Table Of ContentPRAISE FOR HOW HIPAA CAN CRUSH YOUR MEDICAL PRACTICE
“How HIPAA Can Crush Your Medical Practice, by Craig Petronella, is a sobering
analysis of the very real and growing threat of cyber ransom. It offers proven solutions and
proactive steps that thwart extortionists who can steal confidential patient information
from your servers and hold you up for ransom, threatening to bring the iron-HIPAA fist
down on your practice like a ten-ton wrecking ball. Ignore this book at your peril.”
Daniel Levis
Author, The Email Alchemist and The Web Marketing Advisor
It is said, “Evil knows no bounds.” In this extremely fast-paced age of technology and new
social media forms advancing faster than most can comprehend, let alone grasp, it is
crucial to proactively address the ever-increasing potential of cyber threats that social
media, workplace exposure, data breaches, and hackers bring to your doorstep.
If people today had the slightest inkling of the ever present, unrelenting, and imminent
dangers posed by malware, spyware, ransomware, and keyloggers to their livelihood and
the safety and security of their families, they would never sleep. Over six hundred million
new viruses are introduced to the Internet every year—every year—and the number is
growing!
Along with all the good that technology affords, there exists an evil and malicious element
hell bent on using the same technologies to steal, deceive, malign, and destroy all you
have worked for.
How should people protect themselves, their livelihoods, or their families? First, you must
recognize that there is a problem. Second, you must identify the problem. Then, you must
exercise all available resources to neutralize the threats. Last, you must remain vigilant.
The vast majority of people have no clue they even have a problem until they really do
have a problem. So you have a problem, now what? Unless you are a cyber security/IT
expert, it is vitally important to know someone who is.
I happen to know someone who is, and I highly recommend his services. His name is
Craig Petronella. He has devoted his life’s work to IT, to educating his clients, and to
mitigating the dangers associated with cybersecurity breaches.
I encourage you to start a conversation with Craig Petronella today. If you wait, the
damage could be irreparable.
Larry J. Fenn
Global Account Executive at Global Money International
“A MUST read for everyone that owns a business which directly or indirectly supports the
medical market! But brace yourself! This book will not make you feel good. Instead, it
will arm you with the information you need to make prudent decisions to help ensure the
integrity, availability and confidentiality of the patient healthcare information in your trust.
Craig Petronella uses plain spoken, easy to understand, and hard-hitting language along
with real world examples to help best confront the spectrum of threats lurking inside and
outside of your business. Small to medium sized businesses should pay particular
attention, as they can most readily be crushed by the costs of a network breach. Craig is a
security pro, and I congratulate him on his efforts!”
James G. Bitzes, Colonel, USAF (retired), Cyber/National Security Legal Counsel
HOW HIPAA CAN CRUSH
YOUR MEDICAL PRACTICE
HOW HIPAA CAN CRUSH
YOUR MEDICAL PRACTICE
WHY MOST MEDICAL PRACTICES DON’T HAVE A CLUE ABOUT
CYBERSECURITY OR HIPAA AND WHAT TO DO ABOUT IT
Craig A. Petronella
Published by
Petronella Technology Group, Inc., Raleigh, North Carolina
Copyright
© 2016 Craig A. Petronella. All rights reserved. No part of this publication may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or
otherwise, except as permitted under Section 107 or 108 of the 1976 US Copyright Act, without the prior written
permission of the publisher. Requests to the publisher for permission should be addressed to Petronella Technology
Group, Inc., 5540 Centerview Dr., Suite 200, Raleigh, NC 27606.
Limit of Liability/Disclaimer of Warranty: While the publisher and authors have used their best efforts in preparing this
book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this
book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty
may be created or extended by sales representative or written sales materials. The advice and strategies contained herein
may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher
nor the authors shall be liable for any loss of profit or any other commercial damages, including but not limited to
special, incidental, consequential, or other damages. For general information on other products and services, please visit
the website: https://healthcareitsupport.com.
ISBN: 1533019193
ISBN 13: 9781533019196
Library of Congress Control Number: 2016907784
CreateSpace Independent Publishing Platform
North Charleston, South Carolina
Craig Petronella, the top cybersecurity
expert and IT authority in Raleigh, North
Carolina, has authored multiple books,
including Peace of Mind Computer Support.
He has spent thirty years advising clients
and protecting computer information. Craig
makes sure your medical practice network
works when you need it the most, and he is
a celebrity in his field and hometown.
Craig is frequently quoted in the local
Raleigh news and appears on local TV news
programs for his expertise in protecting
local businesses and medical practice
owners from hackers halfway around the
world in places such as Ukraine, Russia,
and China. Craig has been quoted and
featured on ABC News North Carolina,
CBS News North Carolina, NBC stations
WNCN in Raleigh and WCNC in Charlotte, NC Time Warner Cable News, PR Newswire,
and Newsobserver.com.
