Marti Arvin's guest appearances

Marti Arvin

Compliance Perspectives

Compliance Mastermind: Strategies for your healthcare compliance program and your career

Brenda Manning

Jay Anstine

Roy Snell

Jay Rosen

Jason Ross

Nick Morgan

Richard Lewis

John Riggi

James Green

Jay Kogen

Willie Garson

Alison Lee

John Wilson

Robert Smith

Brian Lee

OwlTail

Post By: Adam TurteltaubAmerica’s data is under attack. Solar Winds and other recent headline-grabbing stories have demonstrated that foreign adversaries are eager to hack into computer systems for a wide range of purposes.The US Department of Defense has had its supply chain hit hard, and to help protect both the chain and the nation’s assets has pursued the Cybersecurity Maturity Model Certification (CMMC), with a multi-level approach requiring outside certification, not the self-certification as in the past.  Although only for defense contractors, it is a model worth watching since it may eventually expand, in one form or another, to additional areas of government contracting.In this podcast Tony Buenger, Cyber Security Consultant and Instructor, and Marti Arvin, Executive Advisor, both of CynergisTek explain some of the complexities of CMMC and its many levels. Level 1 covers basic hygiene and is primarily focused on technical security controls. Level 3 is a certification that requires maturity in terms of documented policies and procedures that have been institutionalized. Level 5, the highest level, is focused on persistent threats.Notably CMMC focuses not just on technology, but also on processes and people, even looking to ensure that the process are built into the organization’s governance. As a result, it’s not a standard for just the CISO or CIO to handle. CMMC is a commitment that needs to be institutionalized, takes time, and requires both trust and ongoing verification.In sum, it very much requires the maturity that is a part of its name.Listen in to learn more about CMMC and what your organization needs to do now, and possibly in the future.

Post By: Adam Turteltaub America’s data is under attack. Solar Winds and other recent headline-grabbing stories have demonstrated that foreign adversaries are eager to hack into computer systems for a wide range of purposes. The US Department of Defense has had its supply chain hit hard, and to help protect both the chain and the nation’s assets has pursued the Cybersecurity Maturity Model Certification (CMMC), with a multi-level approach requiring outside certification, not the self-certification as in the past.  Although only for defense contractors, it is a model worth watching since it may eventually expand, in one form or another, to additional areas of government contracting. In this podcast Tony Buenger, Cyber Security Consultant and Instructor, and Marti Arvin, Executive Advisor, both of CynergisTek explain some of the complexities of CMMC and its many levels. Level 1 covers basic hygiene and is primarily focused on technical security controls. Level 3 is a certification that requires maturity in terms of documented policies and procedures that have been institutionalized. Level 5, the highest level, is focused on persistent threats. Notably CMMC focuses not just on technology, but also on processes and people, even looking to ensure that the process are built into the organization’s governance. As a result, it’s not a standard for just the CISO or CIO to handle. CMMC is a commitment that needs to be institutionalized, takes time, and requires both trust and ongoing verification. In sum, it very much requires the maturity that is a part of its name. Listen in to learn more about CMMC and what your organization needs to do now, and possibly in the future.

Marti Arvin and Anthony Buenger on the CMMC Framework [Podcast]

Adam Greene

Joan Podleski

Post By: Adam TurteltaubA hospital has a patient with COVID-19. Can it share this information with the media if the patient isn’t named?A patient in the ER hears the person in the next room coughing. He asks if that person has COVID-19. Can you tell him?An employee tells her boss she has COVID-19. What can the boss tell the rest of the office?The corona virus pandemic has led to endless questions about what is and isn’t permissible in both healthcare and other settings. Tackling the issues in this podcast are Joan Podleski, Chief Privacy Officer, Children’s Health; Marti Arvin, Executive Advisor, CynergisTek; and Adam Greene, Partner, Davis Wright Tremaine.As they explain, for healthcare organizations, there needs, as always, to be great sensitivity to HIPAA and what is considered personal health information (PHI). For employers in the rest of industry, HIPAA generally doesn’t apply but the American with Disabilities Act (ADA) may limit what you can and cannot share. It can even affect how you store the information about a COVID-19 patient in your systems.Compliance teams need to be alert to these and many other potential issues.Our podcast guests also advise compliance teams to ensure that IT systems are being used properly by remote employees. The family sitting around the dinner table is great at dinner, but not if there is PHI that the kids can see.Listen in to learn more about permissible, impermissible and accidental disclosures in the time of COVID-19.

