IntroductionHIPAA was enacted in 1996. The “Security Rule” of Title II of the act describes security safeguards. The safeguards are categorized as:
- Administrative safeguards
- Physical safeguards
- Technical safeguards
Within the cybersecurity space, organizations are required to protect the availability, integrity and confidentiality of electronic forms of protected health information [PHI]. PHI on paper is also protected by HIPAA but in our cybersecurity space, we should concern ourselves with PHI in electronic form.
With an understanding of the CyberSecurity Framework and security measures, we are better fit to understand what to do about HIPAA for cybersecurity.
It is important to note that compliance to HIPAA requires other information technology measures. For instance, the “Transaction and Code Sets Rule” describes how data should be exchanged between different organizations. Furthermore, the Privacy Rule of HIPAA describes how PHI should be handled and these requirements may impact your information technology operations. These topics, however, will not be discussed in this article.
The Security Rule will be the focus of this article.
Where To Get Security Rule of Title II of HIPAAThe US Department of Health and Human Services website is here:
http://www.hhs.gov/ocr/privacy/index.htmlThe final Security Rule (Feb. 20, 2003) is available here:
http://www.cms.hhs.gov/securitystandard/downloads/securityfinalrule.pdfPlease refer to “Subpart C – Security Standards for the Protection of Electronic Protected Health Information” of the document.
HIPAA’s Sensitive InformationThe Security Rule applies to “covered entities” including health care plans, clearinghouses, and some providers.
HIPAA requires the following 18 types of sensitive patient data (From: Title 45 Code of Federal Regulations 164.514(b)(2)(i)
http://aspe.hhs.gov/admnsimp/final/pvctxt01.htm):
(A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code; and ...
HIPAA’s Security Rule’s Standards PrimerThis section helps you understand the thrust of the standards of the Security Rule. Examples of “standard” include “Security Management Process” and “Access Control”. Standards fall into three categories of safeguards: administrative, physical, and technical. Under each standard are implementation specifications – a high level “what to do” guide for each standard.
There are two types of implementation specifications: required and addressable. “Required” implementation specifications are required. “Addressable” implementation specifications allow organizations to use alternate implementations to achieve the security standard. Some implementation specifications might not be applicable to some organizations. In this case, the organization does not have to implement the measures, but it must document its decision to not implement them. Please review the finalized rule for details.
This section explains each standard using concepts in parts 1 and 2 of this book, so that they are more easily understood.
1. Administrative SafeguardsSecurity Management ProcessThis overarching standard requires that your organization must identify how availability, integrity, and confidentiality of PHI can be compromised and take security measures to reduce the likelihood of compromise. Discipline people if you have to.
Assigned Security ResponsibilityThe organization must clearly designate the person who is responsible for its security program. Assigning clear responsibility assures that the job gets done.
Workforce SecurityMake sure the right internal people have access to PHI. Remove access when people should no longer have access to PHI. Access management should be ongoing.
Information Access ManagementMake sure that you continue to provide the right access to internal/external applications and external users. Access management should be ongoing.
Security Awareness and TrainingEncourage security awareness among your internal users with reminders and training. Training should include measures to protecting against evil software, detecting irregularities in last login data, and using strong passwords. Security can be enhanced through the participation of internal users.
Security Incident ProceduresHave a process and organization in place so that the organization can respond to security incidents. Keep records of the history.
Contingency PlanHave ongoing processes to backup data. Have a reaction plan including recovery plans and interim operation plan in place for occasions when availability is compromised. Make sure the plan actually works. You want to avoid discovering that there’s a glitch in the recovery program when you actually have to recover data.
EvaluationAdjust security measures to protect PHI as circumstances change. The security program should be ongoing.
Business Associate Contracts and Other ArrangementGet documented assurances from business associates that they will safeguard shared PHI. Organizations should not ignore how shared PHI is being handled by business associates.
2. Physical SafeguardsFacility Access ControlsOnly allow the right people with the right physical access during normal operations and during special operations. During special operations such as disaster recovery, people who are not allowed physical access during normal operation may need to enter the facility. Keep track of who goes in and out.
Workstation UseUnderstand and define what role each workstation or type of workstation should be allowed to take with respect to PHI. If a workstation has a specific role, then you can monitor the workstation to verify that the workstation is not doing stuff it shouldn’t be doing.
Workstation SecurityProtect workstations in the physical space so only the right people access PHI.
Device and Media ControlsEnsure that PHI on devices and media do not escape. Protect against the physical theft of data.
3. Technical SafeguardsAccess ControlOnly allow the right people to have accounts that access PHI. Do not share accounts. Accounts that are left with a user logged on should be automatically closed and the user logged off.
Audit ControlsMake sure that your system is operating in the manner expected.
IntegrityProtect against unauthorized changes to data. Make sure that the PHI data being access is the right data.
Person or Entity AuthenticationMake sure the right people and organizations are accessing PHI.
Transmission SecurityEnsure integrity of PHI is preserved when transmitted. Encrypt transmissions of PHI when eavesdropping is enough of a risk.
PrioritizationThe Security Rule does not prioritize the safeguards.
A possible approach to prioritizing the implementation of these safeguards is to identify where the highest risk of compromise is and implement security measures that effectively reduce the risk and are easy to implement.
If you have no physical protection of your sensitive assets, implement barriers to your equipment room. If it’s been a very long time since you’ve checked whether the right internal people have the right access rights to PHI, update your access control assignments. Worry about making this an ongoing process later. If there are no measures to ensure that only the right external users and applications are accessing PHI, then erect network-based and host-based barriers to block unauthorized outsiders.
ConclusionIt’s important to look at the actual standard itself to understand its details and history. This article serves as a primer. Reviewing parts 1 and 2 of this book will help you understand the context of the Security Rule’s implementation specifications and get more concrete ideas of the security measures you should implement.
Next Article:Article 23: Other Compliance Standards: SOX and NERCGo to: Table of Contents
