Phase 2 of the HIPAA audits is fully underway, and covered entities now can take a breath if they have not received a desk audit request. But we still are at the beginning of Phase 2, with more to come. One of the best ways to ensure that your HIPAA compliance is in order is to prepare as if an audit is imminent. Here are some steps that covered entities and business associates can take to further prepare:

A business associate has settled a direct enforcement action over allegations that it potentially violated HIPAA. We can expect future HIPAA enforcement actions against business associates.

What Happened? It all started with the theft of a smart phone.

Federal regulators are intensifying the spotlight on security risks posed to healthcare organizations and business associates by vulnerabilities in third-party applications.

On June 7 the HHS OCR stated, “Recently, it has been reported that third-party application software security vulnerabilities are on the rise. Many covered entities and business associates may think their computers and devices that utilize operating systems are secure because the covered entities and business associates are deploying operating-system updates, but many systems are still at risk from third-party software.”

Security researchers say there’s been a flood of new malware variants reaching the market and cybercriminals are eager to cash in on the profit potential afforded by ransomware. A new “ransomware” program dubbed Ranscam has been working its way around and is far more blunt than more sophisticated ransomware programs.

The current round of HHS audits have increased their scrutiny on healthcare providers’ Business Associates. This means that just having a BA agreement in place is not enough; healthcare organizations need to also look at the security controls in place for each of their BAs.

A new banking data management program VRMBuilder.com is available from Lincoln firm MetaLogic. This program is rolling out at two levels that will allow banks to organize and manage their data on a secure, user-friendly platform. The platform is offered at two tiers to fit the individual needs of community banks.

The regulatory compliance burden for banks and all other businesses in Nebraska that deal with personal information has just been increased. By changing the definition of personal information to include things like usernames, passwords, and security questions there is now more information that needs to be protected in order to avoid breaches and the hassles that accompany them.

HIPAA audits really are here. One of my clients let me know this week that they were contacted by the OCR announcing a HIPAA audit. Now is the time to make sure you are prepared.

Almost two years after the OCR first announced preparation for another round of HIPAA audits, Phase II of OCR’s HIPAA audit program is finally underway.

The Department of Homeland Security has issued a new alert regarding more than 1,400 software vulnerabilities in an older line of systems used to dispense medical supplies at hospitals. This alert highlights the challenges involved in ensuring security in legacy equipment, including medical devices.

FICO Card Alert Service just released data that indicated ATM skimming increased 546 percent from 2014 to 2015. That increase represents the largest year-over-year increase that the service has seen in its more than 20 years of existence. The FICO research is based on the analysis of thousands of U.S. ATMs, and it shows that off-premises retail ATMs were most often targeted. These off-premise machines were attacked 10 times as often in 2015 compared to 2014.