www.riskandsecurityllc.com

Doctor Shot and Killed in Grudge Shooting Over “Mom”

Posted on January 25, 2015 9:53 am by Caroline Ramsey-Hamilton Comment

RISKAlert- Active Shooter No. 625, January 21, 2015, Boston, Mass.

Middle-Aged Shooter kills Cardiologist at Brigham and Women’s Hospital, and then Kills
Himself, in an apparent Grudge Shooting Because the Doctor had Operated on his Mother.

On Tuesday morning on Jan. 21, at 11 am, Stephen Pasceri, 55, walked into the Shapiro Center
at Brigham and Women’s Hospital, and asked to see cardiologist, Dr. Michael J. Davidson. When
he saw Dr. Davidson, outside of an exam, he shot him twice, critically injuring him.

Dr. Davidson later died from his injuries. Pasceri then went to the 2^nd floor and killed himself with a gunshot
to the head. Later, it was discovered that Dr. Davidson had operated on Pasceri’s mother, Marguerite, and
she had died on November 15, 2014. Pasceri’s sister was quoted as saying, “He loved his mom, and he
loved her very much. He appeared to be handling her death well,” the sister said of her brother.

“Everything seemed to be going really well. I have no idea why he snapped like this.
He was a great guy. He took care of his family, he had a beautiful house and he has four
beautiful children. He was an upstanding citizen.”

The hospital locked down and rushed Dr. Davidson into surgery, but he died during the night from his injuries.
Brigham and Women’s Hospital’s COO said the hospital was one of the first to institute an active shooter
training program. The hospital does not use metal detectors.

Lessons Learned : “A is for Access Control”

1. Metal Detectors can be are a reliable tool to Prevent In-Hospital Shootings.

2. Active Shooter Drills are NOT ENOUGH as these incidents unfold in just a few minutes.

3. Installing ‘NO WEAPONS’ Signage at Entrances can be a deterrent to these first time shooters.

Despite having a good job, family, and a beautiful home, when confronted with a mid-life crisis, his mother’s
death, another middle-aged shooter goes to a hospital and shoots the doctor, in a scenario that resembles
the Johns Hopkins shooting in 2010. To protect staff and patients, hospitals will have to increase their
security protective measures, including use of metal detectors, no weapons signage and
situational awareness of the staff.

RISKAlerts is a publication of Risk & Security LLC.
To subscribe, write to: info@riskandsecurityllc.com

Inmate Patient Takes Sheriff’s Deputy’s Gun, Shoots Deputy and Kills Himself

Posted on August 25, 2014 10:23 am by Caroline Ramsey-Hamilton Comment

Prisoner Grabs Deputy’s Gun at a West Union, Iowa Hospital, Shoots Deputy & Turns Firearm on Himself.

At Palmer Lutheran Health Center, a full service hospital in West Union, Iowa, an inmate who was brought from Fayette County Jail on Saturday morning, August 23, at 8:30 am, grabbed the County Sheriff Deputy’s gun and demanded he be released, the deputy used a non-lethal device on the inmate, who then shot the deputy at close range. The inmate then killed himself with the handgun.

The deputy, who was wearing a bulletproof vest, was shot in the stomach, but was treated and released at the site of the incident. The inmate, still unidentified, grabbed the gun when one of his hands was released for his medical treatment.

LESSONS LEARNED:

1. Forensic patients (prisoners) know it’s easier to escape
from the hospital room, or hospital bed, than it is to
escape from the County Jail! Security should be
present to support law enforcement. One deputy is
a minimum. Deputy with security officer present is
better.

2. Wearing a bulletproof vest saved the deputy’s life during the incident. Security officers should
consider having bulletproof vests available when dealing with this type of patient.

According to research in the Journal of Injury Prevention, “Shootings in U.S. Hospitals 2000 – 2011,
in 23% of shootings within hospital emergency departments, the weapon was a security officer’s gun taken by the perpetrator. https://www.llis.dhs.gov/sites/default/files/FA-gdkelen.pdf

IAHSS (International Association of Hospital Safety and Security), has policy guidelines for security departments that deal with forensic (inmate) patients. IAHSS members can access the Healthcare Security: Basic Industry Guidelines at www.iahss.org.

