# Presentation: 705256

## HIPAA Security Standards Final Rule

- Stanley Nachimson
- Office of HIPAA Standards
- CMS

## Regulation Dates

- Published February 20, 2003
- Effective Date April 21, 2003
- Compliance Date:
- April 21, 2005 for all covered entities except small health plans
- April 21, 2006 for small health plans (as HIPAA requires)

## General Requirements(164.306(a))

- Ensure
- Confidentiality (only the right people see it)
- Integrity (the information is what it is supposed to be – it hasn’t been changed)
- Availability (the right people can see it when needed)

## General Requirements

- Applies to _Electronic_ Protected Health Information
- That a Covered Entity Creates, Receives, Maintains, or Transmits

## General Requirements

- Protect against reasonably anticipated threats or hazards to the security or integrity of information
- Protect against reasonably anticipated uses and disclosures not permitted by privacy rules
- Ensure compliance by workforce

## Regulation Themes

- Scalability/Flexibility
- Covered entities can take into account:
- Size
- Complexity
- Capabilities
- Technical Infrastructure
- Cost of procedures to comply
- Potential security risks

## Regulation Themes

- Technologically Neutral
- What needs to be done, not how
- Comprehensive
- Not just technical aspects, but behavioral as well

## How Did We Accomplish This

- Standards Are Required but:
- Implementation specifications which provide more detail can be either required or addressable.

## Addressability

- If an implementation specification is addressable, a covered entity can:
- Implement, if reasonable and appropriate
- Implement an equivalent measure, if reasonable and appropriate
- Not implement it
- Based on sound, documented reasoning from a risk analysis

## What are the Standards?

- Three types:
- Administrative
- Physical
- Technical

## Administrative Standards

- Security Management
- Risk analysis (R)
- Risk management (R)
- Assigned Responsibility
- Workforce Security
- Termination procedures (A)
- Clearance Procedures (A)

## Administrative Standards

- Information Access Management
- Isolating Clearinghouse (R)
- Access Authorization (A)
- Security Awareness and Training
- Security Incident Procedures
- Contingency Plan
- Evaluation
- Business Associate Contracts

## Physical Standards

- Facility Access Controls
- All addressable specifications
- Contingency operations
- Facility Security Plan
- Access control
- Maintenance Records
- Workstation Use (no imp specs)
- Workstation Security
- Device and Media Controls

## Technical Standards

- Access Control
- Unique User Id (R)
- Emergency Access (R)
- Automatic Logoff (A)
- Encryption and Decryption (A)
- Audit Controls
- Integrity
- Person or Entity Authentication
- Transmission Security

## Chart in Regulation

- At end of the regulation, this chart lists each standard, its associated implementation specifications, and if they are required or addressable

## Basic Changes from NPRM

- Aligned with Privacy (Definitions, requirements for business associates)
- Encryption now addressable
- No requirement for certification
- Standards simplified and redundancy eliminated.

## Implementation Approach

- Do Risk Analysis – Document
- Based on Analysis, determine how to implement each standard and implementation specification – Document
- Develop Security Policies and Procedures – Document
- Train Workforce
- Implement Policies and Procedures
- Periodic Evaluation

## Summary

- Scalable, flexible approach
- Standards that make good business sense
- Two years for implementation
- First step is risk analysis