Dear Healthcare Professional,
Welcome to the September/October issue of the Indidge Advantage newsletter. From the enthusiastic response we received from our previous newsletter and the breadth of interesting topics, we decided to become a monthly newsletter starting in November. Enjoy!
The Indidge Advantage is produced by Indidge Systems a healthcare software development company specializing in Compliance and Risk Management solutions.
We especially want to thank those of you who stopped by our booth at the National Association for Healthcare Quality in Phoenix and at the American Society for Healthcare Risk Management in Boston to say hello, pick up a rose and enjoy some popcorn.
Learn from Experts
By Christina Torode, Senior News Writer
02 Apr 2007 | SearchWinIT.com
This is the fourth of a four-part series on compliance.
Successful audits require that IT managers and compliance auditors speak the same language. Clearly written policies are one way to bridge the gap.
Joe Fleming, IT manager at Blue Cross Blue Shield in Helena, Mont., realized just how important written policies are after his first mock-audit when his organization desperately needed an electronic signature-based system to automate the process.
The never-ending paper trail created by compliance checks and balances had his IT staff running from department to department for the signatures of those in charge of delegating who gets access to what systems at Blue Cross Blue Shield in Helena, Mont.
"After the pseudo-audit, it wasn't any major changes we had to make, it was a lot of user ID changes caused by regular turn over in the company," Fleming said. "We had to make sure that the user IDs that were set up matched what the paper work said and that no one was taking any short cuts filling out the paperwork."
Fleming estimates that his staff spent hundreds of hours trying to get the auditing staff to clarify what exactly they were looking for.
Disconnect more common in regulatory compliance
Disconnects such as this are becoming fairly commonplace as more regulatory compliance initiatives move beyond high-level strategic discussions and perimeter security measures to the tactical IT trenches.
Take, for example, the case of an auditor asking a large company to encrypt a back-end database that contained customer information. Only three people had access to the back end, but the database had a Web front-end that gave more than 2,000 employees access to the data.
"The auditor made the wrong recommendation," said Paul Proctor, an analyst with Stamford, Conn.-based research group Gartner. "They wanted the company to spend $2 million protecting the back-end and overlooked the dangers on the front-end. "This is why IT has to get involved in the conversation to talk about what controls are really needed and to prevent stupid spending."
Reporting is another pitfall of unnecessary audit requests.
"With the mainframe [the auditors] wanted to know who had access to which data sets, which is data that can be pulled up in a lot of different ways," Fleming said. "We wanted them to give us the specific commands they wanted us to run, otherwise the data sets they were asking for would generate hundreds and hundreds of pages."
Steve Schlarman, chief compliance strategist at compliance management software maker Brabeion Software in McLean, Va., and former auditor with PricewaterhouseCoopers' security and auditing practice said he has seen discussion between auditors and IT staffs get lost in translation on many occasions.
Auditor speaks different language
"The language is just different," Schlarman said. "An auditor will ask to see a company's user registration policy and the IT administrator will say 'Huh?'. When the auditor should be asking 'What happens when you hire a new person', to determine how an organization is controlling user access. If IT thinks in terms of process, policy and control diagrams they will have a little more insight into the mind of an auditor."
And he's seen communication backfires coming down from the corporate level in the form of bible like corporate governance books on compliance.
"A Windows admin is going to look at that big book on proper controls and procedures and either ask a lot of questions, or interpret it the way he sees it," Schlarman said. "They need a set of standard builds, configurations specific to that box, or IT will spend a lot of time trying to interpret that high-level document and interpretation is where you get into trouble."
That is not to say that all auditors are less than tech-savvy. It's becoming juts the opposite with more compliance auditors taking IT classes at places like the SANS Institute and The Information System Audit and Control Association.
New breed of IT-smart auditors
"It's not just the auditors of old that you think of, the guy that knows how to look at the balance sheet and cash flow, but ones that know about IT and are being very specific as to what they want IT professionals to do, particularly with regulations like [the Payment Card Industry data security standard]," said Alex Bakman, founder of compliance reporting software vendor Ecora in Portsmouth, N.H.
Over at the Academic Enterprise Systems division of the University of Kansas, David Barnhill, senior system specialist, is more worried about how to word email auditing policies, versus having to deal with an actual auditor.
