Gerry Blass's guest appearances

Gerry Blass

Compliance Perspectives

Healthcare NOW Radio Podcast Network - Discussions on healthcare including technology, innovation, policy, data security, telehealth and more. Visit HealthcareNOWRadio.com

Healthcare IT Today Interviews

Jared Johnson

Margarita Derelanko

Jane Sarasohn-Kahn

Lisa Miller

Drew Ivan

Damon Auer

Cam Deemer

Micky Tripathi

Jeremy Orr

Lee McGrath

Rochelle Walensky

Carla Robinson

Jill McCormick

Julie Sheppard

Nancy Brickhouse

OwlTail

Post By: Adam TurteltaubHealthcare risk doesn’t stop at the facility’s door. Covered entities have countless business associates (BA), each of which poses risks of its own. That, in and of itself, is a challenge, but Gerry Blass, President and CEO of ComplyAssistant observes in this podcast that many covered entities aren’t even sure of their complete list of vendors, let alone the risks that can reside in them.To get a handle on this situation he recommends creating an inventory of your BAs and then dividing them into high, medium and low inherent risk. That involves looking at what each vendor does and the relative risks involved on a granular level. For example, an electronic medical record (EMR) vendor with a cloud-based solution is going to be inherently high risk. A vendor that transfers but does not store data may be just a medium-level risk.With reports indicating that approximately 60% of breaches occurred at the vendor level in 2021, getting a handle on this risk is critical.Of course, preliminary scoring of the risk level is only the first step. From there the organization needs to get more detailed information to ensure that there are adequate mitigation measures.He recommends putting together a detailed list of questions both to ask during the onboarding process and later as a part of ongoing auditing and monitoring of the BA. Checking in periodically is essential because situations do change. The work being done by the vendor may have evolved, and so may the vendor’s internal risk management efforts.He also advises looking at the BA’s own business associates. A given vendor may rely on 10 others.  As a result, it’s important to understand how the risk of the BA’s own BA’s are being managed.Finally, he also addresses the need to reassess risk as organizations return to the workplace, including how remote access is handled.Listened in to learn more about how to improve your healthcare vendor risk management processes.

Post By: Adam Turteltaub Healthcare risk doesn’t stop at the facility’s door. Covered entities have countless business associates (BA), each of which poses risks of its own. That, in and of itself, is a challenge, but Gerry Blass, President and CEO of ComplyAssistant observes in this podcast that many covered entities aren’t even sure of their complete list of vendors, let alone the risks that can reside in them. To get a handle on this situation he recommends creating an inventory of your BAs and then dividing them into high, medium and low inherent risk. That involves looking at what each vendor does and the relative risks involved on a granular level. For example, an electronic medical record (EMR) vendor with a cloud-based solution is going to be inherently high risk. A vendor that transfers but does not store data may be just a medium-level risk. With reports indicating that approximately 60% of breaches occurred at the vendor level in 2021, getting a handle on this risk is critical. Of course, preliminary scoring of the risk level is only the first step. From there the organization needs to get more detailed information to ensure that there are adequate mitigation measures. He recommends putting together a detailed list of questions both to ask during the onboarding process and later as a part of ongoing auditing and monitoring of the BA. Checking in periodically is essential because situations do change. The work being done by the vendor may have evolved, and so may the vendor’s internal risk management efforts. He also advises looking at the BA’s own business associates. A given vendor may rely on 10 others.  As a result, it’s important to understand how the risk of the BA’s own BA’s are being managed. Finally, he also addresses the need to reassess risk as organizations return to the workplace, including how remote access is handled. Listened in to learn more about how to improve your healthcare vendor risk management processes.

