By:
On:
In: *Connecting the Dots Blog*, Health Care, Incident Reporting, Legal

  A previous Lessons Learned Blog mentioned the Dodd-Frank Wall Street Reform and Consumer Protection Act and a special bounty program within the Act for whistleblowers.  Did you see it? An attorney at the Healthcare Financial Management Association’s Annual National Institute legal update says healthcare providers may be heading into a storm of whistleblower suits that could cause serious problems for the unprepared. The attorney predicts the new Patient Protection and Affordable Care Act could lead to an explosion of whistleblower lawsuits because the new law does not require the plaintiff to have direct knowledge of alleged fraud to file a suit. So if youRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management

  Dissemination vs. Implementation The Veterans Affairs Department recently announced they will be publishing monthly online accounts of data breaches and lost BlackBerrys and laptops in order to improve accountability and increase transparency. What was shocking to me was that from April through July of this year, the VA has lost 72 BlackBerrys and 34 laptops.  Patient information has been sent to the wrong address or mailed incorrectly 441 times.  There were 9,746 breach incidents involving notifications to patients and 2,501 incidents in which credit reporting was required. Almost 10,000 breach incidents in 3 months!  What is wrong with this picture?  Instead of just disseminatingRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Legal, Risk Management

  According to a recent Washington Post headline, law firms are gearing up for new whistleblower reward program. The new program was included in the Dodd-Frank Wall Street Reform and Consumer Protection Act signed by President Obama in July 2009 has created a bounty program that rewards individuals who provide “original information” to the SEC.  The SEC can then award the individual with up to 30 percent of any successful enforcement action that exceeds $1 million. There is no doubt that federal agencies are publicly ramping up  to police illegal corporate activity… future Lessons Learned Blogs will discuss healthcare, education and others. Here are someRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, School Safety

  I met some really outstanding people this month while presenting at the NASRO national conference and I deeply appreciate how school resource officers (SROs) and school security officers (SSOs) are striving to make a difference with students and with schools. Before and after my presentations I had some interesting conversations with several SROs from schools all across the U.S.    One of the SROs I spoke brought up an ongoing challenge with cameras.  He would like to replace outdated analog cameras that do not give him the clarity he needs to recognize and identify people.  He also wants to add more cameras for better coverageRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance

  Did everyone see this ultimate lesson regarding lessons learned but not implemented? Remember back in February 2009 when the Federal Trade Commission (FTC) issued a settlement against CVS Caremark?  According to the settlement, CVS Caremark violated the HIPAA privacy rule and the FTC Act when some of its stores improperly disposed of prescription information and pill bottles that had patient information on them.  The settlement resulted in a $2.25 million fine and they must ensure their security program meets the standards of the settlement [including ongoing audits] for the next 20 years. Now roll the clock ahead to July 2010 and another pharmacy chainRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Human Resources, Risk Management, School Safety, Workplace Violence

  In my previous blog I suggested that building a successful preparedness campaign is like building a skyscraper…and in some cases it seems like building a skyscraper may actually be easier than building a successful campus-wide or organization-wide preparedness effort. I mentioned that building a skyscraper and building a campus-wide or organization-wide preparedness effort have a lot in common and one of those common items is blueprints. Blueprints can be a technical drawing, a mechanical drawing, an architectural plan, a model, a prototype, a detailed plan of action and etc.  Blueprints can also include programs, policies, procedures, processes, guidelines, checklists and etc. But blueprints areRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Emergency Management, Risk Management, School Safety, Workplace Violence

  I attended the Virginia Governor’s Campus Preparedness conference last week and had an interesting discussion with one of the attendees.  We were talking about how building preparedness across an organization or an entire campus is becoming more complex and more difficult due to escalating challenges, regulations, obligations, liabilities and much more. As our discussion continued, we started talking about how important tools can be when building campus-wide preparedness programs.   In reference to whether tools can make a difference, I offered the following analogy: Could a skyscraper be built using a hammer, a saw and some nails? The attendee responded quickly, yes the skyscraper couldRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Risk Management

  Lessons learned from a recent hacking competition at Defcon revealed yet again that your employees are the biggest threat to your organization. With just two phone calls, a hacker posing as a Louisiana-based employee handling claims involving the Gulf oil spill was able to trick a computer support employee at BP into divulging sensitive information that could have proved crucial in launching a network attack.  The employee provided information to the caller including the model of laptops BP used, the specific operating system, browser anti-virus and VPN software.  The hacker also convinced the employee to visit an unknown web site, Social-Engineer.org. Other hackers inRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, School Safety

  While tragic incidents like Columbine and Virginia Tech have created an increased awareness of campus safety and security, most college students reveal they still feel fairly safe on campus.  A recent study by three Southern Illinois University scholars has revealed most students are not particularly worried about encountering an active shooter on campus. The survey of more than 5000 students discusses attitudes towards on-campus crime, perceptions of risk and safety, personal experiences and understanding of campus safety measures. What was perhaps most interesting  about the report was the recommendations by the students to reinforce public safety training and communicate emergency procedures with students, facultyRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security

  One of the first things security professionals recommend when you install new programs, systems or hardware is that you change the default password immediately.  And, if a system has been breached or is vulnerable to a potential breach, most security professionals recommend your Users change their passwords as a precaution. Now, what if the password was hard-coded into the system and could not be changed without throwing all systems into chaos and disrupting or halting operations? And what if the default password for your software had been shared in online forums since 2008? That would never happen, right…? Unfortunately this is exactly what hasRead More →