We all know that cybersecurity is an issue that each person and company (i.e. practice) needs to deal with.  But how many of you have said...

• It won't happen to me
• I will take care of cyber threats tomorrow
• Anyone can hack passwords, so why bother?
• I have no idea where to start...

Sound like you?  I bet for most of you, it's hitting a bit close to home.  It seems like in this world of medicine and business, there are so many other things... that we simply don't put a priority on cybersecurity.  But you should.

Here are just some recent descriptions of various threats and attacks on health care facilities.  Some are prepared.  Some are not. What would an article say about your company if you were attacked by a hacker? 

• Malware attack disrupts operations at Indiana medical center
• Three Alabama hospitals halt admissions after a ransomware attack
• Indiana medical center alerts 106k patients of a ransomware attack
• Patient data from EHR...

What are your requirements in the event of a data breach?

Did you know that if you had a data breach in 2018 that involved less than 500 individuals, you are required to file a report with the federal government prior to March 1, 2019?  

If you had a data breach that impacted over 500 individuals, then a report must be provided to the government at the same time as notification of the impacted people.

It's important to understand these complex regulations because failure to comply can result in a substantial monetary fine.  Moreover, it's important that such reporting (Form available here) is done very carefully to ensure that you accurately report the incident so that your exposure to regulations is minimized.  For that, it's probably best practice to consult with an attorney who is knowledgeable in such reporting.  

The following link is a short article by McDonald Hopkins, a legal firm which is knowledgeable in...