Gerry Blass on Healthcare Vendor Risk Management [Podcast]

In a recent discussion with Gerry Blass, President &amp; CEO of ComplyAssistant, he pointed out a number of things about ransomware that make it a unique challenge for healthcare organizations from a disaster recovery and business continuity perspective.  Not the least of which is that any healthcare organization could be hit by ransomware.  Plus, unlike many other disaster recovery situations, how much downtime you’ll have from ransomware is undetermined and may last for a long time.   In the video below, you can learn more about how the world of disaster recovery and business continuity (DRBC) has been changing and what’s needed in healthcare organizations today.  Plus, Blass shares some of the common issues he sees in healthcare organizations DRBC plans.   We also dive into whether healthcare organizations should pay the ransom and some of the challenges a healthcare organization will need to consider if they do want to pay the ransom (ie. $20k per day limit on buying bitcoin).  Blass also shares his thoughts on when to involve local police and the FBI and the benefits of doing so. Plus, he offers some good first steps that healthcare organizations can take to make sure they’re better prepared for disasters.   Check out the interview below for more info on disaster recovery and business continuity and how ransomware has changed both of these important efforts.   Learn more about ComplyAssistant: https://www.complyassistant.com/  Find more great Health IT content: https://www.healthcareittoday.com/

In a recent discussion with Gerry Blass, President &amp; CEO of ComplyAssistant, he pointed out a number of things about ransomware that make it a unique challenge for healthcare organizations from a disaster recovery and business continuity perspective.  Not the least of which is that any healthcare organization could be hit by ransomware.  Plus, unlike many other disaster recovery situations, how much downtime you’ll have from ransomware is undetermined and may last for a long time.   In the video below, you can learn more about how the world of disaster recovery and business continuity (DRBC) has been changing and what’s needed in healthcare organizations today.  Plus, Blass shares some of the common issues he sees in healthcare organizations DRBC plans.   We also dive into whether healthcare organizations should pay the ransom and some of the challenges a healthcare organization will need to consider if they do want to pay the ransom (ie. $20k per day limit on buying bitcoin).  Blass also shares his thoughts on when to involve local police and the FBI and the benefits of doing so. Plus, he offers some good first steps that healthcare organizations can take to make sure they’re better prepared for disasters.   Check out the interview below for more info on disaster recovery and business continuity and how ransomware has changed both of these important efforts.   Learn more about ComplyAssistant: <a href="https://www.complyassistant.com/" rel="nofollow" target="_blank">https://www.complyassistant.com/</a> Find more great Health IT content: <a href="https://www.healthcareittoday.com/" rel="nofollow" target="_blank">https://www.healthcareittoday.com/</a>

Interview with Gerry Blass from ComplyAssistant

Post By: Adam TurteltaubWith healthcare relying so heavily on vendors to manage data the risks of a breach are enormous.  According to Gerry Blass, President and CEO of ComplyAssistant, a recent survey found that 63% of cyberattacks were through third parties.In this podcast he provides insight into how to assess and manage the risk of breaches through business associates.  To best manage the risk, it’s best to begin before signing the contract: that’s when vendors are most willing to allow you to conduct a technical and administrative assessment of their security.  Be sure, he advises, to ask to see their SOC 2 report.On an ongoing basis do an assessment at least once a year, more frequently for higher risk entities.And always look at issues such as: 	If the third party has downstream business associates, are they located in the US or in countries with different data rules? 	Are their employees accessing the data remotely? 	What controls are in place if an employee is terminated?Listen in to learn more about which third parties hold the most and least risk, and what you can do about it.

Post By: Adam Turteltaub With healthcare relying so heavily on vendors to manage data the risks of a breach are enormous.  According to Gerry Blass, President and CEO of ComplyAssistant, a recent survey found that 63% of cyberattacks were through third parties. In this podcast he provides insight into how to assess and manage the risk of breaches through business associates.  To best manage the risk, it’s best to begin before signing the contract: that’s when vendors are most willing to allow you to conduct a technical and administrative assessment of their security.  Be sure, he advises, to ask to see their SOC 2 report. On an ongoing basis do an assessment at least once a year, more frequently for higher risk entities. And always look at issues such as: 	If the third party has downstream business associates, are they located in the US or in countries with different data rules? 	Are their employees accessing the data remotely? 	What controls are in place if an employee is terminated? Listen in to learn more about which third parties hold the most and least risk, and what you can do about it.

Gerry Blass on Healthcare Third-Party Data Breaches [Podcast]