Eventually the university is going to get hit with an audit, whether it be through healthcare regulatory standard HIPAA as it relates to its toxicology and pharmacology research departments, or privacy laws related to students IDs, grades and health records.
The problem isn't so much what technology to put in place, but what and who should determine if an email violates a given regulation and what to do with it if it does, Barnhill said.
"Technology isn't the issue, we have a Sophos system that we can turn on tomorrow that can flag outbound emails just as easily as it does with inbound emails, Barnhill said. "What we don't have is policies. Who decides when something is a violation? If it's seen as a violation do we bounce it back to the user, or a person on staff who makes a final decision? Do we counsel the user? Should we have a program to teach people what not to send in an email?"
Barnhill also fears the backlash from university staff and students if a system is put in place that monitors the content of their emails. "I think it could be a huge political problem if we're looking at their emails, even if it's a less intrusive automated process," he said.
http://searchwinit.techtarget.com/news/article/0,289142,sid1_
gci1249792,00.html
Core Values
By Tom Reid, Director of Sales at Indidge Systems
There are two guiding principles that we adhere to at Indidge Systems that directs our selling team and we believe form the foundation of our success.
First, we believe that success is built on relationships.
Here are our seven Bs of relationship Building:
- Be real. We are each unique individuals. Be who you are. There is not another person like you. Don't try to impress others by trying to be somebody else. The prerequisite for relationship building is trust. At its most basic level, trust is built on believing that people are who they represent themselves to be.
- Be interested (not just interesting). It may be true that interesting people attract attention, but I believe that interested people attract attention. People are flattered when you express an interest in getting to know them better, not out of morbid curiosity, but in an effort to help or serve them more effectively. Appreciating the people we serve increases the value of our service to them.
- Be a better listener. When you take an interest in and listen to people, they provide important practical information you can use to create value. People are flattered when you make an effort to get to know them and seek information on how to serve them better. Understanding and appreciating what they want increases the value of what you can provide for them.
- Be empathic. If you are interested in others and make the effort to truly know them by listening to them, you'll better understand how they feel. This is empathy. The need to be understood is one of the highest human needs, but too often people who know us either don't care or don't make the effort to understand how we really feel. Two thousand years ago a wise man named Philo Judaeus said, "Be kind. Everyone you meet is fighting a tough battle." His counsel is the essence of practical empathy.
- Be honest. I summarize all business strategy with this simple idea: Say what you'll do, and do what you say. Don't create expectations you can't fulfill. Be a man, woman, or organization of your word. That's integrity.
- Be helpful. Little things make a big difference. Lots of small things cumulatively make a huge difference. Remember your manners and people will remember you.
- Be prompt. Time is the one thing many people have far less of than money. Helping them save time by being prompt and efficient is a gift of great value.
It doesn't take much extra time or effort to be interested and demonstrate the value we have for others, especially those on whom we depend for mutual success. And that is the essence of building relationships, whether business or personal.
Remember that the quality of a relationship is related directly to the amount of time invested in it. We want to make sure we are giving some of our best time to our relationships.
Secondly, we believe that we must continually create value for others. Every day we interact with dozens of people. Often those interactions are fleeting and unmemorable. However, those that are committed to making a difference don't use people as a means to an end; they use relationships to build a foundation for success. They understand that all outcomes are created by and through interactions with others. They understand that b relationships create loyalty and are the basis of partnerships and teamwork.
At Indidge Systems we continually strive to create value for others. To compete successfully we attempt to offer better ideas, products, and services than our competitors. Our objective is to do more than talk about "value-added"; we want to deliver on it.
We want to create extra value by doing more than is necessary and exceeding your expectations - most of the time for no extra pay. We are a "for profit" company and that may not always be possible, but it is the goal.
I once worked with a hospital that was committed to improving patient relations. One little idea made a big difference: Whenever patients or visitors asked for directions, rather than simply telling them how to get where they wanted to go, the staff member personally escorted them, especially in cases where people were confused or perplexed. Anyone who has to go to a hospital, whether as a patient or a visitor, is bound to be somewhat bewildered. Having a personal escort relieves people of extra stress they don't need. The hospital staff provided extra value by relieving a burden.
