SOC 2 Overview
A Service Organization Controls (SOC) 2 audit examines the controls an organization has in place to protect and secure its system, or services used by customers or partners. An organizationā€™s security is assessed based on the requirements within a SOC 2 examination, known as the Trust Services Criteria (TSC). The is the governing body of the SOC framework and they set the U.S. standards that auditors follow for SOC 2 examinations.

The report assesses if a companyā€™s controls are appropriately designed and working under the five TSC. They include:

• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Security is the only TSC that must be met in the SOC 2 report. The other four are optional but are usually added depending on the type of service(s) that an organization offers. This versatility is essential because SOC 2 reports are meant for use across all industries.Ā No matter the nature of the business, the focus is on securing digital information.

There areĀ , Type 1 and Type 2.

• SOC 2 Type 1Ā evaluates an organizationā€™s cybersecurity controls at a single point in time. The goal is to determine whether the internal controls put in place to safeguard customer data are sufficient and designed correctly. Do they fulfill the required TSC? Type 1 audits and reports can be completed in a matter of weeks.
• SOC 2 Type 2 examines how well a service organization’s system and controls perform over a period of time (typically 3-12 months). What is their operating effectiveness? Do they function as intended? Type 2 audits can take 12 months to complete and are costlier than Type 1 audits.

How Does SOC 1 Differ From SOC 2?
SOC 1 Type 2 is an audit 911³Ō¹Ļ undergoes annually. It focuses on financial controls instead of data security. If a company uses a third-party service provider to perform crucial financial reporting processes (e.g., an outsourced payroll management system or a revenue reporting platform), the company will likely ask those service providers for a SOC 1 report. As a bill review provider conducting payment processing services on behalf of clients, 911³Ō¹Ļ frequently provides our SOC 1 report to customers.

Like SOC 2, there are two levels of SOC 1 audits:

• SOC 1 Type 1 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the design of the controls to achieve the related control objectives included in the description, as of a specified date.
• SOC 1 Type 2 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the designĀ and operating effectivenessĀ of the controls to achieve the related control objectives included in the description throughout a specified period.Ā Type 2 audits are much more robust than Type 1. Type 2 audits actually evaluate if a company is doing what it says over a period of time.

HITRUST Overview
Founded in 2007, the, orĀ , is a not-for-profit organization advocating programs that protect sensitive information and manage information risk.

While the HITRUST Common Security Framework (CSF) is designed for all industries,Ģżit is closely associated with the healthcare industryā€™s challenges, such as the numerous applications of controls specific to healthcare (e.g., ). Overall, the HITRUST framework is used as a guide by organizations that deal withĀ or ePHI. TheĀ Ā was a response to the need to have more consistency in certifications. The aim is to have a standard regulation and risk management framework.

HITRUST CSF consolidated the varying requirements from ,Ģż, , , and and checks for the following:

• The presence of clearly defined procedures and policies
• Capability testing to prove its implementation
• Demonstration of a companyā€™s ability to measure and manage these controls

Compliance with this frameworkĀ ensures the protection of sensitive ePHI.Ā This is why meeting the HITRUST CSF requirements is vital to stay on top of all relevant regulations and standards.

Both SOC 2 and HITRUST reports revolve around the protection of sensitive personal data.Ā One main difference is that SOC 2 is an attestation report, while HITRUST is a certification.

Attestation Report (SOC 2)
An attestation report discusses the confirmation of management that the information in the report is accurate. An independent author will then confirm this report with the help of an opinion. The opinion in the SOC 2 report can be clean, unqualified, qualified, or adverse. Qualified means that the testing cannot confirm that at least one objective has been identified by management. Adverse implies that the testing has failed to verify most of the purposes outlined by management. Even though it may seem it has an asterisk beside it, a qualified report is still reliable. But the company must follow up on it to prove that remediation steps have been undertaken to address any issues raised in the qualified report. SOC 2 reports are completed yearly and may go on from one to three months from completion to report delivery. This depends on how promptly the SOC 2 client can provide documentation and the evidence needed for testing.

