CHRIS: That's right. Yeah. And this ultimately ends up resulting in a lot of confusion in the industry about what exactly that means. What is it that security, where does it begin, and where does it end? How can you say that your system is meeting these standards of security, the HIPAA security rule? And the reality is, is technically, there isn't a literally 100% clear cut compliance audit that the government does, and in their enforcement, it's not literally just make or break one way or the other. The general concept though is that data does need to be encrypted at rest, the resources that are in place to set up the physical safeguards need to be very secure. So generally, this is going to be similar to the level of security that you would see with the payment card industry, PCI DSS payment card data security standard.
And so in addition to the physical security, and like you were saying, Ron, some of this administrative security on the technical side, there are constantly breaches. Everyone hears about them all the time where ransomware is taking over large oil refineries or oil distribution companies, or possibly crippling healthcare organizations directly, or there's malware and things like this, people's accounts get hacked into. So this is a real legitimate concern that there need to be actual technical safeguards in place. And probably the best way to look at this is that, it's an ongoing effort. In order to ensure that the security rule is met, you're going to want to incorporate ongoing maintenance and patching of whatever software that you have, and actually have a plan, and document the plan, and then actually execute on that plan to keep your software up to date.
So whenever you have ePHI data directly, or you're working with a vendor that does have that data, you need to make sure that you or the vendor or vendors actually comply with the security rule. And the security rule, it's ultimately going to be more and more complex if you have a lot more complex scenarios, if you're dealing with a lot more robust sets of data, and you're transferring it between different locations, that becomes more complex. So you need to budget and allocate resources based on the complexity. If it's a simple form, like you were saying, Ron, it really needs to be something that the company is aware of, the covered entity or the organization is aware of, but they probably don't need to put a huge budget out there, there are some nice SaaS-based offerings, right?
RON: Yeah. Yeah. The thing I always see where our clients make the mistake is, they come to us, they ask for a HIPAA compliant website, we put it in place, and off they go, and they're like, great, we're done, and they don't have any of that ongoing stuff, and then they don't necessarily engage us for ongoing maintenance. Fortunately, I haven't seen any of our HIPAA compliance sites ever be breached, however, the handful of clients that I have seen in my almost 10 years here that their sites have been hacked, they were sites that we did seven years ago, and then they did their own internal maintenance, but like you just literally explained, they didn't stay up on the patches, they didn't have a plan in place, a security officer wasn't assigned to ensure that specific protocols were met, and sure enough, over six or seven years, they either missed a patch or got lazy, and boom, their site got hit.
So this is much more important, because it's not just your information on your website anymore, you're literally talking about the patients protected by the government law's data, and you have to have a really good plan in place for ongoing maintenance and continued improvements. As technology changes, your securing of this data has to change with it.