Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
carlcarlson
Jun 20, 2008
What type of report are you running? I can't see from your screenshot, so it looks like maybe you're not running a contact report. Contact report should only return contacts, not individual actions, so there shouldn't be any duplicates (assuming you don't already have duplicate contacts).

Adbot
ADBOT LOVES YOU

carlcarlson
Jun 20, 2008
We couldn't implement IM at my old place because we couldn't get people to stop saying dumb poo poo in emails, that would then get turned over in a lawsuit. God only knows how e-discovery would have worked with chat logs. I imagine we'd have to turn over the entire chat log between employees, which would inevitably include them talking about wanting to see the new girls tits or whatever other terrible poo poo that was worse than what they already said in email.

carlcarlson
Jun 20, 2008
I was at an MSP during the pandemic, and we had a lot of customers ask for this type of software as everyone shifted to remote work. We weren't partners and didn't resell any, but Teramind was our go-to recommendation. Although once customers realized how expensive this software was, they always backed off, so I don't actually have any experience deploying/managing it. https://www.teramind.co/product/price

At my place before that, we did have a couple of these, but they were on-prem based deployments that would only work if the PCs had access to the internal network, which in 2022 I can't imagine is a viable option.

It did help me get an rear end in a top hat fired when his google search history consisted of different variations of "how to permanently delete email from Outloook" (don't worry, all email was being archived at the mx level).

carlcarlson
Jun 20, 2008
uhh, anything more specific than that? HIPAA compliance covers a very wide range depending on how an entity is covered. HIPAA compliance focuses on three types of controls: physical, administrative, and technical, but there is an almost infinite amount of nuance beyond that.

In my experience, a lot of smaller orgs will argue that they aren't HIPAA covered entities and aren't required to be HIPAA compliant (lol). Or that their IT department is responsible for compliance, and completely ignore physical and administrative controls.

https://www.hhs.gov/hipaa/index.html is not terribly helpful, but is the "official" source of HIPAA.

In short, your clients will not find any of this easy to understand, which is why they should pay an expert to handle it for them. A lot of the technical controls around HIPAA are not inexpensive, specifically around SOC/SIEM, encryption, auditing, IR/DR planning, backup/recovery + testing, etc, which in my experience is why a lot of business will simply put their head in the sand and pretend it doesn't exist.

edit: at my last MSP gig we had clients pay for a sub to HIPAA Secure Now, and charged them for us to walk through this with them, https://www.hipaasecurenow.com/
this was just the first step though, as this is really identifying the gaps in their compliance, from here you build out your plan of action and then put together projects going forward (clients also resisted this part, as they would hope just putting together policies/procedures would make them compliant). In some cases there was a real distrust that they were charging us to discover what else we needed to charge them for.

carlcarlson fucked around with this message at 16:35 on Jun 1, 2022

carlcarlson
Jun 20, 2008
AFAIK, the only "certificate" that "proves" HIPAA compliance is HITRUST certification, and if they aren't interested in paying for HIPAA compliance, lol at getting them to go through the HITRUST certification process.

At a broader level, HIPAA focuses on securing PHI and being able to provide care in the event you experience some kind of disaster. Did your servers get ransomed and now patients are dying because you can't treat them? Or are you a business that only tangentially has PHI? How a business is a HIPAA covered entity is probably the most important aspect of determining what to focus on for their HIPAA compliance.

HIPAA is written very generically, and does not focus on specific technologies, but a main focus is protecting PHI. So things like, named users (people are not allowed to share any credentials that could get them access to PHI), encryption at rest and in transit, MFA for anything that gets access to PHI (email, vpn, desktop, 3rd party apps, etc), and logging so that you can prove that your PHI was not accessed by someone that should not have had access.

If your work with these companies focuses exclusively on the technology of their business, and not the other HIPAA controls, that's what I would try to focus on. I would always try to get companies to work through where their PHI was, and plausible scenarios that could lead to a breach and therefore mandatory breach reporting, https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

It only takes a breach of 500 records with PHI to qualify for mandatory reporting, and what is considered PHI is extraordinarily broad. Like if you were oncologists and a list of 500 patient names were left on a copier and the cleaning crew walked off with the print out, that could be considered a breach.

carlcarlson
Jun 20, 2008
For an all-in-one, fully hosted solution, RingCentral was pretty great for ~300 users over multiple locations, although this was pre-Covid. Not sure how well this would work for users logging in/out of handsets on their own. I'm also not sure about voicemail transcription.

At my MSP gig we resold Zultys systems, which is a low-cost option but pretty good for users that need a "phone system". It also allows you to bring your own SIP, which can be beneficial if you are multinational and need to be able to make "local" phone calls from different countries, or you want to be able to mange DIDs and dialtones on your own without being tied to your system provider. They also offer an on-prem box that can handle ethernet handoff, T1, and traditional copper. As well as offering a virtual machine image, and a fully hosted cloud option. The system itself is compatible with pretty much any SIP capable handset, so it was easy to mix/match with existing hardware to help lower the upfront cost of a system migration.

Adbot
ADBOT LOVES YOU

carlcarlson
Jun 20, 2008

nvrgrls posted:

Yeah I used to see ringcentral all the time. Do they still resell Zoom for their video conf solution?
Cursory internet searching says that RingCentral built their own video conferencing app, which you can subscribe to separately.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply