Tip: Use 'honeypots' to catch snooping employees
HIPAA Weekly Advisor, December 8, 2008
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Some facilities use “honeypots” as bait to catch snooping staff members who are in violation of HIPAA. “Honeypots,” also referred to as “honeynuts,” are fictitious medical records that IT monitors to determine if anyone is accessing them.
If you already have strong security techniques in place, honeypots enhance your ability to monitor compliance.
“This is frosting on the security cupcake,” says Gary Nichols, CISM, information security officer for Blue Cross Blue Shield (BCBS) of Arizona. If you’re a privacy director pursuing this strategy, gaining executive sponsorship the first step, says Nichols.
You need to have executive sponsorship willing to back you in the event that the use of honeypots results in controversy. After you’ve earned administration’s support, you’ll next need to have the information security and HIM department set up and monitor the honeypot.
Human resources participation is necessary to ensure that they will and can take appropriate action if you catch someone accessing records inappropriately, John Christiansen, founder of Christiansen IT Law, in Seattle. says. “Legal counsel should vet the whole program to make sure legal risks are avoided,” he says.
Editor’s note: This tip is adapted from an article in the December issue of the HCPro, Inc., newsletter, Briefings on HIPAA. For more advice on using “honeypots,” please see the next edition of HIPAA Weekly Advisor.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Comments
0 comments on “Tip: Use 'honeypots' to catch snooping employees ”
Related Products
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
HIPAA Training Handbook for Business Associates
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Executive, Administrative and Corporate Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- Running an effective peer review committee meeting
- HealthDataInsights posts new issues for medical necessity claims
- Sneak Peek: Effort underway to establish caseload benchmarks
- Q/A: Coding for telescopic intraocular lens
- New FAQ posted on storing laryngoscope blades
- Tip: Perform your own internal investigation prior to government audit
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- What does case-mix index mean to you?
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- HHS task force: Consider privacy, security with text messages
- Q/A: Coding for telescopic intraocular lens
- Q/A: Correct use of modifier -PT
- Tip: Correctly code bilateral pain management procedures
- "Wall fountains" may be spreading Legionnaires to patients, visitors
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- COT basics to best
- Searched