Post By: Adam Turteltaub A hospital has a patient with COVID-19. Can it share this information with the media if the patient isn’t named? A patient in the ER hears the person in the next room coughing. He asks if that person has COVID-19. Can you tell him? An employee tells her boss she has COVID-19. What can the boss tell the rest of the office? The corona virus pandemic has led to endless questions about what is and isn’t permissible in both healthcare and other settings. Tackling the issues in this podcast are Joan Podleski, Chief Privacy Officer, Children’s Health; Marti Arvin, Executive Advisor, CynergisTek; and Adam Greene, Partner, Davis Wright Tremaine. As they explain, for healthcare organizations, there needs, as always, to be great sensitivity to HIPAA and what is considered personal health information (PHI). For employers in the rest of industry, HIPAA generally doesn’t apply but the American with Disabilities Act (ADA) may limit what you can and cannot share. It can even affect how you store the information about a COVID-19 patient in your systems. Compliance teams need to be alert to these and many other potential issues. Our podcast guests also advise compliance teams to ensure that IT systems are being used properly by remote employees. The family sitting around the dinner table is great at dinner, but not if there is PHI that the kids can see. Listen in to learn more about permissible, impermissible and accidental disclosures in the time of COVID-19.

Marti Arvin, Adam Greene and Joan Podleski on COVID-19 Disclosure Issues [Podcast]

Today on the show I am talking with Marti Arvin. Marti is the Vice President of audit strategy for CynergisTek and has more than three decades of operational and executive leadership experience in the fields of compliance, research, and regulatory oversight in both academic medical and traditional hospital care settings.   Marti and I are talking about vendor management. This is one of those areas that I think can be very overwhelming and it's hard to know where to start. In our conversation Marti provides some very practical suggestions and tactics to help you evaluate your organization’s vendor relationships and ensure that you have the appropriate controls in place. You can reach Marti at: marti.arvin@cynergistek.com or https://cynergistek.com  Podcast website: www.compliancemastermind.com  Rebekah can be reached at: compliancemastermind@gmail.com Remember to subscribe to the show! Disclaimer: On this podcast I speak only for myself and what I share are the opinions of me alone. My guests also speak for themselves only and do not represent the opinions of their firms or organizations. All content provided on this podcast is for information purposes only. Neither I or my guests make any representations as to the accuracy or completeness of any information on the podcast or in the show notes. This podcast should not be used in any legal capacity whatsoever. Please consult a qualified attorney before taking any action that could have legal implications to you or your business.

Today on the show I am talking with Marti Arvin. Marti is the Vice President of audit strategy for CynergisTek and has more than three decades of operational and executive leadership experience in the fields of compliance, research, and regulatory oversight in both academic medical and traditional hospital care settings.   Marti and I are talking about vendor management. This is one of those areas that I think can be very overwhelming and it's hard to know where to start. In our conversation Marti provides some very practical suggestions and tactics to help you evaluate your organization’s vendor relationships and ensure that you have the appropriate controls in place. You can reach Marti at: <a href="mailto:marti.arvin@cynergistek.com">marti.arvin@cynergistek.com</a> or <a href="https://cynergistek.com" rel="nofollow" target="_blank">https://cynergistek.com</a> Podcast website: <a href="http://www.compliancemastermind.com" rel="nofollow" target="_blank">www.compliancemastermind.com</a> Rebekah can be reached at: <a href="mailto:compliancemastermind@gmail.com">compliancemastermind@gmail.com</a> Remember to subscribe to the show! Disclaimer: On this podcast I speak only for myself and what I share are the opinions of me alone. My guests also speak for themselves only and do not represent the opinions of their firms or organizations. All content provided on this podcast is for information purposes only. Neither I or my guests make any representations as to the accuracy or completeness of any information on the podcast or in the show notes. This podcast should not be used in any legal capacity whatsoever. Please consult a qualified attorney before taking any action that could have legal implications to you or your business.

CM018: Vendor Management with Marti Arvin