As with every new year, new regulations and upcoming changes are on the horizon. Cybersecurity will become a new regulation this year with the Joint Commission under the emergency preparedness standards. It has become a focal area within the last few years due to the advance of ransomware affecting hospitals nationwide. 

When a hospital is attacked, their medical information is held for ransom and a monetary figure is given to them indicating how much the hackers want for the hospital to get their information returned. 

There have been instances when the exit strategy for the hospital was to pay the ransom to get their information back. They felt that the best way to approach it was to pay the ransom then take the chance of the information being distributed on a global scale. In cases like these, the federal government is involved in the process and attempts to identify the hackers and prevent the transaction proceeding. By that time, the damage is already done, especially since your accrediting agency and CMS are involved. 

Last November, CMS put out a bulletin specifically to help Emergency Preparedness staff and IT departments provide more information on the types of ransomware they are seeing. It also stated how the ransomware programs have evolved to the point so that they attach through other malicious means. The Joint Commission alert dives even deeper into the realm of cybersecurity and specific types of names that are deemed to be virus/ransomware. I think you will be interested in what the CyberSecurity and Infrastructure Security Agency has to say about the issue. 

Since Soleran is a software-based company, we also take cybersecurity very seriously. In fact, we utilize multiple locations and servers to back up our data. This ensures if one area becomes corrupted, we are able to retrieve the data from another location. To give you an idea of how serious we take our security, we do not provide any information on where our locations are or how many times we back up information. This approach provides the best possible service for our clients in the present and future. 

We are still waiting on the exact changes from the Joint Commission, but early information is indicating that your IT Director will become part of the Life Safety Session. The idea is to build a culture of cybersecurity. Specific questions will be asked on how you test staff to ensure that cybersecurity is still considered a focus and hasn’t become lax due to virus/ransomware fatigue. Once more information is received and the standards are updated, I will provide more information to help with your upcoming surveys.  

References:

Cybersecurity Alert | The Joint Commission

New Quick Safety advisory on building a culture of cybersecurity | The Joint Commission