Health Information Management

Educate board on cybersecurity practices

Briefings on HIPAA, December 28, 2015

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

When President Barack Obama issued Executive Order 13636 February 12, 2013, Dena Boggan, CPC, CMC, CHPC, took notice. Boggan is the HIPAA privacy and security officer for St. Dominic Hospital, a 535-bed, 27-clinic facility headquartered in Jackson, Mississippi.

Engaging the board

An August 2014 American Hospital Association (AHA) article, "Cybersecurity and Hospitals: What Hospital Trustees Need to Know About Managing Cybersecurity Risk and Response" (, reported that hospitals and healthcare are part of the United States' "critical infrastructure," meaning "their systems and assets are considered so vital to the country that their impairment as a result of a cyber attack would pose a threat to the nation's public health and safety."

That's why Boggan and St. Dominic found it critical to ensure they have a robust cybersecurity program. A major part of that program was to get the hospital's board of directors and board of trustees in the know about cybersecurity. Boggan notes that at some of the organizations that suffered major breaches of PHI, investigators found that board members were generally unaware that cybersecurity programs even existed.

"They had that deer caught in the headlights look when asked about their program," she recalls of her research.

The AHA recommended, Boggan says, that organizations get their board of directors in the know. She started by developing a cybersecurity overview for her board. She reports up to St. Dominic's compliance committee, which includes some board members.

"We gave them a good definition of what cybersecurity is and identified that board of directors and trustees need to be responsible for understanding, at a high level, their organization's cybersecurity risks and vulnerabilities," Boggan says. "They need to understand the security response plan that is in place, who in management is responsible for delivering that plan, and when it's appropriate for board insight over that plan."

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

    Briefings on APCs
  • Briefings on APCs

    Worried about the complexities of the new rules under OPPS and APCs? Briefings on APCs helps you understand the new rules...

  • HIM Briefings

    Guiding Health Information Management professionals through the continuously changing field of medical records and toward a...

  • Briefings on Coding Compliance Strategies

    Submitting improper Medicare documentation can lead to denial of fees, payback, fines, and increased diligence from payers...

  • Briefings on HIPAA

    How can you minimize the impact of HIPAA? Subscribe to Briefings on HIPAA, your health information management resource for...

  • APCs Insider

    This HTML-based e-mail newsletter provides weekly tips and advice on the new ambulatory payment classifications regulations...

Most Popular