SOC 2 Overview
A Service Organization Controls (SOC) 2 audit examines the controls an organization has in place to protect and secure its system, or services used by customers or partners. An organizationā€™s security is assessed based on the requirements within a SOC 2 examination, known as the Trust Services Criteria (TSC). The is the governing body of the SOC framework and they set the U.S. standards that auditors follow for SOC 2 examinations.

The report assesses if a companyā€™s controls are appropriately designed and working under the five TSC. They include:

• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Security is the only TSC that must be met in the SOC 2 report. The other four are optional but are usually added depending on the type of service(s) that an organization offers. This versatility is essential because SOC 2 reports are meant for use across all industries.Ā No matter the nature of the business, the focus is on securing digital information.

There areĀ , Type 1 and Type 2.

• SOC 2 Type 1Ā evaluates an organizationā€™s cybersecurity controls at a single point in time. The goal is to determine whether the internal controls put in place to safeguard customer data are sufficient and designed correctly. Do they fulfill the required TSC? Type 1 audits and reports can be completed in a matter of weeks.
• SOC 2 Type 2 examines how well a service organization’s system and controls perform over a period of time (typically 3-12 months). What is their operating effectiveness? Do they function as intended? Type 2 audits can take 12 months to complete and are costlier than Type 1 audits.

How Does SOC 1 Differ From SOC 2?
SOC 1 Type 2 is an audit 911³Ō¹Ļ undergoes annually. It focuses on financial controls instead of data security. If a company uses a third-party service provider to perform crucial financial reporting processes (e.g., an outsourced payroll management system or a revenue reporting platform), the company will likely ask those service providers for a SOC 1 report. As a bill review provider conducting payment processing services on behalf of clients, 911³Ō¹Ļ frequently provides our SOC 1 report to customers.

Like SOC 2, there are two levels of SOC 1 audits:

• SOC 1 Type 1 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the design of the controls to achieve the related control objectives included in the description, as of a specified date.
• SOC 1 Type 2 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the designĀ and operating effectivenessĀ of the controls to achieve the related control objectives included in the description throughout a specified period.Ā Type 2 audits are much more robust than Type 1. Type 2 audits actually evaluate if a company is doing what it says over a period of time.

HITRUST Overview
Founded in 2007, the, orĀ , is a not-for-profit organization advocating programs that protect sensitive information and manage information risk.

While the HITRUST Common Security Framework (CSF) is designed for all industries,Ģżit is closely associated with the healthcare industryā€™s challenges, such as the numerous applications of controls specific to healthcare (e.g., ). Overall, the HITRUST framework is used as a guide by organizations that deal withĀ or ePHI. TheĀ Ā was a response to the need to have more consistency in certifications. The aim is to have a standard regulation and risk management framework.

HITRUST CSF consolidated the varying requirements from ,Ģż, , , and and checks for the following:

• The presence of clearly defined procedures and policies
• Capability testing to prove its implementation
• Demonstration of a companyā€™s ability to measure and manage these controls

Compliance with this frameworkĀ ensures the protection of sensitive ePHI.Ā This is why meeting the HITRUST CSF requirements is vital to stay on top of all relevant regulations and standards.

Both SOC 2 and HITRUST reports revolve around the protection of sensitive personal data.Ā One main difference is that SOC 2 is an attestation report, while HITRUST is a certification.

Attestation Report (SOC 2)
An attestation report discusses the confirmation of management that the information in the report is accurate. An independent author will then confirm this report with the help of an opinion. The opinion in the SOC 2 report can be clean, unqualified, qualified, or adverse. Qualified means that the testing cannot confirm that at least one objective has been identified by management. Adverse implies that the testing has failed to verify most of the purposes outlined by management. Even though it may seem it has an asterisk beside it, a qualified report is still reliable. But the company must follow up on it to prove that remediation steps have been undertaken to address any issues raised in the qualified report. SOC 2 reports are completed yearly and may go on from one to three months from completion to report delivery. This depends on how promptly the SOC 2 client can provide documentation and the evidence needed for testing.

Certification Report (HITRUST)
The HITRUST report differs from SOC 2 because it comes with a certification. It has more details peppered in with the reportĀ with five times more controls as it incorporates requirements from numerous standards within the HITRUST CSF. Within the HITRUST report, the organizationā€™s management needs to submit a Letter of Representation instead of the management assertion inscribed within the SOC 2 report. This Letter of Representation is still collected within the SOC 2 report but is not included in the final report. The opinion in the HITRUST Certification letter is presented as a Letter of Certification or Letter of Validation, all dependent on the final score of the conducted assessment. The HITRUST certification has a duration of two years, with interim testing finished within a year.Ā Because of the increased number of controls, it takes more time and significantly greater resources to complete.