Certification Report (HITRUST)
The HITRUST report differs from SOC 2 because it comes with a certification. It has more details peppered in with the reportĀ with five times more controls as it incorporates requirements from numerous standards within the HITRUST CSF. Within the HITRUST report, the organizationā€™s management needs to submit a Letter of Representation instead of the management assertion inscribed within the SOC 2 report. This Letter of Representation is still collected within the SOC 2 report but is not included in the final report. The opinion in the HITRUST Certification letter is presented as a Letter of Certification or Letter of Validation, all dependent on the final score of the conducted assessment. The HITRUST certification has a duration of two years, with interim testing finished within a year.Ā Because of the increased number of controls, it takes more time and significantly greater resources to complete.

Why 911³Ō¹Ļ Chose HITRUST Certification
Given the volume of ePHI 911³Ō¹Ļ stores and processes as part of our daily operations, it was clear that HITRUST certification would best serve our customersā€™ needs, and we made significant investments in infrastructure, processes, and personnel to achieve it. With five times the controls of SOC 2, achieving HITRUST Risk-based, 2-year (r2) Certification assures our clients that we are using the highest security standards to safeguard their sensitive data from ongoing digital threats facing the healthcare and insurance industries.

The post HITRUST vs. SOC 2 – Why 911³Ō¹Ļ Chose HITRUST appeared first on 911³Ō¹Ļ.

We make lives better.
911³Ō¹Ļ takes the pain out of the healthcare experience
for those providing, receiving, and paying for medical care.

Though there was nothing wrong with our previous mission statement, it was a little hard to remember and did not seem to inspire people the way we wanted.

Revising 911³Ō¹Ļ’s original mission statement was an exhaustive process. We considered hundreds of versions and modifications. We wanted to get it right.

I even tried Chat GPT once. I asked for a mission statement about a company that provides the services 911³Ō¹Ļ does and takes the pain out of the healthcare process. It came up with:

“Our mission is to empower patients and simplify healthcare by reducing complexity and eliminating unnecessary pain points in the healthcare process, ensuring accessible, efficient, and compassionate healthcare for all.”

While it’s unlikely I’d ever remember a mission statement that long, for a first pass by an AI computer, I have to say I was impressed.

Still, the challenge persisted. To follow best practices, a company’s mission statement needs to concisely encapsulate its focus and value. For 911³Ō¹Ļ, that meant accomplishing three goals with our new mission statement:

1. Inspire employees and clients alike with a shared sense of purpose.
2. Incorporate the word “better” to align with our tagline, A Better Way.
3. Demonstrate that we “take the pain out of the process” for all stakeholders – employees, payers, providers, and patients.

With these four words – We make lives better – I believe we’ve hit the mark.

The post Updated Mission Statement: “We make lives better” appeared first on 911³Ō¹Ļ.

Certainly, we are always trying to anticipate industry changes and their impact. How will blockchainā€‹ā€‹ā€‹ technology change medical records? How can AI change managed care?ā€‹ Change will and does occur, and we need to constantly be adapting and finding a better way.

Still, some things are universal and timeless. Our customers will always want good value and great service. They will always want an easy user experience. It’s not possible to picture “change” where our clients ask us to not respond as quickly, process referrals and bills slower, and make our systems a little more difficult for them to use.

If you look at Amazon’s original website, it advertised, “One million titles, consistently low prices.” Although the products on Amazon have expanded exponentially, large selection and affordable prices have remained the cornerstone of their business model. What’s changed is how they utilize new technology to deliver timeless value.

It’s important to focus on the things that “never change” to ensure we are doing them as well or better than we ever have before. The overlap of the “change” with the “timeless” is the sweet spot in the Venn diagram of product and business development.

Here is a list from the article of some things people will never stop caring about, with some of 911³Ō¹Ļ’s specialties bolded:

• Better value: Greater savings/Lower prices
• Faster solutions to problems
• Greater control over your time
• More choices
• Added comfort
• Entertainment/curiosity
• Deeper human interactions
• Greater transparency
• Less collateral damage
• Higher social status
• Increased confidence/trustĀ 

We can make big, long-term bets on these things, because there’s no chance people will stop caring about them in the future.

The post Betting on Things That Never Change appeared first on 911³Ō¹Ļ.

