HIPAA.com

Facility Access Controls: Contingency Operations-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Physical Safeguard Standard, Facility Access Controls. This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. What…

Ed JonesHIPAA Law2010, 2019, addressable, American Recovery and Reinvestment Act, ARRA, business associate, contingency operations, contingency plan, covered entity, disaster recovery plan, electronic protected health information, emergency mode operations, facility access controls, February 17, HIPAA Administrative Simplification, HIPAA Security Rule, HITECH Act, physical safeguard standard, policies and procedures, power failure, President Obama, reasonable and appropriate, restoration of lost data, Security Official, Security Rule, threats and vulnerabilitiesLeave a comment

Facility Access Controls: What This HIPAA Security Rule Physical Safeguard Standard Means

This is the first Physical Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has four implementation specifications: contingency operations; facility security plan; access control and validation procedures; and maintenance records. Each of these implementation specifications is addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA,…

Ed JonesHIPAA Law2010, 2019, access control and validation procedures, addressable, American Recovery and Reinvestment Act, ARRA, authorized access, business associate, contingency operations, covered entity, electronic protected health information, facility, facility access controls, facility security plan, February 17, hardware, HIPAA Administrative Simplification, HIPAA Security Rule, HITECH Act, internal and external protection, landlord’s building security plan, maintenance records, multiple business offices dwelling, physical location, physical premises, physical safeguard standard, policies and procedures, President Obama, reasonable and appropriate, Security Official, Security Rule, single business dwelling, softwareLeave a comment

Physical Safeguard Standards of the HIPAA Administrative Simplification Security Rule

There are four physical safeguard standards: facility access controls, workstation use, workstation security, and device and media controls. Each standard has implementation specifications, which can be required or addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As we have noted in earlier postings on HIPAA.com, business associates of covered entities will be required to comply with the Security Rule safeguard standards, beginning February 17, 2010. This requirement is one of the HITECH Act provisions of the American Recovery and Reinvestment Act ARRA, signed by President Obama on February 17, 2009. Physical…

Ed JonesHIPAA Law2010, 2019, addressable, American Recovery and Reinvestment Act, ARRA, business associate, covered entity, device and media controls, disposal, electronic protected health information, facility, facility access controls, February 17, hardware, HIPAA Administrative Simplification, HITECH Act, physical location, physical safeguard standards, President Obama, reasonable and appropriate, required, Security Rule, software, workstation security, workstation useLeave a comment

FTC Posts NPRM on Breach Notification Rule for e-Health Information

On April 17, 2009, the Federal Trade Commission issued a notice of proposed rulemaking that requires vendors of personal health records and related entities such as non-profit organizations that offer PHRs, to notify individuals when the security of their individually identifiable health information is breached. The NPRM seeks to conform with rules from HHS that safeguard protected health information, but the FTC proposed rule applies to non HIPAA-covered entities that are not subject to HIPAA privacy and security requirements. Of the many comments the FTC seeks is to identify entities that would fall under this ruling. We believe this rule will strengthen the trust consumers/patients have in sharing information in their…

Carolyn HartleyAmerican Recovery and Reinvestment ActARRA, HIPAA, Personal Health Records, PHRs, Security BreachLeave a comment

Evaluation-What This HIPAA Security Rule Administrative Safeguard Standard Means

This is the eighth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. Its implementation specification is embodied in the language of the standard itself, and it is required of covered entities. Further, as HIPAA.com has noted earlier, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010, as provided for in the HITECH Act provisions of the American Recovery and Reinvestment Act, signed by President Obama on February 17, 2009. What is Required Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of…

Ed JonesHIPAA Law2009, 2010, acceptable level of risk, Administrative Safeguard Standard, American Recovery and Reinvestment Act, ARRA, business associate, covered entity, electronic protected health information, Evaluation, evaluation plan, February 17, HIPAA Security Rule, implementation specification, National Institute of Standards and Technology, NIST, NIST Publication 800-16, preamble, President Obama, risk, Risk Analysis, risk assessment, risk mitigation, risk profile, Security Official, security policies and proceduresLeave a comment

HITECH Guidance & RFI

HITECH GUIDANCE & RFI 45 CFR Parts 160 and 164 AGENCY: Office of the Secretary, Department of Health and Human Services. Download (Requires Acrobat Reader)

Kristopher CargileHealth IT and HITECH45 CFR, HHS, HITECH, HITECH Act, Part 160, Part 164, RFILeave a comment

Pay attention to HITECH Act Definition of Breach: Lost Customers Big Cost Factor

The April 2009 issue of Baseline magazine has an article by Corinne Bernstein entitled: “The Cost of Data Breaches,” which is available online at www.baselinemag.com. We recommended that covered entities and business associates review this article, based on a Ponemon Institute study of incidents and costs incurred at 43 organizations in 17 industry sectors. Here are several highlights: » “Lost business accounted for nearly 70 percent of a data breach in 2008. » “[S]ectors suffering the highest customer losses were health care…and financial services. » “The biggest cause of breaches…is insider negligence…88% of all cases in 2008. » “The number of breaches involving third-party organizations continues to climb.” The article…

Ed JonesHealth IT and HITECH2010, American Recovery and Reinvestment Act, Baseline, breach, Corinne Bernstein, cost factor, February 17, HIPAA Administrative Simplification, HITECH Act, insider negligence, lost business, Ponemon Institute, President Obama, Security RuleLeave a comment

Word of the Day: EHR

Electronic health record (EHR): A secure, real-time, interoperable point-of-care, patient-centric information resource for clinicians. The EHR aids clinicians in decision making by providing access to patient health record information where and when they need it and by incorporating evidence-based decision support. The EHR automates and streamlines the clinicians’ workflow, closing loops in communication and response that result in delays or gaps in care. The EHR also supports the collection of data for uses other than direct clinical care, such as billing, quality management, outcomes reporting, resource planning, and public health disease surveillance and reporting.

Carolyn HartleyHealth IT and HITECHEHR, Glossary, terms, word of the dayLeave a comment

Kudos to DOQ-IT

Praise goes out to the Doctors Office Quality – Information Technology (DOQ-IT) centers that worked tirelessly to assist physicians select and implement electronic health records. Effective April 16, 2009, DOQ-IT will end. Access to all DOQ-IT-related programming and resources on QualityNet (e.g., online registration, data submission, reports) will end April 16, 2009, at 5 p.m. Central Time. We have had the pleasure of working with most of the DOQ-IT program leaders, building substantial friendships. We hope that their work will be a strong impetus to build on as physicians continue to select, implement and thrive in a health IT environment.

Carolyn HartleyHealth IT and HITECHDoctors Office Quality, DOQ-IT, EHR, electronic health record, QualityNetLeave a comment

Contingency Plan: Applications and Data Criticality Analysis-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the fifth implementation specification for the Administrative Safeguard Standard (Contingency Plan). This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. As HIPAA.com has noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (ARRA) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. What to Do Assess the relative criticality of specific applications and data in support of other…

Ed JonesHIPAA Law2009, 2010, addressable, Administrative Safeguard Standard, American Recovery and Reinvestment Act of 2009, applications and data criticality analysis, ARRA, business associate, business operations, contingency plan, covered entity, data backup plan, disaster recovery plan, electricity, electronic protected health information, electronic systems, emergency mode operation plan, February 17, HIPAA Administrative Simplification, implementation specification, reasonable and appropriate, Risk Analysis, Security Official, Security Rule, threats and vulnerabilitiesLeave a comment