HIPAA Security Best Practices Clint Davies Principal BerryDunn

Slides:

Advertisements

Similar presentations

HIPAA Security Presentation to The American Hospital Association Dianne Faup Office of HIPAA Standards November 5, 2003.

Advertisements

Security Vulnerabilities and Conflicts of Interest in the Provider-Clearinghouse*-Payer Model Andy Podgurski and Bret Kiraly EECS Department & Sharona.

Chapter 10. Understand the importance of establishing a health care organization-wide security program. Identify significant threats—internal, external,

1 HIPAA Security Final Rule Overview April 9, 2003Karen Trudel.

Health Insurance Portability and Accountability Act (HIPAA)HIPAA.

HIPAA and the GLB Connections Between Congress and Information Assurance.

Where to start Ben Burton, JD, MBA, RHIA, CHP, CHC.

HIPAA Security Regulations Jean C. Hemphill Ballard Spahr Andrews & Ingersoll, LLP November 30, 2004.

HIPAA: FEDERAL REGULATIONS REGARDING PATIENT SECURITY.

Topics Rule Changes Skagit County, WA HIPAA Magic Bullet HIPAA Culture of Compliance Foundation to HIPAA Privacy and Security Compliance Security Officer.

HIPAA Security Risk Overview Lynne Shoemaker, RHIA, CHP, CHC OCHIN Integrity Officer Daniel M. Briley, CISSP, CIPP Summit Security Group.

Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq. 1.

1 HIPAA Privacy & Security Overview Know HIPAA Presents.

Health information security & compliance

1 HIT Standards Committee Privacy and Security Workgroup: Recommendations Dixie Baker, SAIC Steven Findlay, Consumers Union August 20, 2009.

© Copyright 2014 Saul Ewing LLP The Coalition for Academic Scientific Computation HIPAA Legal Framework and Breach Analysis Presented by: Bruce D. Armon,

HIPAA 203: Security An Introduction to the Draft HIPAA Security Regulations.

Security Controls – What Works

Beyond HIPAA, Protecting Data Key Points from the HIPAA Security Rule.

ELECTRONIC MEDICAL RECORDS By Group 5 members: Kinal Patel David A. Ronca Tolulope Oke.

CAMP Med Mapping HIPAA to the Middleware Layer Sandra Senti Biological Sciences Division University of Chicago C opyright Sandra Senti,

1 HIPAA Security Overview Centers for Medicare & Medicaid Services (CMS)

IT’S OFFICIAL: GOVERNMENT AUDITING OF SECURITY RULE COMPLIANCE Nancy Davis, MS, RHIA Director of Privacy/Security Officer, Ministry Health Care & Catherine.

Compliance: A Traditional Risk-Based Audit Approach GR-ISSA Lloyd Guyot, MCS GSEC Sarbanes-Oxley USA PATRIOT Act Gramm-Leach-Bliley … more November, 2005.

Information Security Technological Security Implementation and Privacy Protection.

HIPAA PRIVACY AND SECURITY AWARENESS.

“ Technology Working For People” Intro to HIPAA and Small Practice Implementation.

Copyright ©2011 by Pearson Education, Inc. Upper Saddle River, New Jersey All rights reserved. Health Information Technology and Management Richard.

Health Insurance Portability and Accountability Act of 1996 (HIPAA) Proposed Rule: Security and Electronic Signature Standards.

How Hospitals Protect Your Health Information. Your Health Information Privacy Rights You can ask to see or get a copy of your medical record and other.

HIPAA Compliance. What is it? The federal Health Insurance Portability and Accountability Act of Ensures the privacy rights of patients.

Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems Lecture a This material (Comp7_Unit7a) was developed by.

April 14, A Watershed Date in HIPAA Privacy Compliance: Where Should You Be in HIPAA Security Compliance and How to Get There… John Parmigiani National.

1 Guide to HIPAA Security HIPAA Security Step-By-Step: A Consensus of Experts Session 5.04 – 3/9/2004 Presented by: Robert Happy Grenert, GSEC Project.

Lesson 5-Legal Issues in Information Security. Overview U.S. criminal law. State laws. Laws of other countries. Issues with prosecution. Civil issues.

LeToia Crozier, Esq., CHC Vice President, Compliance & Regulatory Affairs Corey Wilson Director of Technical Services & Security Officer Interactive Think.

Eliza de Guzman HTM 520 Health Information Exchange.

Ali Pabrai, CISSP, CSCS ecfirst, chairman & ceo Preparing for a HIPAA Security Audit.

Design of Health Technologies lecture 22 John Canny 11/28/05.

Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems Lecture b This material (Comp7_Unit7b) was developed by.

The Culture of Healthcare Privacy, Confidentiality, and Security Lecture d This material (Comp2_Unit9d) was developed by Oregon Health and Science University,

Working with HIT Systems

Component 8/Unit 6aHealth IT Workforce Curriculum Version 1.0 Fall Installation and Maintenance of Health IT Systems Unit 6a System Security Procedures.

1 Security Planning (From a CISO’s perspective) by Todd Plesco 24OCT2007

The IT Vendor: HIPAA Security Savior for Smaller Health Plans?