Here is how we believe we can add value to others:
- Tell the truth. Truth telling should be a basic rather than a value-added opportunity. A philosopher once commented that if honesty did not exist, someone would invent it as the best way of getting rich. Ironically, truth is often so scarce today that we assign an even higher value to it than we did in the past.
- Practice personality power. Create an extraordinary conclusion to an unexceptional experience by using the power of your individual personality. Your personality is unique. Allow it to give others a glimpse of the light that is within.
- Attract through artistry. We are drawn to attractiveness not only in people but in goods, services, architecture, and all avenues of design. We increase the value of things when we make them aesthetically pleasing.
- Meet needs in advance. This is the power of anticipation. Here is an example. If you know that your next door neighbors are going on vacation next week, why not offer to pick up their mail or water their plants why they are gone? Often people forget about the details that need to be taken care of until the very last minute. Anticipating how we can be of service while your neighbors are gone is a magnanimous gesture that will create value. We strive to anticipate and meet your needs.
- Add "good stuff." I summarize all business strategy with this simple idea: Say what you'll do, and do what you say. Don't create expectations you can't fulfill. Be a man, woman, or organization of your word. That's integrity.
- • Enjoyment: What can we do to add a little enjoyment to someone's day? It can be something as simple as telling a good joke or giving someone a piece of candy. There is power in adding a little good stuff, like enjoyment. We understand the serious side of business, but that doesn't mean we can't enjoy our work and bring some of that joy to you.
- • Enthusiasm: Enthusiasm is a blend of positive emotion and energy. Enthusiasm makes ordinary events, processes, services, or interactions extraordinary. We are an enthusiastic company.
- • Humor: Laughter is good medicine for the soul. What product or service couldn't benefit from a spoonful of soul medicine? We try not to take ourselves too seriously.
- Subtract "bad stuff." What annoys you the most when it comes to dealing with people or vendors? Wouldn't it be great if others were vigilant enough to notice what those irritants are and, to the degree they could, reduce or eliminate them for you? Here are a few things that we consider the worst of the "bad stuff" that we strive to eliminate:
- • Waiting: Who likes to wait? Don't you love prompt people? Don't you appreciate it when your appointment starts and ends on time. We appreciate your time and will do our best not to keep you waiting.
- • Defects: It's true that nothing is perfect. But when you pay for something to be correct, it is maddening to experience a flaw. We are not perfect at Indidge Systems but one of our objectives is to be excellent...always. We strive to make our products and services error free.
- • Mistakes: If defects happen to things, mistakes happen to processes. What a drag when someone else makes a mistake, but you have to pay for the consequences. Our people will solve a problem for you even if they did not create it. It's no compliment to be a problem spotter, but the world loves problem solvers. Our people take responsibility for solving problems and mistakes even if they didn't initially create them.
- • Irritation and frustration: Irritation and frustration comes in many forms. The bottom line is that our people work hard to minimize irritation and frustration for others and to maximize positive feelings.
- • Misinformation: We make every effort to subtract as much of this stuff as we can. If we don't know the answer to a question we will say so. We will be honest when we don't know the answer to a question and will do everything in our power to find the right answer as quickly as possible.
- Simplify. We want to make it easy for you to get what you need from us. We try to eliminate red tape and mind-numbing bureaucracy. We want to be of service to you and we will use all our knowledge and expertise to help you understand what appears to be a complex and overwhelming problem or situation.
- Improve. To improve means "to make better, to multiply existing value." Daily we do what we have always done, but each day we want to do it better than we have ever done. We believe that if we remain committed to excellence you will notice. In 1869 H. J. Heinz coined a phrase that is our goal every day: "To do the common thing uncommonly well." We are always looking for ways to improve the quality of our work and our interactions with you.
We are committed to building relationships with our clients. We believe that improves our business relationships and makes us better fit to take care of our customer's needs.
We are committed to adding value on the front end as opposed to being reactive and pretending to add something to the relationship only after you purchase from us. Our objective is to offer better ideas, better solutions, and better service.
Those are the cornerstones on which we build sales success at Indidge Systems. How can we help you today?