having a good look inside themselves and saying if we were able to get it done this time, and if we were able to relax our standards this time, why can't we continue that model and I think here's the difference.
It's all about how far can you extend or extrapolate assurances. And if one year, you're doing an on-site audit, and the next year, a pandemic hits, and you're not able to do an on-site audit, and you could still provide that same level of assurance and auditors can still issue their opinions and etc., and when does that become stale, and maybe they've done some additional alternative procedures to extend or extrapolate the assurances, but at some point, it's going to become stale.
So maybe we'll see a model where it doesn't all go away, but it shifts to every other year. There's an on-site audit as an example. So, I don't think you'll see them fully go away, but I do think they will be more relaxed and not as rigid as they've been in the past.
Sierra: Okay, great. And Mike, how do you keep up with industry trends? Do you listen to any good podcasts, reading any good blogs, newsletters, anything that we should be following?
Mike: Yeah, I mean, I doing a number of different things.
You know, everything from looking at Flipboard with topical items and articles that are relevant to the industry.
I stay in contact with a lot of the industry thought leaders relative to, obviously, security, privacy, third-party risk management, I interact with a lot of the other standards organizations and authoritative sources, such as CMS, HHS, NIST, etc. and follow some other organizations that are thought leaders within the third party risk management space so I do a lot naturally, but I would tell you, most of my updates is from talking to people.
And it's just understanding, you know, what are they seeing, what are they dealing with maybe hearing about something new or something interesting to take a note on that and then going back and doing my, my own research to learn more about it.
Sierra: Right. And you do talk to a lot of people, so.
Mike: Right.
Sierra: And then my last question for you is, what do you do to de-stress and relax? I know that but I don't think our listeners know that.
Mike: Yeah, yeah, de-stress, and relax. You know, I would tell you, some of those things are the same as they were before. And some things are naturally different considering the environment that we're having to live with within today. I'm certainly a big fan of wine.
So, I enjoy the hobby of exploring and, naturally, drinking wine, especially being in Northern California. I love spending time with my family, of course, kids, life, friends, and also our dog who recently just got out of surgery yesterday. So looking after her right now.
Sierra: I'm glad she's okay.
Mike: You know? Yes, she's doing okay.
So you know, all those things were things from before. And also today, we love to travel as a family. And that's something that we really enjoy and exploring new places.
Naturally, that is not something we're able to do right now. We're looking forward to when we can begin to do that again, and have no agenda on those trips and just really explore and be open and so what that been replaced with.
Maybe it's a little more tactical. But every day we make a point to cut the workday off and go for a walk with the family, with friends, with the dog. And every day, right get out of the house clear your mind. I guess it's a form of a trip and travel or to the extent that they can do it right now.
Yeah. But that's important because in today's day and age, it's funny and you're probably experiencing this as well, Sierra, that now I think, working from home, of course, has its benefits, but it has its detriments as well. And a lot of people are working more now without breaks and without ways to escape than they have been before. Just because the laptop is always on.
You don't have to necessarily commute to work or your commute is very short to your desk and as a result, I think as a society, we are working a lot more now than we had before. And it becomes harder to draw those lines, you know, to stop working and shift to the personal life. So it's really important to have some diligence in place.
Sierra: I agree with you. And I think the lack of human interaction too, is detrimental to your emotional stability.
Also, you need human interaction, you need to touch other individuals, you need to talk and interact and have that interaction to be emotional, emotionally stable.
So I agree with you on that. We've been trying to get all over and go on walks and get some sun as well.
So appreciate all that and appreciate your great insight today. And so thank you so much for being with us today.
Mike: You're welcome. Thank you.
Olena: Thank you so much, Sierra, for that insightful and really in-depth interview.
Sierra: Yeah, it's always great to talk to Mike, he's a personal friend and always provides valuable insight. So it was really, really fun to interview him.
Olena: Great. Okay, well, that's gonna wrap it up on this edition of the HIPAA Critical Podcast. For more information, you can also log on to our website. That's Paubox.com P-A-U-B-O-X.com. If you like what you hear be sure to like and subscribe to the HIPAA Critical Podcast.
Subscribe via Apple Podcasts, Spotify, iHeart Radio, or Stitcher. [THEME MUSIC]
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