Why 911³Ō¹Ļ Chose HITRUST Certification
Given the volume of ePHI 911³Ō¹Ļ stores and processes as part of our daily operations, it was clear that HITRUST certification would best serve our customersā€™ needs, and we made significant investments in infrastructure, processes, and personnel to achieve it. With five times the controls of SOC 2, achieving HITRUST Risk-based, 2-year (r2) Certification assures our clients that we are using the highest security standards to safeguard their sensitive data from ongoing digital threats facing the healthcare and insurance industries.

The post HITRUST vs. SOC 2 – Why 911³Ō¹Ļ Chose HITRUST appeared first on 911³Ō¹Ļ.

We make lives better.
911³Ō¹Ļ takes the pain out of the healthcare experience
for those providing, receiving, and paying for medical care.

Though there was nothing wrong with our previous mission statement, it was a little hard to remember and did not seem to inspire people the way we wanted.

Revising 911³Ō¹Ļ’s original mission statement was an exhaustive process. We considered hundreds of versions and modifications. We wanted to get it right.

I even tried Chat GPT once. I asked for a mission statement about a company that provides the services 911³Ō¹Ļ does and takes the pain out of the healthcare process. It came up with:

“Our mission is to empower patients and simplify healthcare by reducing complexity and eliminating unnecessary pain points in the healthcare process, ensuring accessible, efficient, and compassionate healthcare for all.”

While it’s unlikely I’d ever remember a mission statement that long, for a first pass by an AI computer, I have to say I was impressed.

Still, the challenge persisted. To follow best practices, a company’s mission statement needs to concisely encapsulate its focus and value. For 911³Ō¹Ļ, that meant accomplishing three goals with our new mission statement:

1. Inspire employees and clients alike with a shared sense of purpose.
2. Incorporate the word “better” to align with our tagline, A Better Way.
3. Demonstrate that we “take the pain out of the process” for all stakeholders – employees, payers, providers, and patients.

With these four words – We make lives better – I believe we’ve hit the mark.

The post Updated Mission Statement: “We make lives better” appeared first on 911³Ō¹Ļ.

Certainly, we are always trying to anticipate industry changes and their impact. How will blockchainā€‹ā€‹ā€‹ technology change medical records? How can AI change managed care?ā€‹ Change will and does occur, and we need to constantly be adapting and finding a better way.

Still, some things are universal and timeless. Our customers will always want good value and great service. They will always want an easy user experience. It’s not possible to picture “change” where our clients ask us to not respond as quickly, process referrals and bills slower, and make our systems a little more difficult for them to use.

If you look at Amazon’s original website, it advertised, “One million titles, consistently low prices.” Although the products on Amazon have expanded exponentially, large selection and affordable prices have remained the cornerstone of their business model. What’s changed is how they utilize new technology to deliver timeless value.

It’s important to focus on the things that “never change” to ensure we are doing them as well or better than we ever have before. The overlap of the “change” with the “timeless” is the sweet spot in the Venn diagram of product and business development.

Here is a list from the article of some things people will never stop caring about, with some of 911³Ō¹Ļ’s specialties bolded:

• Better value: Greater savings/Lower prices
• Faster solutions to problems
• Greater control over your time
• More choices
• Added comfort
• Entertainment/curiosity
• Deeper human interactions
• Greater transparency
• Less collateral damage
• Higher social status
• Increased confidence/trustĀ 

We can make big, long-term bets on these things, because there’s no chance people will stop caring about them in the future.

The post Betting on Things That Never Change appeared first on 911³Ō¹Ļ.

Numerous studies have shown that using our brain for challenging or stressful tasks drains energy and makes us tired.

This happens for multiple reasons.

Thinking increases glutamate.

A recently published in Current Biology found that participants who spent more than six hours working on a mentally taxing assignment had higher levels of glutamate ā€” an important signaling molecule in the brain. Too much glutamate can disrupt brain function.

The scientists thought the effects of cognitive fatigue could be due to metabolic changes in the brain. They enrolled 40 participants and assigned 24 of them to perform a challenging task. For example, watching letters appear on a computer screen every 1.6 seconds and documenting when one matched a letter that had appeared three letters ago. The other 16 participants were asked to perform a similar, but easier task. Both teams worked for just over six hours, with two 10-minute breaks.

