Hello, I'm Adler Archer. Today we will be learning about security breaches in healthcare. During this presentation, we'll discuss what a healthcare data breach is. What the HIPAA Breach Notification Rule is. What increases your risk of a breach. What is a data breach in healthcare? Essentially, it's any impermissible use of protected health information. Something that's going to violate the way the information is supposed to be secured, or who has access to this confidential information. Within HIPAA, there's something called the Breach Notification Rule. This applies to all covered entities. Covered entities, of course, are hospitals, healthcare providers, organizations that deal with PHI, which is protected health information, or the business associates, or people who were working with them, like accounting firms, data storage companies. Anyone who's going to have access to the personal health information because they're helping covered entities. This breach notification will apply to both groups. Essentially, what it says is that, if there's a breach, you have to notify the patient, and then you may or may not have to notify others like, the Department of Health and Human Services or other stakeholders. The exception to that would be if it's determined that there's a low probability of compromise. Phishing attacks is a type of attack where hackers will try to gain access to the system. Generally, through an email, where they pretend to be someone else that they're not, to get login credentials. Then they can log in and try to steal data or even deliver ransomware. Ransomware, is a type of computer code that affects the files on your system, and then it makes them inaccessible until you pay a ransom. This can lockdown all the files or some of the files and even after you pay the ransom, sometimes the files are still not unlocked then, so the system is still not usable. Distributed denial of service attacks. This type of attack is one when someone is sending, what is technically a legitimate request, they're just sending a lot of them to overwhelm the system. The hacker is sending so many requests that it just completely overburden the system and the network can't operate because of the load. What types of things happen that increase risk for beaches in healthcare? One is human error. It could be weak passwords. We all know password is not a good password. 1234567 is not a good password, 000 is not a good password. Certainly, having stronger passwords is a good way to deter against a breach happening. Also, wrong recipients, where maybe you are sending some protected health information to a colleague, but you misspelled a colleague's name or something else happens and it goes to the wrong person. Then password sharing is a big one, where maybe your system is unlocked and colleague has forgotten their password or something happens, and you allow someone else to use your password so they can log in. We have already covered malware. That's ransomware, distributed denial of service attack, and phishing attempts. Insider misuse though, is another important one, and that happens when someone who has access to the data legitimately decides to take it and use it for a purpose that is not meant to be. Whether it would be selling it to someone or just disclosing it in a way that it's not meant to be disclosed, but it's intentional. Then the last is physical theft. Someone just coming in and taking a computer. These are all things that will certainly increase the risk of healthcare security breach. True or false. If the IT department calls and asks for your username and password, you should give it to them. You can answer it false. That is correct. The IT department will not call and ask for your username and your password. We've gone through the definition of what healthcare data breach is, we've discussed that Breach Notification Rule, and we've talked about things that increase the risk of breach. Thanks so much for watching.