HIPAA.com

Physical Safeguard Standard, Device and Media Controls: Medi Re-use Implementation Specification-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Media Re-use is the second of four implementation specifications, and it is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. What to Do A covered entity must implement procedures for removal of electronic protected health information from electronic media before the…

Ed JonesHIPAA Law2003, 2009, 2010, American Recovery and Reinvestment Act, ARRA, business associates, covered entity, device and media controls, electronic protected health information, February 17, February 20, Federal Register, flash drive, hardware vendor, HITECH Act, implementation specification, media re-use, physical safeguard standard, President Obama, required, Risk Analysis, risk mitigation, Security Rule, software vendor, workstationLeave a comment

Physical Safeguard Standard, Device and Media Controls: Disposal Implementation Specification-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, Device and Medial Controls is the fourth and last Physical Safeguard Standard. Disposal is the first of four implementation specifications, and it is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. What to Do A covered entity must implement policies and procedures to address the final disposition of electronic protected health information and…

Ed JonesHIPAA Law2009, 2010, American Recovery and Reinvestment Act, ARRA, backup, business associates, civil liability, covered entity, data disposal, degaussing, device and media controls, disposal, electronic media, electronic protected health information, Enforcement, February 17, fines, hardware, hardware vendor, HITECH Act, implementation specification, magnetic media, physical safeguard standard, President Obama, reformatting, required, security incident, Security Official, Security Rule, software vendorLeave a comment

Device and Media Controls: What This HIPAA Security Rule Physical Safeguard Standard Means

This is the fourth and last Physical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: disposal, media re-use, accountability, and data backup and storage. The first two are required; the last two are addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act…

Ed JonesHIPAA Law2009, 2010, accountability, addressable, American Recovery and Reinvestment Act, ARRA, business associates, covered entity, device and media controls, electronic media, electronic protected health information, Enforcement, erasure, February 17, file deletion, hardware, HITECH Act, implementation specification, physical facility, physical safeguard standard, policies and procedures, President Obama, privacy breach, Risk Analysis, risk mitigation, security incident, Security Rule, unauthorized electronic media, workforce, written inventoryLeave a comment

Word of the Day: Benchmarking

Benchmarking: Continuous process whereby an enterprise measures and compares all of its functions, systems, and practices against strong competitors, identifying quality gaps in the organization, and striving to achieve competitive advantage locally and globally.

Carolyn HartleyHealth IT and HITECHbenchmark, competitive advantage, Glossary, word of the dayLeave a comment

Physical Safeguard Standard, Workstation Security-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the third Physical Safeguard Standard, Workstation Security. The implementation specification for this standard is defined by the standard title, and is required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. What to Do A covered entity must implement physical safeguards for all workstations that access electronic protected health information to restrict access…

Ed JonesHIPAA Law2009, 2010, American Recovery and Reinvestment Act, ARRA, authorized user, browser, business associate, controlled access, covered entity, electronic media, electronic protected health information, February 17, Federal Register, healthcare provider, HIPAA Administrative Simplification, HITECH Act, implementation specification, Internet, logoff, mobile devices, PDA, physical safeguard standard, President Obama, receptionist, required, Risk Analysis, risk management, Security Official, Security Rule, unauthorized user, vulnerable, workforce member, workstation securityLeave a comment

Word of the Day: Request for Proposal

Request for Proposal (RFP): A compilation of factors the buyer will consider before making a purchase. An RFP is typically sent to two or more potential responders and always contains a due date and contact person in the event those bidding on the proposal have additional questions.

Carolyn HartleyHealth IT and HITECHGlossary, request for proposal, RFP, word of the dayLeave a comment

Physical Safeguard Standard, Workstation Use-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, Workstation Use is the second Physical Safeguard Standard. There is no defined implementation specification for this standard. Implementation of policies and procedures pertaining to this standard are required. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act (ARRA), signed by President Obama on February 17, 2009. What is Required A covered entity must implement policies and procedures that specify the proper functions to be…

Ed JonesHealth IT and HITECH2009, 2010, American Recovery and Reinvestment Act, antivirus, ARRA, automatic logoff, business associate agreement, business associates, copyright law, covered entities, database security, desktop, electronic protected health information, February 17, HIPAA Administrative Simplification, HITECH Act, implementation specification, laptop, logoff, password, PDA, physical safeguard standard, policies and procedures, President Obama, required, Security Official, Security Rule, software licensing, tablet, workstation useLeave a comment

HHS appoints members to HIT Policy and Standards Committee

On Friday, May 8, 2009, the U.S. Department of Health and Human Services (HHS) announced appointments to the Health Information Technology (HIT) Policy Committee and HIT Standards Committee. These federal advisory committees were established by provisions in the American Recovery and Reinvestment Act (ARRA) that President Obama signed on February 17, 2009. Today, is the first meeting of the HIT Policy Committee, and Friday, May 15, 2009, is the first scheduled meeting of the HIT Standards Committee, both in Washington, DC. According to the press release issued by HHS, “[t]he HIT Policy Committee will make recommendations to the National Coordinator for Health Information Technology [Dr. David Blumenthal] on a policy…

Ed JonesHealth IT and HITECH2009, American Recovery and Reinvestment Act, ARRA, certification criteria, Dr. David Blumenthal, Electronic Exchange, health information, health information infrastructure, health information technology, healthit, HHS, HIT, implementation specifications, interoperable, May 11, May 15, May 8, National Coordinator for Health Information Technology, patient medical information, Policy Committee, recommendations, Standards, Standards Committee, US Department of Health and Human ServicesLeave a comment

HITECH Privacy Provisions Include HIPAA Privacy Definitions and New or Broadened Concepts

This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards. HIPAA Privacy Definitions: BreachBusiness AssociateCovered EntityDisclosureElectronic Health RecordHealth Care Operations Health Care ProviderHealth PlanNational CoordinatorPaymentPersonal Health RecordProtected Health Information SecretarySecurityStateTreatmentUseVendor Of Personal Health…

Ed JonesHealth IT and HITECHbreach, business associate, covered entity, Disclose, Disclosure, electronic health record, Health Care Operations, Health Care Provider, health plan, National Coordinator, Payment, personal health record, protected health information, Secretary, Security, State, Treatment, Use, Vendor of Personal Health RecordsLeave a comment