Security managers and hospital management need to make sure that All Hospital Staff including Clinical Staff
Are Warned to Use Extreme Caution When Working with or Near Forensic Patients!

RISKAlert® is a publication of Risk & Security LLC at www.riskandsecurity.com

TO SIGN UP FOR RISKAlerts, send your email address to info@riskandsecurityllc.com

Copyright, 2014-2015 – Risk & Security LLC

The LAX Shooting and the Active Shooter Threat

Posted on November 3, 2013 9:26 am by Caroline Ramsey-Hamilton Comment

With the 3^rd Active Shooter incident in less than 45 days, you are probably wondering what is happening here? Why are we having so many active shooters?

There are not any easy answers, but one thing is certain, all the shooters in the Navy Yard Shooting, the Sparks Middle School shooting, and the LAX Shooter all suffered from psychological problems.

In the LAX shooting, the shooter ‘s parent had tried to contact the police because of a suicide text they had received, but it was already too late.

Police red tape being what it is – thorough, the urgency was lost and the incident was already in process before anything had been done.

BUT NOTE: The text was a HELP ME. And it was noticed, but not followed up in time.

All these shooters had major mental issues, that people had noticed, and
that people had remarked on, and that people had worried about.

We don’t know where all the guns in the incidents were purchased, or just picked up at home and taken to the scene.

BUT we know that most of the active shooters had mental issues, which means that the screenings must be approved, and more help available for these individuals, before they can kill or hurt others.

How to Easily Update your HIPAA Business Associate Agreements Before Sept. 23, 2013

Posted on August 19, 2013 4:05 pm by Caroline Ramsey-Hamilton Comment

One of the major changes for every business involved with the new HIPAA Omnibus Rule is that you are required to

“Review and, if Necessary, Amend Business Associate Agreements”

Whether your organization is defined as a Hospital, a Physician Practice, a Group Health Plan, a Managed Care organization, a Pharmacy, a Dental Office, or any kind of “Covered Entity” (CE), you have to change your business agreements with all the people who access, create, manage, store, or view your Protected Health Information (PHI).

The new HIPAA Omnibus Rule (45 CFR § 164.314(a) and .504(e)) added new elements that require you to adjust the Business Associate agreements to make sure they agree (in writing) to comply with the HIPAA Security Rule, to make sure they perform their own Risk Analysis to assess how they protect PHI.

Covered entities and business associates must ensure that their existing and future agreements contain the elements required by . In addition to previous requirements, the agreement must require the business associate to:

1. Comply with the security rule.

2. Execute business associate agreements with their subcontractors.

3. To the extent the business associate carries out an obligation of a covered entity, comply with any HIPAA
rule applicable to such obligations.

4. Report breaches of unsecured protected health information to the covered entity (organization).
If you’re not sure how to adjust all these agreement, DHHS-OCR has updated sample business associate language for you
to use at : http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html.

The HIPAA Omnibus Rule has made accountability more important because it says that the Covered Entity (CE) is

are liable for the misconduct of business associates if the business associate is acting as the agent of the covered entity.

In the same way, business associates should review their agreements with their Covered Entities and also their Sub-Contractors to make sure that the language in their contracts is up to date and makes it clear that the subcontractors are acting as independent contractors and not as the agents of the covered entity or business associate, and that the agreements do not give the covered entity too much control over day-to-day operations of you, their business associate.

As of today, August 19, 2013, both the Healthcare Provider (CEs), and the Business Associates have 34 more Days to modify these agreements modified and up to date, making sure they match the new HIPAA Omnibus Rule if :

(1) the agreement they had in place on January 25, 2013, complied with the HIPAA rules as of that date, and

(2) the agreement does not expire or renew (other than through evergreen clauses) prior to September 23, 2014!

So get out those pencils, and those agreements and start reviewing, amending and modifying those agreements!