CONTENTS
Foreword
Section I Introduction: HIPAA Can Hurt You
Chapter 1 Are You in the HIPAA Crosshairs?
Chapter 2 What Does It Take to Comply with HIPAA?
Chapter 3 Why Is Failure to Comply So Serious?
Section II Introduction: HIPAA Violations Can Occur Against Your Will
Chapter 4 How Do Breaches Happen?
Chapter 5 What Cyber Threats Do You Face?
Chapter 6 Why Must Security Maintenance Be Active and Ongoing?
Section III Introduction: Your Data Can Be Kidnapped
Chapter 7 What Exactly Is Ransomware?
Chapter 8 How Would Ransomware Ruin My Day?
Chapter 9 How Can I Prevent a Ransomware Attack?
Section IV Introduction: You Can Protect Yourself
Chapter 10 What Preventive Measures Can You Take?
Chapter 11 Why Is Having a Quality IT Provider So Important?
Chapter 12 How Can You Choose the Best IT Provider for You?
Four Pillars of IT Success Analysis
Actual Disasters the Four Pillars Could (or Did) Prevent
Appendix
FOREWORD
by Perry S. Marshall
Author of Ultimate Guide to Google AdWords, Ultimate Guide to Facebook Advertising,
and 80/20 Sales & Marketing
This book scared me.
I do not bear even a fourth of the risks that a typical US health-care provider bears. In fact,
HIPAA has nothing to do with me. I’m not a doctor’s office, not a dentist, not an insurance
company. I’m a business and marketing consultant. But the dangers online are so real that
even nonmedical businesses need to batten down the hatches.
Now.
Did you know that hackers can hold you hostage and get money from you repeatedly with
“ransomware”? Did you know one innocuous USB stick can cost you millions of dollars
in federal fines? Did you know that one misstep by a twelve-dollars-per-hour employee
could give government agencies unlimited access to drain your retirement account by
forced wire transfer?
The risks are grave. And the victims are legion. Will you be next? What precautions
should you take?
This book gives you solid answers in an easy one-hour read. Craig Petronella has digested
huge amounts of information for you—gleaned from hundreds of industry journals,
seminars, conferences, experts, clients, and up-close-and-personal, unmitigated disasters
that he’s had a front-row seat to—and condensed his experience and expertise into a book
barely over one hundred pages long.
When I finished reading this book, I asked Craig to spend some time with my staff
educating them about how loose lips sink ships—how one password stored in the wrong
place or one wrong file folder or computer left in the back seat of a car can destroy your
future.
Somebody’s future is going to be destroyed, because of the dangers Craig describes in this
book.
But it doesn’t have to be you.
To your success,
Perry Marshall
Author, Ultimate Guide to Google AdWords,
Ultimate Guide to Facebook Advertising, and
80/20 Sales & Marketing
SECTION I
INTRODUCTION: HIPAA CAN HURT YOU
E
ver since the US Senate endorsed it in 1996, the Health Insurance Portability and
Accountability Act (HIPAA) has set the standard for protecting Americans’ private
health information. An individual’s well-being or lack thereof is strictly his or her own
business, and HIPAA aims to make sure nobody’s nose is in that business unless
absolutely necessary.
That’s great and all—upholding privacy rights is important—but at the same time
that HIPAA has proven to be beneficial to guarding patient information, it has also proven
to be a monumental challenge for the people responsible for keeping that information
private. In fact, it’s just downright hard. There is a never-ending list of strict regulations
that govern how an individual’s personal health information (PHI) may be used or
disclosed, and there are increasingly stiff penalties for failing to comply with these
regulations.
In short, if you are one of the folks subject to HIPAA compliance, you are
walking the proverbial tightrope. And there is no net to catch you if you fall.
The stakes were raised further in 2009 with the Health Information Technology for
Economic and Clinical Health (HITECH) Act. This addition shines the spotlight on the
electronic aspect of health information, including the proper handling of electronic
personal health information (e-PHI). Basically, it took HIPAA to new heights via
computers. HITECH actively promotes the adoption of health information technology,
effectively pushing the medical community to get with the times and digitize. It also
strengthens the enforcement of HIPAA rules and makes penalties for noncompliance even
scarier than they were before.
Violators of HIPAA protocols now face penalties both civil and criminal. That’s
right—we said “criminal.” In addition to the civil penalties incurred when disobeying
HIPAA, deliberate violators are prosecuted criminally and can receive a prison term of up
to ten years. Yep. A person can now go to prison for really fouling up HIPAA compliance.
In the immortal words of Milton Bradley’s board game Monopoly: “Go directly to jail. Do
not pass go. Do not collect $200.”