Energize Your Workflow! ©2006 Merge eMed. All Rights Reserved User Group Meeting “Energize Your Workflow” May 7-9, Security.

In Depth Security Review Martin Rogers Computer Horizons Corp. © Copyright eB Networks All rights reserved. No part of this presentation may be reproduced,

HIPAA Security John Parmigiani Director HIPAA Compliance Services CTG HealthCare Solutions, Inc.

Working with HIT Systems Unit 7a Protecting Privacy, Security, and Confidentiality in HIT Systems This material was developed by Johns Hopkins University,

Case Study: Applying Authentication Technologies as Part of a HIPAA Compliance Strategy.

The Art of Information Security: A Strategy Brief Uday Ali Pabrai, CISSP, CHSS.

The Health Insurance Portability and Accountability Act of 1996 “HIPAA” Public Law

COMMUNITY-WIDE HEALTH INFORMATION EXCHANGE: HIPAA PRIVACY AND SECURITY ISSUES Ninth National HIPAA Summit September 14, 2004 Prepared by: Robert Belfort,

Installation and Maintenance of Health IT Systems System Security Procedures and Standards Lecture a This material Comp8_Unit6a was developed by Duke University,

© 2016 Health Information Management Technology: An Applied Approach Chapter 10 Data Security.

The Health Insurance Portability and Accountability Act

iSecurity Compliance with HIPAA

No audio. Recording preparation.

Paul T. Smith Davis Wright Tremaine LLP

Disability Services Agencies Briefing On HIPAA

Final HIPAA Security Rule

County HIPAA Review All Rights Reserved 2002.

Thursday, June 5 10: :45 AM Session 1.01 Tom Walsh, CISSP

HIPAA Privacy and Security Summit 2018 HIPAA Privacy Rule: Compliance Plans, Training, Internal Audits and Patient Rights Widener University Delaware.

HIPAA Security Standards Final Rule

HIPAA Compliance Services CTG HealthCare Solutions, Inc.

HIPAA Compliance Services CTG HealthCare Solutions, Inc.

Introduction to the PACS Security

Presentation transcript:

HIPAA Security Best Practices

Clint Davies Principal BerryDunn

Dan Vogt Senior Manager BerryDunn

Agenda Introductions HIPAA in the News Overview of the HIPAA Security Rule Risk Assessment Approach Top Issues Challenging IT Security Questions and Answers

HIPAA in the News 2 2

Source:

Cost of a Data Breach Source: Verizon 2015 Data Breach Investigations Report

Background Health Insurance Portability and Accountability Act (HIPAA) Established in 1996 Privacy and Security Rules ARRA (2009) Omnibus Rule (2013)

Security Rule The Security Rule is structured by: Implementation Specifications Standards Safeguard

Security Rule Safeguards are organized into: Administrative Safeguards Physical Safeguards Technical Safeguards Implementation Specifications are either: Required Addressable

Administrative Safeguards StandardImplementation SpecificationR/A Security Management Process Risk AnalysisR Risk ManagementR Sanction PolicyR Information System Activity ReviewR Assign Security Responsibility R Workforce Security Authorization and/or SupervisionA Workforce Clearance ProcedureA Termination ProceduresA

Administrative Safeguards (cont.) StandardImplementation SpecificationR/A Information Access Management Isolating Health Care Clearinghouse Functions R Access AuthorizationA Access Establishment and ModificationA Security Awareness and Training Security RemindersA Protection from Malicious SoftwareA Log-in MonitoringA Password ManagementA Security Incident Procedures Response and ReportingR

Administrative Safeguards (cont.) StandardImplementation SpecificationR/A Contingency Plan Data Backup PlanR Disaster Recovery PlanR Emergency Mode Operation PlanR Testing and Revision ProceduresA Application and Data Criticality AnalysisA EvaluationR Business Associate Contracts and Other Arrangements Written Contract or Other ArrangementR

StandardImplementation SpecificationR/A Facility Access Controls Contingency OperationsA Facility Security PlanA Access Control and Validation ProceduresA Maintenance RecordsA Workstation UseR Workstation SecurityR Device and Media Controls DisposalR Media Re-UseR AccountabilityA Data Backup and StorageA Physical Safeguards

Technical Safeguards StandardImplementation SpecificationR/A Access Control Unique User IdentificationR Emergency Access ProcedureR Automatic LogoffA Encryption and DecryptionA Audit ControlsR IntegrityMechanism to Authenticate Electronic PHIA Person or Entity Authentication R Transmission Security Integrity ControlsA EncryptionA

All about assessing the risks!

18 Likelihood and Impact

THE RISK ASSESSMENT PROCESS

Putting this to practical use – the Top 10 IT Security Control Risks and what you can do

#10 Segregation of Duties

#9 Finding and Maintaining Qualified Security Personnel

#8 Lack of Management Support

#7 IT Diplomatic Immunity

#6 Data on User Owned Mobile Devices

#5 Lack of Encryption

#4 Outdated Operating Systems

#3 Technology Innovations That Outpace Security

#2 Inadequate System Logging

#1 Overreliance on Security Monitoring Software

QUESTIONS?

Clint Davies Dan Vogt