Using a technique called magnetic resonance spectroscopy, the researchers measured glutamate levels in the brain’s lateral prefrontal cortex. The prefrontal cortex is the home of cognitive control ā€” the part of the brain that allows people to suppress their impulses. ā€œIf you get stung by an insect, you want to scratch,ā€ said Antonius Wiehler of the Paris Brain Institute. ā€œIf youā€™re stopping this reflex, that would be cognitive control.ā€ Itā€™s also the system that humans rely on to choose tempting short-term rewards, such as an unhealthy snack, over long-term gains.

The researchers found that by the end of the day, participants who labored on the more difficult task had accumulated more glutamate in this region of the brain than those who had worked on the easier task. And, given a choice between an immediate cash reward and a larger reward that would come months later, they were more likely to choose the smaller, short-term reward than they were at the start of the day.

In addition to increased glutamate, our brains burn a lot of sugar when they are working hard.

Glucose (a form of sugar) is the primary energy source for every cell in the body. Because the brain is so rich in nerve cells, or neurons, it is the most energy-demanding organ, Brain function such as thinking, memory, and learning are closely linked to glucose levels and how efficiently the brain uses this fuel source. For example, if there’s insufficient glucose in the brain, neurotransmitters, the brain’s chemical messengers, are not produced and communication between neurons breaks down. Additionally, hypoglycemia, a common diabetic complication caused by low blood glucose levels, can lead to loss of energy for brain function. It’s also linked to poor attention and cognitive function.

So, there is a biological reason why I crave something sweet every afternoon! Think of all the “fuel” craved when cramming for a test or working late on a project. Our brains are demanding fuel to keep powering through!

Understanding the science behind our behavior can help us make healthier choices. Try to forego junk food and fuel up with healthier sugar sources like fruit instead. Take regular breaks to clear your head. A few minor changes can make a big difference in your energy levels, cognitive function, and overall health.

The post Why Thinking Makes Us Feel Tired appeared first on 911³Ō¹Ļ.

The post Driving a Customer-Centric Culture with the Net Promotor Score (NPSĀ®) appeared first on 911³Ō¹Ļ.

The post Other Factors In Play With Lockdowns – Mental Health appeared first on 911³Ō¹Ļ.

The Cook County Medical Examinerā€™s shows COVID-19 as the primary cause of death for 2,303 people. Of those, more than 2,112 appear to have at least one underlying condition as a secondary cause of death. There were no secondary causes reported for 191 deaths.

Hypertension affected 1,070 victims or more than 46% of all deaths. Diabetes impacted 973 victims or 42% of the death total. Pulmonary disease was part of 397 deaths or 17%. And 215 of those deaths, about 9%, were accompanied by obesity or morbid obesity. Others had conditions including cancer, cardiovascular disease, or kidney disease. The numbers in the table above equal more than 100% because many victims had more than one preexisting condition.

The Cook County data aligns with Ā on comorbidity volume. Though the City’s data does not provide the same level of comorbidity detail, it does report that 1,090 of Chicagoā€™s 1,160 COVID-19 victims had underlying conditions. Thatā€™s 94%.

As of May 8, the average age of all COVID-19 deaths in Illinois was 74, while the median age of the state’s population is old.Ā  Almost 50% of all Illinois deaths have Ā long-term care facilities ().

Whatā€™s remarkable about the Cook County comorbidity data is just how few young adults have died from COVID-19 in the absence of a preexisting condition. Nobody under 20 has died without one. Only three deaths in the 20-29 age bracket were without a documented comorbidity. And in the 30-39 and 40-49 age brackets, just 26 deaths had no defined underlying causes. Such statistics suggest the odds are slight of anyone young and healthy dying from this disease.

When those numbers are compared against each age bracket’s population percentage, those at risk (and who have very low risk) become more even more clearly defined.

Illinois residents over the age of 70 account for 8.5% of the state’s population and 63.8% of the deaths. Those under 40-years old account for 54.5% of the population and just 2.2% of the deaths. Put another way, a person over 80 is 706,740% more at risk of dying from COVID-19 than a person under 20.

Understanding who is most at risk (and who is not) is paramount to combating the virus. What Cook County and other comorbidity data across the country indicates is that the risk of death for young and healthy people is considerably lower than people may have originally thought or continue to believe. There are pockets of people (elderly, those with high risk comorbidities) and specific environments (nursing homes, hospitals, jails, congested workplaces like meat processing plants, etc.) warranting stringent infectious disease precautions and concentrated efforts to control the virus’s damage. The young and healthy should take precautions too (proper hand hygiene, immunity-boosting supplements), but there is lower risk to them going about their normal lives.

Stay safe, stay strong!

