The increased scope of the security standard to all electronically maintained or communicated health information obscures this fact and leads to some confusion. Any delay in creating the Privacy standard negatively impacts ability of covered person to comply with the security regulations. Stipulation to mitigate the negative impact of any delay in providing the Sec 264 Privacy Standard. Fax and IVR provide electronic access to sensitive patient information. Eliminate IVR and FAX exclusion.
Risk analysis presumes a cost can be assigned to any potential lose.
This may lead to irrational results. Systems with large amounts of routinely collected data would be afforded more protection than systems that maintain significantly smaller amounts of extra-ordinarily collected data. Common reasoning suggests that more sensitivity about the extra-ordinary than the routine. The NPRM defines data as merely a sequence of symbols to which meaning is assigned. The regulation proposes authentication mechanisms which have the effect of corroborating the meaning of characters, data elements, records, and messages.