Washington Report- September 27, 2011

September 27, 2011The following is this week’s edition of the Dell Services weekly Washington Report.Information and updates in this report include:  Quote of the Week  5 Tips for Making Your Smartphone Secure – Smartphones and tablets make life easier, but they could also represent an easier target for hackers  Creating Metadata Standards – CHIME offers ONC recommendations on creating metadata standards.  Health Watch – A weekly digest of the latest news in the healthcare industry  Tweets for Your Consideration – A few tweets worth noting this weekQuote of the Week“They will be called the lost generation in that their careers would not be the same way ifwe had avoided this economic disaster. “Richard Freeman, Harvard University economist commenting on the 2010 census data thatwas released last Thursday, which showed the impact of the recession, especially on 20- and30-year olds.5 Tips for Making Your Smartphone More SecureSmartphones and tablets make life easier, but they could represent an easier target forhackersBy Jeff Fawcett, Security Practice Executive, Dell SecureWorksAccording to security vendor McAfee, mobile malware grew by 46 percent in 2010.Smartphones lack an operating system as robust as a Windows® or Linux®, so protectingdevices is much more difficult. Organized crime and nation states are focusing onsmartphones since it is much easier to get the data they want. In a previous WashingtonReport article, The M Factor, we discussed how mobile devices, such as smartphones, arecreating new security vulnerabilities. Below are 5 of the more common threats associatedwith smartphones and mobiles devices, along with best practices to help mitigate theserisks.1) Wi-Fi Man-in-the-Middle Attacks – This means of attack is popular and effective today incoffee shops, bars, restaurants and airports that offer wireless Internet access without apassword. In this environment, anyone else on the same network can hack your device inless than five minutes, downloading all your data, email, contacts, and files unless the data isencrypted. Even without hackers present, other devices, such as laptops, tablets, andsmartphones infected with malware can search for other vulnerable devices, infect them,and send information back to the hacker.

Recommendation: Turn off your Wi-Fi unless you are at work or at home. Use a Mobile VPNproduct if your company has one. If you are encrypting your desktop/laptop, include thecontents of your smartphone. Unfortunately, most smartphones purchased today have littleor no encryption capability.2) Bluetooth Man-in-the-Middle Attacks – When using your Bluetooth headset, others caneasily listen to phone conversations, make calls, and of course download your data. Whywould you secure the smartphone but leave this avenue via the Bluetooth headset open?Recommendation: Unless you are using an encrypted Bluetooth headset—the overwhelmingmajority are not encrypted—turn off Bluetooth and use a wired headset. Again, as a generalrecommendation, if you are encrypting your desktop or laptop, an encrypted Bluetoothheadset is appropriate.3) Lack of Awareness and Standardized Policies – Many security breaches for mobiledevices as well as laptops and desktops occur because users don’t understand the risksassociated with everyday actions.Recommendation: Create and maintain a portable media and device policy to describeexpected employee behavior. Create an End User Acceptance Policy that contains clearrequirements and expectations for mobile devices, including corporate-owned, as well aspersonal-owned devices that are allowed to access enterprise resources. Educate all userson the content of these policies on a recurring basis, and update each as necessary torespond to the changing mobile device landscape.4) Compromised Devices and Open Gateways – Stolen phones and devices log in tocompany networks every day, exposing corporate data to unauthorized disclosure ormodification.Recommendation: Use a mobile NAC (Network Access Control) software solution thatauthenticates, reviews, and compares devices to your policies before allowing them into thecorporate environment. Blocked devices that fail to meet the policy requirements can bequarantined to a site outside the DMZ (De Militarized Zone, or a sub-network that enclosesand exposes your organization’s external services to an untrusted network). It should requireregistration of employee-owned devices that will access corporate resources.5) Social Media Vulnerabilities: Advanced and persistent hackers use social sites to collectdata about you, your network of colleagues, and friends to create targeted and maliciousemails. The personal info posted on these sites is used to help create a relationship of trust inhopes that you’ll open an email link connected to an infected web site.Recommendation: Limit your employees’ exposure on social sites by discouraging themfrom sharing personal data and closely reviewing “friend” requests and emails. Instruct themto never click on links in an email from people they haven’t met personally - and even then,be wary.To read a full list of the 10 best practice suggestions for smartphone threats, check out theDell whitepaper, written by Jeff Fawcett and Brandon Swain from Dell SecureWorks.

