Google Health - NYHIMA

[object Object],[object Object],Google Health's Impact on Compliance and Patient Care Raj Goel, CISSP

Google Health's Impact on Healthcare ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Google Health's Impact on Healthcare ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],1936 - SSNs established 1938 - Wallet manufacturer includes secretary's SSN card inside a wallet. 40,000 people thought it was their SSN. Pre-1986 - kids under 14yrs not required Post-1990 - Kids get SSN # with Birth Certificate http://en.wikipedia.org/wiki/Social_Security_number

Did I say TRW/Equifax/Experian Huge? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Your users & staff will want it...anyway ,[object Object],[object Object],[object Object],[object Object],[object Object]

Your users & staff will want it...anyway ,[object Object],[object Object],[object Object],[object Object],[object Object],ISO 8583 - Standard for ATM Transactions 1987 Version 1993 Version 2003 Version Each organization maps their data to the standard when communicating with other firms. Exactly what Healthcare has been trying to do for 20+ years.

How is Google Marketing Google Health? Currently, working with selected organizations. Employees and Patients of these organizations are invited to use GH. Same marketing model as Gmail or GoogleTalk. Early adopters get invites which are “limited” in quantity. Overtime, everyone who wants it will get it. Microsoft HealthVault and GoogleHealth use similar models. Walmart, and other large corporations (Intel, AT&T, Pitney-Bowes, Sanofi-Aventis, etc), are testing/using/rolling out Dossia to their employees.

What's wrong with Google Health? GH Privacy Policy ,[object Object],[object Object],[object Object]

What's wrong with Google Health? GH Privacy Policy ,[object Object],[object Object],[object Object],These 3 rd parties and subsidiaries are NOT enumerated. One of Google’s subsidiaries is DoubleClick – one of the reasons HIPAA Privacy & Security rules were created was to protect healthcare data from marketers like DoubleClick.

Google Health's Terms ,[object Object],[object Object],[object Object]

Google Flu Trends ,[object Object],[object Object],[object Object]

Google Flu Trends ,[object Object],[object Object],[object Object],Search for “dark web”

ECPA – Electronic Communications Privacy Act (1986) ,[object Object],[object Object],[object Object],[object Object]

ECPA – Electronic Communications Privacy Act (1986) ,[object Object],[object Object],[object Object],[object Object],FBI Abuses Patriot Act http://www.nytimes.com/2007/03/10/washington/10fbi.html Sprint received 8 MILLION law enforcement requests in 13 months http://www.eff.org/deeplinks/2009/12/surveillance-shocker-sprint-received-8-million-law Your Identity for Sale http://money.cnn.com/2005/05/09/pf/security_info_profit/index.htm Google "FBI buys data from private sector"

ECPA – Disclosure Rules ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ECPA – Disclosure Rules ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],CSO's and CPOs should know about ECPA Employees are forwarding emails to GMAIL because it is fast, easy to use and has copious capacity. The opposite of most corporate email systems. How many of your employees are forwarding emails to gmail/yahoo/hotmail right now?

ECPA – Disclosure Rules ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Shameless Self-Promo!! Brainlinks provides HIPAA, PCI-DSS and State Privacy Breach law compliance audits Information Security Audits IT Consulting for Healthcare If you like what you're hearing, hire us! www.brainlink.com

US vs WARSHAK ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

US vs WARSHAK ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],US v Warshak could set the benchmark for online privacy expectations.

US vs WARSHAK ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Hackers transfer $ 378,000 from Poughkeepsie to Ukraine http://www.finextra.com/News/fullstory.aspx?newsitemid=21055 ATM hackers steal $ 9 Million in 1 day http://www.wired.com/threatlevel/2009/02/atm/ Banking Trojan steals $ 438,000 http://news.cnet.com/8301-27080_3-10363836-245.html Bank Of America vs. Lopez http://www.americanbanker.com/usb_issues/115_4/-246231-1.html Read “Trends in Financial Crimes” http://www.brainlink.com/news/159/24/InfoSecurity-Issue-7---Trends-In-Financial-Crimes.html

Threats ,[object Object],[object Object],[object Object],[object Object]

Threats ,[object Object],[object Object],[object Object],[object Object],Users treat their computers like cars. They assume there's a lemon law for software, or a seatbelt protecting them from themselves. Nothing could be further from the truth.

Threats ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Threats ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Why does a PDF reader install a virus scanner? Do you allow your users to install software? Can you roll-back user installations? Can you find rogue software installations? Unlike desktop applications, where you control when updates get applied, Web 2.0 applications can add features, change privacy policies, etc. at anytime, outside your control. Woman loses job after tweeting to Governor Barbour http://www.wlbt.com/Global/story.asp?S=11713360

Threats ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],People like new technology, new tools. However, they don't always understand the risks involved. Web-based applications are integrating with each other (OpenSocial, OpenID, Ebay+Paypal, etc) - Google Buzz merges social networking with contacts Desktop tools are integrating with online systems - Google Desktop, Picasa, etc. - Office 2010 with Facebook & Twitter integration

Other Threats - Online profiles ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Other Threats - Online profiles ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],You can purchase a person's online profile report that consolidates information from various social networks, credit reports, etc in a single document. Recruiters are vetting online profiles when interviewing or submitting candidates.

Other Threats - Online profiles ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Does your HIPAA Compliance Policy, or Employee handbook, have a procedure for dealing with online postings regarding terminations? How soon after termination can they twitter or facebook or otherwise advertise their new, unemployed, status?

Recommended Reading ,[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],EMR – Electronic Medical Record – software is deployed by the covered entity PMR/PHR – Personal Medical/Health Record – software adopted by patients to self-manage their medical records.

Raj Goel, CISSP Raj Goel, CISSP, is an Oracle and Solaris expert and he has over 22 years of experience in software development, systems, networks, communications and security for the financial, banking, insurance, health care and pharmaceutical industries. Raj is a regular speaker on HIPAA, Sarbanes-Oxley,PCI-DSS Credit Card Security, Information Security and other technology and business issues, addressing diverse audiences including technologists, policy-makers, front-line workers and corporate executives. He also works with community and professional organizations such as the InfraGard, ISC2, and TibetAid.org, and the Association of Cancer Online Research - ACOR.org. ,[object Object]

Contact Information ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Google Health - NYHIMA

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Google Health - NYHIMA

Similar to Google Health - NYHIMA (20)

More from Raj Goel

More from Raj Goel (12)

Recently uploaded

Recently uploaded (20)

Google Health - NYHIMA