The post Driving a Customer-Centric Culture with the Net Promotor Score (NPSĀ®) appeared first on 911³Ō¹Ļ.

To help combat this crisis, organizations such as the Official Disability Institute (ODG) and The American College of Occupational and Environmental Medicine (ACOEM) have released guidelines for prescribers in the appropriate use of opioids for treating pain specific to workplace injuries.

In a published in a recent edition of the Journal of Occupational and Environmental Medicine, researchers at the ReedGroup and Kaiser Permanente retroactively applied ACOEMā€™s April 2017 guidelines to 7,840 patients who underwent carpal tunnel release (CTR) surgery from 2007 to 2014. Of the 70 percent of cases prescribed an opioid, 29 percent were contrary to the guidelines, which recommend no more than a five-day supply of short-acting opioids for acute postoperative pain for new users. Patients given greater dosages averaged disability durations 1.9 days longer and medical costs $422 higher than their ACOEM-compliant counterparts.

While these cases were not exclusively workersā€™ compensation related, given the volume of injured workers who require CTR surgery annually, itā€™s easy to see how following the guidelines could substantially benefit payers and patients. The study estimates if 29 percent of the 577,000 CTR procedures performed annuallyĀ were prescribed an opioid according to ACOEM’s guidelines, the potential medical cost savings is $71 million per year with a reduction in disability durations by 124,000 days. Incredible.

Clinicians at the Center for Surgery and Public Health at Brigham and Womenā€™s Hospital took guideline research a step further by analyzing more than 200,000 postoperative opioid prescribing patterns to define the ideal prescription length by procedure type. Their , published by JAMA Surgery, determined the optimal length of opiate prescription was four to nine days for general surgery procedures, four to 13 days for womenā€™s health procedures, and six to 15 days for musculoskeletal procedures.

While itā€™s too soon to know the time and monetary impact these guidelines could yield if implemented, itā€™s heartening to see that the risk of prescription opioid misuse is being considered when looking to alleviate temporary acute pain. We must all be mindful of what is in the patientā€™s long-term best interests and limiting opioid prescription duration is a critical step in that process.

The post The Road to Optimal Opioid Prescription Length appeared first on 911³Ō¹Ļ.

At Kaiser Permanente, virtual patient encounters now outnumber in-person visits. , his health system saw more than 110 million people last year, with some 59 million connecting through online portals, virtual visits or the health systemā€™s apps. That figure represents more than half of the organizationā€™s total 2016 visits.

ā€œWe are going through a major transformation in healthcare,ā€ said Tyson.

At (NYP), their suite of telemedicine services includes adult and pediatric emergency and urgent care, virtual follow-up visits for surgical and psychiatric patients, and a second opinion program.Ā  Such telehealth adoption has yielded dramatic results. In the ER, for example, low-acuity patients are now seen virtually by an ER physician elsewhere in the health system, reducing average wait times from 2.5 hours to 31 minutes.

Moving forward, NYP aims to make 20 percent of all patient visits virtual, a goal that seems readily attainable given its volume of virtual visits has increased 100 percent every month since it began piloting telehealth services in 2015.

Although telemedicine has yet to significantly impact workers’ compensation or auto, its day is coming. Workplace health clinics, such as the kind operated by , are now augmenting onsite occupational care with telemedicine services. Consider the case of a California factory worker with a blistery hand rash who had her condition treated via a teledermatology visit at her employer-sponsored clinic. Itā€™s only a matter of time before onsite injury assessments, follow-up status calls, and prescription management are conducted virtually, with great cost, comfort and convenience benefits for all parties involved.

The post The Future is Now – Telemedicine in the Marketplace appeared first on 911³Ō¹Ļ.

However, sometimes organizations can get bogged down with too many key performance indicators (KPIs), copious desirable employee traits and overly complex review processes, so itā€™s nice to have a quick, ā€œback-of-the-napkinā€ measure of employee value.

According to businessman Mark Cuban, the secret to career longevity in his billion-dollar empire is the ability to lower his stress level.

