The Federal Trade Commission’s (FTC’s) red flags rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009. See this post for more information on how to prepare for Friday’s deadline.
Categories Red Flags RulesLeave a comment
Word of the Day: Integrated System
Integrated System: In an EMR, the vendor builds the system using the same characteristics arranged in the broad categories of data issues, application issues, presentation issues, and operational issues. Systems built in this way are often referred to as a Single Source solution.
Categories Health IT and HITECHLeave a commentFTC’s “Red Flags” Rule to Prevent Identity Theft Requires Compliance by Healthcare Providers on Friday, May 1, 2009
The Federal Trade Commission’s (FTC’s) “red flags” rules for financial institutions and creditors to fight identity theft require compliance by most healthcare providers on Friday, May 1, 2009. HIPAA.com recommends that healthcare providers examine three documents, which we have available at HIPAA.com, to determine their responsibilities with respect to compliance with the red flag rules. These documents are: » Identity Theft Red Flag Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003; Final Rule, published in the Federal Register on November 9, 2007. The preamble of the Final Rule, which discusses the purpose, intent, and scope of coverage, appears on pages 63718-63733. Of particular importance…
Categories Red Flags RulesLeave a commentIdentity Theft Red Flags and Address Discrepancies
DEPARTMENT OF THE TREASURY 12 CFR Part 41, 222, 334, 364, 571 and 717 16 CFR Part 681 Idendity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003 AGENCY: Office of the Secretary, HHS. ACTION: Joint Final Rules and Guidelines. Download (Requires Acrobat Reader)
Categories Red Flags RulesLeave a commentFacility Access Controls: Facility Security Plan-What to Do and How to Do It
In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. What…
Categories HIPAA LawLeave a commentWord of the Day: Security Incident
Security Incident: The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
Categories Health IT and HITECHLeave a commentFacility Access Controls: Contingency Operations-What to Do and How to Do It
In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. What…
Categories HIPAA LawLeave a commentFacility Access Controls: What This HIPAA Security Rule Physical Safeguard Standard Means
This is the first Physical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: contingency operations; facility security plan; access control and validation procedures; and maintenance records. Each of these implementation specifications is addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA,…
Categories HIPAA LawLeave a commentPhysical Safeguard Standards of the HIPAA Administrative Simplification Security Rule
There are four physical safeguard standards: facility access controls, workstation use, workstation security, and device and media controls. Each standard has implementation specifications, which can be required or addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. Physical…
Categories HIPAA LawLeave a commentFTC Posts NPRM on Breach Notification Rule for e-Health Information
On April 17, 2009, the Federal Trade Commission issued a notice of proposed rulemaking that requires vendors of personal health records and related entities such as non-profit organizations that offer PHRs, to notify individuals when the security of their individually identifiable health information is breached. The NPRM seeks to conform with rules from HHS that safeguard protected health information, but the FTC proposed rule applies to non HIPAA-covered entities that are not subject to HIPAA privacy and security requirements. Of the many comments the FTC seeks is to identify entities that would fall under this ruling. We believe this rule will strengthen the trust consumers/patients have in sharing information in their…
Categories American Recovery and Reinvestment ActLeave a comment