The post 9+ Out of 10 Chicago & Cook County COVID-19 Victims Had Preexisting Conditions appeared first on 911³Ō¹Ļ.

I previously mentioned the potential of vitamin D to boost immune system defenses against COVID-19. Two recent studies have between severe vitamin D deficiency and complications and/or mortality rates of COVID-19 patients.

The first – published in – found that COVID-19 infections and deaths were greater in countries where people had low vitamin D levels, such as Italy and Spain, compared to northern European countries where average vitamin D levels were higher. British researchers attributed the vitamin D differences to some southern Europeans having darker pigmentation, which reduces vitamin D synthesis, and northern Europeans consuming more cod liver oil and vitamin D supplements.

The appeared in the online journal . Though not yet peer-reviewed, the study’s conclusion was the same: Low vitamin D levels were linked to a hyperactive immune system.

By analyzing publicly available patient data from around the globe, lead researcher and biomedical engineer and his team at Northwestern University discovered a significant correlation between vitamin D levels and cytokine storm ā€” a hyperinflammatory condition caused by an overactive immune system ā€” as well as a correlation between vitamin D deficiency and mortality.

can severely damage lungs and lead to acute respiratory distress syndrome and death in patients,ā€ said Ali Daneshkhah, a postdoctoral research associate in Beckman’s lab and the paper’s first author. ā€œThis is what seems to kill a majority of COVID-19 patients, not the destruction of the lungs by the virus itself. It is the complications from the misdirected fire from the immune system.ā€

As vitamin D enhances people’s innate immune systems as well as prevents them from becoming dangerously overactive, Backman and his team’s findings indicate that having healthy levels of vitamin D could protect patients against severe complications, including death, from COVID-19.

ā€œOur analysis shows that it might be as high as cutting the mortality rate in half,ā€ Backman said. ā€œIt will not prevent a patient from contracting the virus, but it may reduce complications and prevent death in those who are infected.ā€

Clinical trials to see if vitamin D can help infected patients are now underway. Meanwhile, I continue to be a proponent of taking vitamin D, vitamin C, and zinc supplements to protect your health should you contract COVID-19. Being healthy in general is the best thing you can do to protect your immune system.

The post Vitamin D Deficiency Increases Risk of COVID-19 Complications appeared first on 911³Ō¹Ļ.

H3N2 (or the “Hong Kong flu,” as it was more popularly known) occurred between 1968-1970. It arrived in the United States from Hong Kong in , peaking in mid-December through January 1969. It ultimately killed 100,000 people in the U.S., mostly over the age of 65, and one million worldwide.

At that time, the U.S. lifespan was today. The population was much smaller, 200 million as compared to 328 million. Adjusting for population and demographics, it’s probable the pandemic of five decades ago would result in a quarter million deaths today, making it as lethal as COVID-19.

But while the outbreak is shockingly similar in scale, the way society handled it couldn’t be . Stock markets didn’t plummet. Congress passed no legislation. The Federal Reserve didn’t cut interest rates. Not a single governor acted to enforce social distancing, curve flattening (even though hundreds of thousands of people were hospitalized), or crowd banning. No daycares shuttered despite there being more infant deaths from H3N2 than there have been from COVID-19. No for violating stay-at-home orders. Unemployment didn’t skyrocket. There was no worry of or . Despite a New York Times editorial describing the pandemic as “one of the worst in the nation’s history,” only 23 schools and colleges closed, businesses remained open, and Woodstock was still held (although it took place between the first and second waves of the pandemic). Going about daily life in the face of the disease was a deliberate choice.

So what changed between 1968 and now? Dr. Deborah Birx cited fatality estimates from a Imperial College London for the federal government’s drastic restrictions, a model for its veracity. Some theorize there were partisan elements to the government mandated shelter-in-place orders, with political parties using them to achieve objectives unrelated to public health. Certainly, the Vietnam War received far greater media coverage than the virus in a much less invasive way. Today, with a relentless 24-hour news cycle, stories of COVID-19 can dominate.Ā 

I don’t know the answer. But as a urges, I do think there’s value in revisiting the nation’s response to the Hong Kong flu pandemic. Much like the world repeatedly learned and lost the , it seems like the country needs to rediscover how it treated past disease-born hardships so it can make the most well-informed decisions regarding future pandemic measures. As a healthcare leader, I believe I have a duty to bring that knowledge to light.Ā 

Stay safe, stay strong!

The post Pandemic Response: 1968 vs. Now appeared first on 911³Ō¹Ļ.

The post Sweden Capital – Close to Herd Immunity appeared first on 911³Ō¹Ļ.