Citation Title Description Status/Comments HITECH § 13401(a) Application of Security Provisions and Penalties to Business Associates “Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity.” HIPAA 45 C.F.R. § 164.308 Administrative Safeguards 45 C.F.R. § 164.308(a)(1) Security Management Process “Implement policies and procedures to prevent, detect, contain, and correct security violations.” HIPAA 45 C.F.R. § 164.308(a)(1)(ii)(A) Risk Analysis (Required) “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI held by the covered entity.” This risk analysis should attempt to disclose "all relevant losses" that could be anticipated if security measures were not in place (Preamble, at 8,347), such as “losses caused by inappropriate uses and disclosures and the loss of data integrity that would occur absent the security measures.”
HIPAA 45 C.F.R. § 164.308(b)(1) Business Associate Contracts “A covered entity, in accordance with [45 C.F.R. § 164.306], may permit a business associate to create, receive, maintain, or transmit [ePHI] on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with [45 C.F.R. § 164.314(a) that the business associate will appropriately safeguard the information” HIPAA 45 C.F.R. § 164.310 Physical Safeguards HIPAA 45 C.F.R. § 164.310(a)(1) Facility Access Controls “Implement policies and procedures to physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.” HIPAA 45 C.F.R. § 164.310(a)(2)(i) Contingency Operations (Addressable) “Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.” 45 C.F.R. § 164.310(a)(2)(ii) Facility Security Plan (Addressable) “Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.”
HITECH § 13402(h) Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals NIST Special Publication Guide to Storage Encryption Technologies for End User Devices. Encryption standards for ePHI at rest HITECH § 13402(h) Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals NIST Special Publications Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800– 77, Guide to IPsec VPNs; or 800–113, Guide to SSL VPNs Encryption standards for ePHI in transmission
HIPAA 45 C.F.R. § 164.514(d)(3) Minimum Necessary Requirements For research purposes, a Covered Entity may rely on “documentation or representations that comply with the applicable requirements of [45 CFR] § 164.512(i)” to establish the minimum necessary PHI HIPAA 45 C.F.R. § 164.514(e)(1) Limited Data Sets “A covered entity may use or disclose a limited data set . . . if the covered entity enters into a data use agreement with the limited data set recipient” HIPAA 45 C.F.R. § 164.514(e)(2) Limited Data Sets Limited data set excludes most identifiers, does allow dates, identification codes HIPAA 45 C.F.R. § 164.514(e)(3) Permitted Uses and Disclosures of Limited Data Sets Includes research 45 C.F.R. § 164.514(e)(4) Limited Data Set Agreements Use or disclosure of limited data sets requires limited data set with mandatory provisions
HITECH § 13405(d)(1) Prohibition on Sale of Electronic Health Records or Protected Health Information “A covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual . . . a valid authorization that includes . . . a specification of whether the PHI can be further exchanged for remuneration by the entity receiving PHI of that individual” HITECH § 13405(d)(2)(B) Exception for Research Not applicable if “the purpose of the exchange is for research [as defined under HIPAA] and the price charged reflects the costs of preparation and transmittal of the data for such purpose” HITECH § Exception for Treatment Not applicable if “the purpose of the exchange is for the treatment of the individual, subject to any regulation that [OCR] may promulgate to prevent protected health information from inappropriate access, use, or disclosure”