# Presentation: 352922

## HIPAA Administrative SimplificationSecurity Overview

**David. A. Feinberg, C.D.P.**
**President, Rensis Corporation**

## Administrative Simplification

**National standards for efficient and electronic administrative and financial health care transactions**
**Recommendations, and ultimately, regulations for privacy legislation**
- 	Recommendations for electronic medical records

## HIPAA Security

- Regulation Status
- Notice of Proposed Rule Making (NPRM) issued on 12 August 1998
- Final rule being worked-on by DHHS
- Being aligned with final Privacy regulation
- Final rule will _not_ include provisions for electronic signature

## HIPAA Security

- 	HIPAA Security is a _process_: applying and documenting a series of technology neutral requirements to balance each organization’s specific
- environment
- risks, and
- costs

## HIPAA Security

- Administrative Procedures
- Physical Safeguards
- Technical Security Services --	*protect and control access to information*
- Technical Security Mechanisms --	*guard access to transmitted data*
- Electronic Signatures

## Administrative Procedures

- Certification
- Chain of Trust Agreement
- Contingency Plan
- Applications and data criticality analysis
- Data backup plan
- Disaster recovery plan
- Emergency mode operation plan
- Testing and revision

- continued ...

## Administrative Procedures

- Record processing mechanism
- Information access control
- Access authorization
- Access establishment
- Access modification
- Internal audit

- continued ...

## Administrative Procedures

- Personnel security
- Assured supervision
- Record access authorizations maintenance
- Operating and maintenance personnel access
- Personnel clearance policy / procedure
- Training

- continued ...

## Administrative Procedures

- Security configuration management
- Documentation
- Hardware / software installation and maintenance security review and testing
- Inventory
- Security testing
- Virus checking

- continued ...

## Administrative Procedures

- Security incident procedures
- Report procedures
- Response procedures
- Security management process
- Risk analysis
- Risk management
- Sanction policy
- Security policy

- continued ...

## Administrative Procedures

- Employee termination procedures
- Changes to combination locks
- Removal from access lists
- Removal of user accounts
- Return of keys, access cards, etc.

- continued ...

## Administrative Procedures

- Training
- Awareness training
- Periodic reminders
- Virus protection education
- Log monitoring and reporting education
- Password management education

## Physical Safeguards

- Assigned security responsibility
- Media controls
- Access control
- Accountability; i.e., tracking mechanism
- Data backup
- Data storage
- Disposal

- continued ...

## Physical Safeguards

- Physical access controls
- Disaster recovery
- Emergency mode operation
- Equipment control
- Facility security plan
- Physical access verification procedures
- Maintenance records
- Personnel need-to-know procedures
- Visitor sign-in and control

- continued ...

## Physical Safeguards

- Work station use policy and guidelines
- Secure work station locations
- Training

## Technical Security Services

- Access Control
- Emergency access procedure
- At least one of
- Context-based access
- Role-based access
- User-based access
- Optional encryption

- continued ...

## Technical Security Services

- Audit controls
- Authorization control
- At least one of
- Role-based access
- User-based access
- Data authentication

- continued ...

## Technical Security Services

- Entity authentication
- Automatic logoff
- Unique user identification
- At least one of
- Biometric
- Password
- Personal Identification Number (PIN)
- Telephone callback
- Token

## Technical Security Mechanisms

- Integrity controls
- Message authentication
- If communications or networking used, then   Access Controls   or   Encryption
- If using a network, then also
- Alarms
- Audit trails
- Entity authentication
- Event reporting

## Technical Security Mechanisms

- A note on encryption
- No _HIPAA_ rules _mandating_ support are currently specified
- Required by _CMS’ Internet Security Policy_**	****	****	**_www.hcfa.gov/security/isecplcy.htm_

## HIPAA Security Summary

- The tools to enforce confidentiality and protect patient privacy
- Principle of “minimum necessary”
- Technology neutral
- _Organizational vulnerability assessments_
- Computing systems infrastructure
- Networks infrastructure
- _Coordination with Business Associates_
- _Compliance certification_

## HIPAA Security Summary

- Further Information
- Notice of Proposed Rule Making (NPRM)	_http://aspe.hhs.gov/admnsimp_
- CMS (nee’ HCFA) Internet Security Policy	_www.hcfa.gov/security/isecplcy.htm_
- other sources	_www.nchica.org__	__http://www.healthkey.org__	__www.hhic.org__	__http://www.ahima.org_

## HIPAA Administrative SimplificationSecurity Overview

**David. A. Feinberg, C.D.P.**
**President, Rensis Corporation**
**3662 SW Othello Street**
**Seattle, Washington  98126 **
**206-617-1717**
_**DAFeinberg@computer.org**_