Lance's Corner

DFS Issues Cybersecurity Update

Nov 4, 2024

Per the notice below, the New York State Department of Financial Services (DFS) has issued an update on its cybersecurity regulations.  While dental practices are not under DFS jurisdiction with respect to DFS cybersecurity regulations, it is interesting to note the direction that DFS is moving with respect to the entities it does regulate on cybersecurity.

Cybersecurity Regulation Updates and Reminders 

November 2024
On November 1, 2023, the Department of Financial Services (DFS) issued its amended Cybersecurity Regulation.  To assist entities of all sizes throughout the rollout of the regulation, DFS is providing regular updates on important information and helpful resources.  Here is what you need to know in November 2024: 
  • New Cybersecurity Regulation Requirements Now in Effect
  • ICYMI: AI Cybersecurity Guidance
  • Introducing Cybersecurity Refresher Video Series

New Cybersecurity Regulation Requirements Now in Effect

On November 1, 2024, the next set of requirements under the Cybersecurity Regulation took effect.  Below, see requirements that now must be implemented, tailored by the type of regulated entity and exemption status.  The "Am I Exempt" flowchart is designed to help businesses determine their exemption type.  New requirements impacting Class A and Standard companies:

  1. Cybersecurity Governance: CISOs must include plans for remediating material inadequacies, among other information, in written reports to senior governing bodies at least annually.  In addition, CISOs are now required to timely report to senior governing bodies or senior officers on material cybersecurity issues, such as significant cybersecurity events and changes to the cybersecurity program.  Entities’ senior governing bodies are required to exercise oversight of cybersecurity risk management.  (Section 500.4)
  2. Encryption of Nonpublic Information (NPI): Entities are now required to implement a written policy requiring encryption that meets industry standards.  Entities may no longer use effective alternative compensating controls for encryption of NPI in transit over external networks; however, entities may use effective alternative compensating controls for encryption of NPI at rest provided that the compensating controls are reviewed and approved in writing by the CISO at least annually.  (Section 500.15)
  3. Incident Response and Business Continuity Management: Incident Response (IR) plans continue to be required, but they must be updated to address additional criteria and tested at least annually.  Business Continuity and Disaster Response (BCDR) plans that are reasonably designed to address a cybersecurity-related disruption as specified must also be in place.  Covered entities must train all employees involved in the plans’ implementations, test plans with critical staff, and revise plans as necessary; test the ability to restore critical data and information systems from backups; and maintain and adequately protect backups necessary to restore material operations.  (Section 500.16)

Small businesses with partial exemptions also have new requirements.  All covered entities except those that qualify for full exemptions and those that qualify for partial exemptions under 500.19(c) or 500.19(d) must now have the following implemented:

  1. Multi-Factor Authentication (MFA): Covered entities that have not already done so are required to implement MFA for any remote access to their information systems, remote access to third-party applications where NPI is accessible (including cloud applications), and to privileged accounts.  (Section 500.12(a))
  2. Cybersecurity Training: At least annually, entities must provide cybersecurity awareness training to all personnel that covers social engineering, such as phishing, business e-mail compromises, and techniques enhanced by AI, like deepfakes.  (Section 500.14(a)(3))

Learn more about the November 2024 requirements: Class A Entities | Standard Entities | Exempt and Partially Exempt Entities

ICYMI: AI Cybersecurity Guidance

During Cybersecurity Awareness Month, DFS issued new guidance to help New York’s financial services sector identify and assess cybersecurity risks arising from AI.  The guidance outlines specific cybersecurity risks associated with the use of AI, how to use the framework of the DFS Cybersecurity Regulation to combat and mitigate those risks, and the substantial cybersecurity benefits that can be gained when organizations integrate AI into their cybersecurity program.  This guidance does not impose new requirements.  Rather, it helps DFS-regulated institutions to understand their existing obligations to assess and address and the evolving risks arising from AI.  Read the guidance on the DFS website.

Introducing Cybersecurity Refresher Video Series 

The Department is rolling out a series of video refreshers to help entities better understand the Cybersecurity Regulation and its requirements.  The first videos help small businesses that qualify for partial exemptions by detailing the November 2024 requirements.
MFA video

Watch:  Multi-Factor Authentication | Cybersecurity Awareness Training

Contact Us

ICYMI: Reminders from DFS

Last week, the following advisory was sent to CISOs at DFS-regulated entities: Cybersecurity Advisory – Threats Posed by Remote Technology Workers with Ties to Democratic People’s Republic of Korea.  To get regular cybersecurity updates delivered to your inbox, subscribe to Cybersecurity Updates.  For additional questions related to the Cybersecurity Regulation, e-mail DFS’s Cybersecurity team at: cyberregsupport@dfs.ny.gov.  Visit the Cybersecurity Resource Center for all of DFS’s cybersecurity tools and guidance.

USDOL Issues Comprehensive Employer Guidance on Long COVID

The United States Department of Labor (USDOL) has issued a comprehensive set of resources that can be accessed below for employers on dealing with Long COVID.

Supporting Employees with Long COVID: A Guide for Employers

The “Supporting Employees with Long COVID” guide from the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) and Job Accommodation Network (JAN) addresses the basics of Long COVID, including its intersection with mental health, and common workplace supports for different symptoms.  It also explores employers’ responsibilities to provide reasonable accommodations and answers frequently asked questions about Long COVID and employment, including inquiries related to telework and leave.