SPECIAL TIP: Here’s a web site with sample Business Associate language to use as a resource:

http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html

The Top 5 Reasons Why You May Not Be HIPAA Compliant!

Posted on July 22, 2013 1:40 pm by Caroline Ramsey-Hamilton Comment

After updating the HIPAA Law (HIPAA Omnibus Rule) in 2013, and a new Enforcement Deadline
coming up on September 23, 2013, some organizations still aren’t HIPAA compliant! With over
22,000,000 disclosures of Protected Health Information already, what are the five most common
reasons why your organization isn’t compliant!

1. No HIPAA Risk Analysis – maybe you were too busy, or maybe you weren’t sure what a risk
analysis really is. A HIPAA Risk Analysis, (according to the Office for Civil Rights for the Department
of Health and Human services) is: Conduct an accurate and thorough assessment of the potential
risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected
health information held by the organization.

2. The HIPAA Risk Analysis is out of date — maybe you did it five years ago, which was BEFORE
the new HIPAA Omnibus Rule was mandated. Maybe you wanted to update it, but you got busy
with all the other pressing IT issues. Maybe you didn’t have the right resources to run a risk analysis.

3. HIPAA Risk Analysis was too focused on technical elements. Many information security
managers think that “IT people always know best”, and as far as HIPAA goes, that’s not correct.
HIPAA rules need to be followed by the medical staff, by the medical records people, by the human
resources department, and by everyone who handles or accesses PHI (protected health information).
And the Risk Analysis has to reflect input from all these different roles.

4. No correlation between the HIPAA Risk Analysis Recommendations and the changes
that were made after the HIPAA Risk Analysis was completed. The HIPAA Security controls should
have been implemented in conjunction with the Risk Analysis, not added completely independently.
The Risk Analysis should be a road map, not a boring report that ended up locked in a file cabinet somewhere.

5. Inadequate training and security awareness program. In a recent HIPAA Risk Analysis,
the individuals surveyed said they had a few hours of HIPAA training when they joined the company,
but nothing since. Next question, how long had they been with the organization, and they said,
six years, twelve years, fifteen years, and yet they had never had UPDATED HIPAA Training
or even access to a security awareness program.

Don’t find out you’re not HIPAA Compliant, when a federal regulator is sitting out in the lobby.
BE PRO-ACTIVE and start your HIPAA Risk Analysis today. To get started, send your questions to caroline@riskandsecurityllc.com, or review the OCR Guidelines for HIPAA Risk Analysis at:
http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidancepdf.pdf

Is Extreme Heat a New Deadly Threat?

Posted on July 1, 2013 10:46 am by Caroline Ramsey-Hamilton Comment

We are currently in the grip of a terrible heat wave in the western states. Death Valley, California almost beat it’s previous record of a 130, with a National Weather Service Thermometer recording 129.9. The highest temperature ever recorded on Planet Earth is 132.

Despite all the news coverage of hurricanes, homes torn apart by tornadoes, and tropical storms, the deaths from excessive heat kill more people annually than almost all the other natural disasters (except for tsumanis and 7.0 and above earthquakes).

Deaths from excessive heat include both cardiac arrest and breathing issues. “Heat-related illnesses and deaths are preventable. Taking steps to stay cool, hydrated and informed in extreme temperatures can prevent serious health effects like heat exhaustion and heat stroke,” said lead author Ethel Taylor, a researcher who works with the CDC.

Because extended heat waves put a strain on electrical loads and may trigger power outages, it is important for companies to have a Plan for Extended Extreme Heat.
Plan for a situation without electricity for 3 or more days.

Having just survived a week in south Florida without AC, and growing in Los Angeles, also
without air conditioning, here are a few tips to stay cool:

1. Stay wet to facilitate evaporate cooling. Wear a wet T-shirt and keep your clothes
damp.

2. Make sure pets are ALWAYS in a shady place and give them plenty of cool water.

3. Buy ice and use it to rub on children’s arms and legs to keep them cool.

4. Use fans and swamp coolers if electricity is available. Coleman makes fans that
run on batteries if electricity goes out during a heat wave.

