The final rule could reduce this burden by confining the covered entity's duties to an obligation to enter into contracts with appropriate data confidentiality clauses and to report only those inappropriate disclosures by vendors which the covered entity gains actual knowledge of. The job for payors and providers would be vastly simplified if the Secretary were to return the rule to traditional state law disclosure notions and focus the tracking requirement on disclosures outside the covered entity. The third step toward readiness is to make data security and confidentiality a check-off point in all enterprise planning. Such reengineering should, however, be minimal if current best practices are incorporated now. Included in that material are model data protection policies from several leading provider systems.
Most experts agree that the necessary encryption and password tools are currently available.
What usually needs attention are the people systems and organizational choices to reduce security exposures. In particular, organizations will be challenged to document procedures that guard data integrity and to implement physical safeguards for the same. Your organization has discretion in developing the safeguards and procedures appropriate given the technological resources available and the threat. For instance, use and disclosure authorizations are often inadequate under the standards derived from current case law. The opportunity is now for covered entities to identify the current weakness in their practices and procedures and to begin to address privacy and security exposures in enterprise planning.