Scribd Logo
Upload

Welcome to Scribd!

  • 47 views

    HIPAA Overview: Controls Applicable To Our Organization

    Uploaded by

    Rupal Fadia
    This document provides an overview of HIPAA regulations regarding privacy and security controls. It discusses the administrative, physical, and technical safeguards required by HIPAA to protect electronic protected health information (ePHI). These include policies for access management, security incident response, workforce training, and encryption of data during transmission and storage. The document also notes that the HITECH Act expanded HIPAA rules by requiring security breach reporting and strengthening enforcement of privacy practices.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    HIPAA Overview: Controls Applicable To Our Organization

    Uploaded by

    Rupal Fadia
    47 views10 pages
    This document provides an overview of HIPAA regulations regarding privacy and security controls. It discusses the administrative, physical, and technical safeguards required by HIPAA to protect electronic protected health information (ePHI). These include policies for access management, security incident response, workforce training, and encryption of data during transmission and storage. The document also notes that the HITECH Act expanded HIPAA rules by requiring security breach reporting and strengthening enforcement of privacy practices.

    Original Description:

    HIPAA core

    Original Title

    HIPAA 1 0

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of HIPAA regulations regarding privacy and security controls. It discusses the administrative, physical, and technical safeguards required by HIPAA to protect electronic protected health information (ePHI). These include policies for access management, security incident response, workforce training, and encryption of data during transmission and storage. The document also notes that the HITECH Act expanded HIPAA rules by requiring security breach reporting and strengthening enforcement of privacy practices.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    47 views10 pages

    HIPAA Overview: Controls Applicable To Our Organization

    Uploaded by

    Rupal Fadia
    This document provides an overview of HIPAA regulations regarding privacy and security controls. It discusses the administrative, physical, and technical safeguards required by HIPAA to protect electronic protected health information (ePHI). These include policies for access management, security incident response, workforce training, and encryption of data during transmission and storage. The document also notes that the HITECH Act expanded HIPAA rules by requiring security breach reporting and strengthening enforcement of privacy practices.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 10

    HIPAA Overview

    Controls applicable to our organization


    Index

    # Contents Slide No.


    1 Introduction 3

    2 Security Vs Privacy 4
    3 Administrative Safeguards 5
    4 Physical Safeguards 6
    5 Technical Safeguards 7
    6 Incident Management 8
    7 HITECH Amendment 9

    Private & Confidential 2


    Introduction

    • HIPAA stands for Health Insurance Portability and Accountability Act, 1996

    • HIPAA defines policies, procedures and guidelines for maintaining the privacy and
    security of Health Information

    • HIPAA outlines the following security rules:


    o Administrative Safeguards
    o Physical Safeguards
    o Technical Safeguards

    • Appropriate safeguards for handling privacy and PHI

    Private & Confidential 3


    Security Vs Privacy

    • The word "security" should not be confused with "privacy.“

    • Security is to protect the privacy of electronic patient information

    • Information stored electronic media

    • Information transmitted through electronic means

    • Privacy covers the confidentiality of PHI in all formats. The physical


    security of PHI in all formats is an element

    Private & Confidential 4


    Administrative Safeguards

    • Designed to guard the confidentiality, integrity, and availability


    • 7 sections to the required administrative procedures
    • Assigned Security
    • Contingency Plan
    • Information Access Management
    • Training & Awareness
    • Security Management
    • Workforce Security
    • Security Incident Procedures

    Private & Confidential 5


    Physical Safeguards

    • Steps for ensuring information on computers is secure


    • Require log-ins
    • Protect IDs and passwords - never share them
    • Screensavers (recommended to be less than 5 minutes)
    • Log off the computer before leaving it unattended
    • Position computer monitors away from public areas to avoid observation
    by visitors
    • Hard drives are appropriately “cleansed” before de-commissioning or
    transfer

    Private & Confidential 6


    Technical Safeguards

    • Access Control
    o Limit access.
    o Unique user identification
    o Emergency access procedure
    o Automatic logoff
    o Encryption and decryption

    • Audit Controls
    o Defines this requirement as implement of hardware, software, and/or procedural mechanism that record
    and examine activity in information systems that contain or use.
    o Appears that flexibility does not extend to having no audit trail mechanisms at all

    • Integrity
    o Policies and procedures to protect e-PHI from improper alteration or destruction

    • Authentication and Transmission


    o e-PHI is not improperly modified without detection until disposed off
    o Mechanisms to encrypt e-PHI deemed appropriate

    * e-PHI stands for Electronic PHI

    Private & Confidential 7


    Incident Management

    • Any activity that harms the resources or can cause harm to the
    Organization and / or:
    o Unauthorized changes or access of PHI or ePHI
    o Criminal activity or natural disaster

    • Employees follow ‘in place’ Security Incident procedures and notify:


    o The respective supervisor / manager
    o The Compliancy Officer or designate
    o The Information Security if PHI is involved

    Private & Confidential 8


    HITECH Amendment

    • HITECH - Health Information Technology for Economical and Clinic Health Act

    • HITECH act expands HIPAA Privacy and Security Rules further to the
    Administrative, Physical and Technical Safeguards:
    o Policies and Documentation
    o New security breach reporting requirement
    o Privacy Requirements
     Health Information Exchange Organizations and Regional Health
    Information Organizations (HIEs and RHIOs)
     Criminal and Civil penalties: The act makes HIPAA’s criminal and civil
    penalties applicable to business associates
    o Security Breach reporting by covered entities (all associated individuals /
    entities / organizations /

    Private & Confidential 9


    CALIBER POINT BUSINESS SOLUTIONS LTD.
    Corporate Office:
    Building No. 3, Sector II, Millennium Business Park, “A” Block, Mahape,

    Thank you Navi Mumbai 400 710, INDIA


    Phone : +91 22 2778 3300
    Web : www.caliberpoint.com

    You might also like