5. Wake up earlier and use the cooler morning hours for outside tasks and stay
indoors during the heat of the day.

And, if it’s blistering hot where you are — DO NOT USE FIREWORKS. Areas that
are already dry, including shake roofs, will burn more easily under such extreme heat!

AND wherever you are, STAY COOL.

Tags:
Death Valley
extreme heat
heat deaths
heat wave

Benghazi Hearing Demonstrates Attack Uncovered A Fatal Lack of Coordination & Funding for Embassy Security

Posted on May 8, 2013 2:37 pm by Caroline Ramsey-Hamilton Comment

Just two weeks ago, we were talking about the lack of coordination between DHS agencies and known intelligence on the brothers responsible.

Now we have the Benghazi Senate hearings, and here is the same problem again – lack of coordination between different parts of the State Department, and with the Defense Department, AND with the CIA and the intelligence community.

Add to this, the appalling cuts in funding for diplomatic security, and a flawed process about what needs to be done about security and protection to our embassies around the world.

“In these tight budget times, the committee has had to make some tough choices to prioritize funding.”, said a GOP aide in The Hill article (GOP cuts to embassy security draw scrutiny), by Alexander Bolton on September 18, 2012. In spite of the uncertainly of the Arab Spring, the demonstrations every Friday in streets from Bahrain to Tunesia, the embassies had their budgets cut.

Of course, security experts are used to this, security doesn’t directly generate revenue, and it is often one of the first functions on the chopping block. However, to cut funding to the critical embassy functions in this volatile environment, is obviously a very bad decision on the part of the GOP.

For example, the security risk assessment which are routinely done on these embassies are not done on a systematic basis. As a risk expert, these security risk assessments should be done WEEKLY, and they should be automated so they can instantly be compared to environments in other embassies, and comparisons made by month, by year, and trends can be tracked.

If we can’t afford to do these assessments and just as important, if we can’t afford to fix the problems that assessments reveal, then we should not have embassies in these places.

The security risk assessments that are done properly must also include complete threat assessments. “We need to develop a paradigm for managing risk“, said Gregory Hicks, a Foreign Service Officer who testified today on Capitol Hill.

These paradigms for managing risk already exist and they have been totally ignored by the State Department, which makes it almost impossible to get a clear, unfiltered view of the security situation at any embassy, at any point in time.

At least both sides of the political aisle agree, we do not want this to happen again! Benghazi is not a political problem, it is a massive security failure problem!

3 Cleveland Women Freed -The New Front Line of the War on Women

Posted on May 8, 2013 1:54 pm by Caroline Ramsey-Hamilton Comment

Posted on May 8, 2013 by Caroline Ramsey-Hamilton

For the past 4 days, media attention has been focused on the three Cleveland girls who were abducted close to their homes and kept as prisoners in an old run-down house with neighbors on all sides.

NOW, neighbors tell how they broke down the door to free the women, the little 6-year old girl who came out with them, presumably the child of their abductor, and stories of screams coming from the house over the LAST TEN YEARS.

Besides the obvious curiosity about how they are, how this happened, how they were subdued for so long, and all the salient details, my question is WHY DID THIS HAPPEN, AND WHAT DO WE NEED TO CHANGE TO MAKE SURE IT NEVER HAPPENS AGAIN!

As a security analyst, I have to place some of the blame at the door of the Cleveland police, not that they are different from any other police department in the U.S. Police are trained to catch criminals – that is their reason for being. But it seems that, increasingly, in crimes where women go missing, even a 16-year-old, the search for them never really gets underway. With no speeding car to chase, no easy suspicious person to detain, they stop looking.

Statistics say that about 2300 people go missing every day, over half are men, so that
leaves about 1000 females, and of these, about 70% are young women. so that easy math – about 700 A DAY! or 255,500 EVERY YEAR!

My point is just that the Cleveland Triple Abduction should be a wake up call for parents, citizens AND law enforcement to find a better way to search for these missing girls.