Jeff Fawcett is a Security Practice Executive at Dell working with customers at the Strategy,Risk, and Architectural levels related to Mobility Security. A mixed background of 10 years inConsulting, 10 years as a Systems Engineer, and 10 years in Sales provides a uniqueperspective in the security area.Creating Metadata StandardsCHIME offers ONC recommendations on creating metadata standards.Metadata is essentially "data about data." It is the behind-the-scenes informationsurrounding data, such as where the data originated, what it means, how it has evolved andhow it should be used. Metadata is important when storing information in Electronic HealthRecords (EHRs) so a patients entire medical history can "follow" them through theirlifetime. The Office of the National Coordinator (ONC) created two initiatives, Query Healthand Data Segmentation, to better understand metadata and how it can best be used in thehealthcare industry.The program Query Health, which launched on September 6th, allows healthcare providersto submit public health or research data questions through a network of data partners. Thedata partners run the queries through a clinical information model and return the answers tothe requesting clinician. The program gives providers in small and large organizationsgreater access to best practices and public health analytics.The second, Data Segmentation Initiative (DSI), which is set to kick off on October 5, allowshealthcare providers to share parts of a patients EHR without sharing all of it. Thistechnology could allow patients to choose what information they would like to shareelectronically and what information they would prefer to remain private.Though these two initiatives are still in the very early stages of their development, they openthe door to a greater understanding, and hopefully a broader use, of metadata. The Collegeof Health Information Management Executives (CHIME) is excited about the opportunitiesthese initiatives bring, but they caution the ONC that the metadata standards may beunderdeveloped. They urge ONC officials to work closely with industry partners to studycomplex issues around metadata and develop and test standards before regulating metadatause to support health information exchanges (HIEs).Further testing will be wise. George T. Hickman, Executive Vice President and HIO of AlbanyMedical Center stated, “For those of us working on expedient and scalable ways to doagnostic EHR-to-EHR CCD (CDA family) exchanges, metadata is a very importantcomponent to get right. We’re making strides in New York to demonstrate use cases withimplementable outcomes for exchange, but to undertake an industry-wide pilot project thatrequires vendors to develop and providers to implement metadata standards is more than astretch.”It will be interesting to watch how the Query Health and DSI programs advance the use ofmetadata in the healthcare industry. It may be a while before we see uniform metadatastandards that will be accepted across the board, but these standards will be instrumental inthe effectiveness of EHRs to exchange information that extends the healthcare system andimproves the quality of care in the United States.

Health WatchA weekly digest of the latest news in the healthcare industryEHRs Really Do Pay- More than $635 million has already been distributed by the federalgovernment to healthcare providers. The data, compiled from CMS, offers details of how themoney was distributed to the organizations that met Meaningful Use. The Medicaidincentive program provided the largest share at $389 million and the Medicare incentiveprogram distributed $264 million. Additional data provided by CMS takes a look at thenumber of hospitals receiving Medicare and Medicaid incentives, the number of physicians,and more.NCQA Names Top 20 Health Plans for 2011- The National Committee for QualityAssurance (NCQA) once again selected Harvard Pilgrim Health Care (HMO/POS) America’sbest health plan for the eighth straight year. Executives at Harvard Pilgrim point to efficienthealthcare IT as a leading factor in achieving this ranking. HPHC’s high-touch customerservice model takes a proactive approach to informing members of health benefits andoffers information that encourages them to make better healthcare choices. The full list oftop health plans can be found here.Large Numbers Shown Seeking Healthcare Information Online- According to a HarrisInteractive poll, the percentage of US adults seeking healthcare-related information onlinereached 39 percent in 2011. This is a 7 percent increase from 2010, and is a 17 percentincrease from 2009. Search engines are the leading platform for pulling healthcareinformation with 69 percent of respondents indicating they have used Google, Yahoo, orothers in their search. As more people search online for crucial information on their health, itis important to ensure accuracy of information – 90 percent of people surveyed believeinformation found is reliable.Data Breaches Alarming Healthcare IT Executives- A report issued byPricewaterhouseCoopers shows that the healthcare industry is not adequately prepared tohandle data breaches. The company conducted 600 interviews during 2011 with healthcareexecutives across the country, and it was clear that embracing new technology was at thetop of their agenda. However, 50 percent of organizations surveyed have failed to addressmobility issues, less than 25 percent have addressed issues related to social media, and only47 percent have addressed issues relating to privacy and security. Executives must take astrategic approach to dealing with these potential breaches, and innovation in IT security isneeded to produce a cost-effective solution.

Tweets for Your ConsiderationA few tweets worth noting this week @DellHealth Dell Healthcare Talk about Shock Value! http://wapo.st/or2r9X via @washingtonpost | A graphic look at health costs pictured as food prices. #thinkhealth @ajax_63 Andrew Jackson Clinical-led IT to deliver improved patient outcomes: @DellHealthsupports @EHICCIOCampaign:ehi.co.uk/insight/analys… #NHS #CCIO @icmccupdate ICMCCupdate http://bit.ly/npdgoj Mobile technology will be omnipresent in health care #healthit #mhealth @HuntingtonNews Huntington Hospital #HHS announces $224 M to support evidence-based home visiting programs to help at-risk parents & #children http://ow.ly/6DjxX #healthreform @DellEnterprise Dell Enterprise Team Healthcare insurers: Prepared for growth & reform? Get the RIGHT technology! FREE Gartner report- http://sflow.us/oMe4KqBe sure to follow @DellHealth on Twitter for breaking Health IT and policy news.For Past UpdatesFor previous editions of the Washington Report, click here. To contact us, direct message us@DellHealth or send an email to Ask_Dell@Dell.com.

Washington Report- September 27, 2011

by Dell Washington Report

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 23

Statistics