Download the guide

Accommodation and Compliance: Long COVID

The Long COVID Accommodation and Compliance webpage from the USDOL-funded Job Accommodation Network (JAN) helps employers and employees understand strategies for supporting workers with Long COVID.  Topics include Long COVID in the context of disability under the Americans with Disabilities Act (ADA), specific accommodation ideas based on limitations or work-related functions, common situations and solutions, and questions to consider when identifying effective accommodations for employees with Long COVID.  Find this and other Long COVID resources from JAN, below:

Long COVID, Disability and Underserved Communities: Recommendations for Employers

The research-to-practice brief “Long COVID, Disability and Underserved Communities” synthesizes an extensive review of documents, literature and data sources, conducted by the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) on the impact of Long COVID on employment, with a focus on demographic differences.  It also outlines recommended actions organizations can take to create a supportive and inclusive workplace culture for people with Long COVID, especially those with disabilities who belong to other historically underserved groups.

Read the brief

Long COVID and Disability Accommodations in the Workplace

The policy brief “Long COVID and Disability Accommodations in the Workplace” explores Long COVID’s impact on the workforce and provides examples of policy actions different states are taking to help affected people remain at work or return when ready.  It was developed by the National Conference of State Legislatures (NCSL) as part of its involvement in USDOL’s State Exchange on Employment and Disability (SEED) initiative.

Download the policy brief

Understanding and Addressing the Workplace Challenges Related to Long COVID

The report “Understanding and Addressing the Workplace Challenges Related to Long COVID” summarizes key themes and takeaways from an ePolicyWorks national online dialogue through which members of the public were invited to share their experiences and insights regarding workplace challenges posed by Long COVID.  The dialogue took place during summer 2022 and was hosted by USDOL and its agencies in collaboration with the Centers for Disease Control and Prevention and the U.S. Surgeon General.

Download the report

Working with Long COVID

The USDOL-published “Working with Long COVID” fact sheet shares strategies for supporting workers with Long COVID, including accommodations for common symptoms and resources for further guidance and assistance with specific situations.

Download the fact sheet

COVID-19: Long-Term Symptoms

This USDOL motion graphic informs workers with Long COVID that they may be entitled to temporary or long-term supports to help them stay on the job or return to work when ready, and shares where they can find related assistance.

Watch the motion graphic

A Personal Story of Long COVID and Disability Disclosure

In the podcast “A Personal Story of Long COVID and Disability Disclosure,” Pam Bingham, senior program manager for Intuit’s Diversity, Equity and Inclusion in Tech team, shares her personal experience of navigating Long COVID symptoms at work.  The segment was produced by the USDOL-funded Partnership on Employment and Accessible Technology (PEAT) as part of its ongoing “Future of Work” podcast series.

Listen to the podcast

HHS OIG Issues Annual Report on State MFCUs

Per the notice below, the Office of the Inspector General (OIG) of the United States Department of Health and Human Services (HHS) has issued its annual report on the performance of state Medicaid Fraud Control Units (MFCUs).

Medicaid Fraud Control Units Fiscal Year 2023 Annual Report (OEI-09-24-00200) 

Medicaid Fraud Control Units (MFCUs) investigate and prosecute Medicaid provider fraud and patient abuse or neglect. OIG is the Federal agency that oversees and annually approves federal funding for MFCUs through a recertification process. This new report analyzed the statistical data on annual case outcomes—such as convictions, civil settlements and judgments, and recoveries—that the 53 MFCUs submitted for Fiscal Year 2023.  New York data is as follows:

Outcomes

  • Investigations1 - 556
  • Indicted/Charged - 9
  • Convictions - 8
  • Civil Settlements/Judgments - 28
  • Recoveries2 - $73,204,518

Resources

  • MFCU Expenditures3 - $55,964,293
  • Staff on Board4 - 257

1Investigations are defined as the total number of open investigations at the end of the fiscal year.

2Recoveries are defined as the amount of money that defendants are required to pay as a result of a settlement, judgment, or prefiling settlement in criminal and civil cases and may not reflect actual collections.  Recoveries may involve cases that include participation by other Federal and State agencies.

3MFCU and Medicaid Expenditures include both State and Federal expenditures.

4Staff on Board is defined as the total number of staff employed by the Unit at the end of the fiscal year.

Read the Full Report

View the Statistical Chart

Engage with the Interactive Map

GAO Issues Report on Medicaid Managed Care Service Denials and Appeal Outcomes

The United States Government Accountability Office (GAO) has issued a report on federal use of state data on Medicaid managed care service denials and appeal outcomes.  GAO found that federal oversight is limited because it doesn't require states to report on Medicaid managed care service denials or appeal outcomes and there has not been much progress on plans to analyze and make the data publicly available.  To read the GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the first link below.  To read GAO highlights of the report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the second link below.
https://www.gao.gov/assets/d24106627.pdf  (GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes)
https://www.gao.gov/assets/d24106627_high.pdf  (GAO highlights on federal use of state data on Medicaid managed care service denials and appeal outcomes)

CMS Issues Latest Medicare Regulatory Activities Update

The Centers for Medicare and Medicaid Services (CMS) has issued its latest update on its regulatory activities in the Medicare program.  While dentistry is only minimally connected to the Medicare program, Medicare drives the majority of health care policies and insurance reimbursement policies throughout the country.  Therefore, it always pays to keep a close eye on what CMS is doing in Medicare.  To read the latest CMS update on its regulatory activities in Medicare, use the link below.
https://www.cms.gov/training-education/medicare-learning-network/newsletter/2024-03-14-mlnc