The world has changed – we have cameras, social media, facebook pages, and we need for all of these to be routinely used to find missing girls before we see another case exactly like this one.

Why the FBI and DHS Need Google’s Help to Track Potential Terrorists

Posted on April 24, 2013 9:39 am by Caroline Ramsey-Hamilton Comment

The Boston Marathon bombings were bad enough. The loss of life was terrible, but the runners and their families who lost legs and feet because they wanted to give their Dad a hug at the finish line were worse.

One week later, we all watch with trepidation as the first bomber is killed and the second captured bleeding in a boat in Watertown.

THE MOST TERRIBLE NEWS OF ALL IS THAT IT MIGHT HAVE BEEN PREVENTED!! This is EXACTLY the situation that DHS was supposed to catch. This is EXACTLY why the agencies were ORDERED to share information, and still these guys can tweet all they want, show violent Islamic videos on their web sites and call for Jihad and NOBODY NOTICES!!

This is made even more incomprehensible because the U.S. government was ALERTED BY THE RUSSIANS that one of them was DANGEROUS.

What do we need to do to get these agencies to start paying attention to these potential terrorists? DO WE NEED TO MAKE THEM WEAR A RED SHIRT?

If the IRS can keep track of every American and in 2 minutes call up their entire history of taxes, and the Department of Labor can calculate your benefit rates in less than 1 minute, and Social Security keep track of all your information – why can’t DHS and the FBI keep a contact database current?

Why can’t they have a person who scans these web sites and Facebook sites for Jihadist pages and then cross-references them with the site’s owner? Why can’t a trip to a violent region of the world trigger a PING, as I heard one congressman call it.

Every company in the world has a simple Contact database on their own customers and suppliers that gives them years of data. WHY CAN’T WE BE PROTECTED FROM THESE TERRORiSTS.

This one wasn’t hiding in the shadows – he was ON SOCIAL MEDIA! He wasn’t locked up in a cabin – he was traveling internationally, his brother was getting a scholarship. And they did this FOR YEARS!!

This intelligence failure is just exactly like 9/11 all over again. These agencies are so procedural that they cannot connect the dots. Ok – they’re human. But we have super computers that CAN connect the dots and do profiles and create alerts…

Maybe we should call Google and get some help. We obviously need it.

Tragedy at the Boston Marathon – What Went Wrong?

Posted on April 16, 2013 11:24 am by Caroline Ramsey-Hamilton Comment

Looking at the CNN footage of the Boston Marathon finish line yesterday, I was struck by the shock of the bystanders and the chaos that followed the blasts.

Having just giving two seminars on security controls, I pulled out my list to see what could possibly have been done differently to prevent this devastating outcome, and there was the first word on the list ACCESS CONTROL.

After thirty years as a security expert and risk-threat analyst, I am about 85% sure that this was a lone wolf attacker who made his crude bombs to address some personal perceived problem, whether it was fear of gun legislation, spillover from the Israeli-Palestinian conflict, the Neo Con torture initiative, or something else.

Putting the attacker aside for a moment, the tragedy happened because SOMEONE WAS ABLE TO WALK RIGHT UP TO THE FINISH LINE AND PUT AT LEAST 3 BOMBS right near the finish line! THiS IS NOT RIGHT.

There has to be SCREENING and ACCESS CONTROL PROCEDURES IN PLACE! You can’t have security if you have open access to a major event like the Boston Marathon. For year, security experts have cautioned that large crowds make a great target, and so events have paid lip service to this concept, without staying on the task, and making sure that SECURITY CONTROL NUMBER ONE – ACCESS CONTROL is ALWAYS in place.

But people don’t like access control, it’s too much trouble, they say. They don’t like metal detectors, too expensive, too much trouble, too intrusive. Well, it’s not as intrusive as having a major injury. There are ways to secure these high profile sites, but the security community has to lead on this.

Yes, it is very sad and depressing that the world has come to this — but it has. And it will happen again. As long as security is perceived as too much trouble, too expensive, too tough to do, and too intrusive, there will be more tragic events like this one.

Risk and Security LLC

Risk Assessments, Training and More