In a recent with Money magazine, Cuban shared, ā€˜ā€™Anybody who reduces my stress becomes invaluable to me.Ā  I never want to get rid of them.ā€™ā€

Cubanā€™s approach really resonated with me. Itā€™s a seemingly simple litmus test that easily encapsulates so many desirable workplace traits:

• Reliability
• Accountability
• Resourcefulness
• Team Player
• Skilled Communicator
• Solution-Oriented
• Conflict Resolver

As any manager can attest, leading teams and organizational functions is often stressful. With so many responsibilities to juggle, it makes perfect sense that an employee who minimizes disruption and spares you headaches is an invaluable asset.

So, the next time Iā€™m considering an employee for a promotion, conducting a review or assessing performance coaching opportunities, Iā€™ll be keeping Cubanā€™s insight in mind. Asking myself, ā€œDoes this person reduce my stress?ā€ is a wise way to gauge an employeeā€™s current worth and potential coaching needs.

The post The One Litmus Test for Indispensable Employees appeared first on 911³Ō¹Ļ.

Expertise and experience should be a competitive advantage when it comes to innovation. Yet, the most experiencedĀ people are oftentimes blind to new opportunities.

It’s called the “paradox of expertiseā€‹” ā€“ the more closely a person is immersed in an industry, the more successful theyā€™ve been in a company or a profession, the harder it can be to see new patterns, prospects, and possibilities.

In fact, show “experts” are no better at predicting their industryā€™s future than actuarial tables.

One way to avoid the paradox of expertise is to cultivate new knowledge, drawing inspiration from other industries and collective insights. Leaders who neglect to be learners plateau. The best leaders are almost always insatiable learners.

“” is a question I put to myself daily and one I encourage all leaders, wherever they are in an organization, to ask themselves too.

The post The Paradox of Expertise appeared first on 911³Ō¹Ļ.

Complaining

Complaining in excess of 30 minutes a day damages a personā€™s brain, according to research by Stanford University biology/neurology professor . Whether youā€™re the griper or the listener, persistent exposure to negativity peels back neurons in the hippocampus ā€“ the part of the brain used for problem solving and cognitive function. Over time, complaining becomes habitual, and, if youā€™re surrounded by complainers, youā€™re more likely to become one.

To keep my brain as sharp as possible, I surround myself with positive people. Chronic complainers who consistently give voice to whatā€™s wrong in their lives or who persist in seeing the world from a ā€œglass half emptyā€ perspective drain my energy and I avoid them. I also strive to practice discernment instead of judgement. Discernment is looking at a situation and saying, ā€œI would have handled it differently.ā€ Ā Judgement is saying, ā€œI canā€™t believe the fool did that.ā€ Judgement is draining, discernment is not.

Gossiping

“Gossip creates gall, envy, and torture that disrupt digestion and create mal-stress,” Dr. Kathy Dooley. “This stress exacerbates anxiety, tension headaches, and other pre-existing symptoms associated with stress.” On top of the physical maladies a gossiper themselves can experience, their words can hurt others and disrupt otherwise healthy workplace relationships and environments.

When I witness high school level social interactions in a professional world, gossip usually plays a large part. My customary counsel is never to say anything behind a personā€™s back that you wouldnā€™t say to their face. Of course, in business, there are times when we have to coach up or part ways with an associate and determining the right course of action requires discussing the person without them present. But if you have your coworkers, clients, and the businessā€™ best interests at heart, the odds are any discussions will be devoid of gossip.

Making Excuses

All of us fall short sometimes. But explaining why we failed doesnā€™t negate the fact we did. Nor does prefacing a new project with a big disclaimer so we have a ready excuse when we donā€™t succeed.

ā€œWisdom stems from personal accountability. We all make mistakes; own themā€¦ learn from them. Donā€™t throw away the lesson by blaming others,ā€ advises behavior scientist and author Steve Maraboli.

Setting (specific, measurable, attainable, realistic, time-bound) goals at the outset of any project increases the likelihood of repeated success. And embracing failures when they do occur demonstrates maturity and self-awareness. In my experience, people who succeed more than they fail and who own up to their failures are best suited for leadership roles.

The post 10 Bad Habits to Eliminate from Your Daily Life appeared first on 911³Ō¹Ļ.