Health Insurance Portability and Accountability Act of 1996 (HIPAA) Proposed Rule: Security and Electronic Signature Standards

Introduction The proposed rule gives information security guidance that governs the storage, maintenance, and transmission of patient information. Guidance applies to health plans, health care clearinghouses, and health care providers. Guidance also addresses requirements for electronic signature standards. The proposed rule gives information security guidance that governs the storage, maintenance, and transmission of patient information. Guidance applies to health plans, health care clearinghouses, and health care providers. Guidance also addresses requirements for electronic signature standards.

Scope “Health Information”-- any info that: (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school, university, or health care clearinghouse, and (2) relates to the past, present, or future physical or mental health or condition of an individual, to the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

Scope Covered electronic transmissions include those using all media, including magnetic tape, disk, compact disk, Internet, Extranet, private networks, and leased or dial-up lines. Telephone voice response and faxback (request for info made via voice using a fax machine and requesting that the info be returned via that same fax machine) are not covered under this rule.

ADMINISTRATIVE PROCEDURES TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY 1.Certification. 2.Chain of trust partner agreement. 3.Contingency plan (all listed implementation features must be implemented). 4.Formal mechanism for processing records. 1.Certification. 2.Chain of trust partner agreement. 3.Contingency plan (all listed implementation features must be implemented). 4.Formal mechanism for processing records. Applications and data criticality analysis. Data backup plan. Disaster recovery plan. Emergency mode operation plan. Testing and revision. Applications and data criticality analysis. Data backup plan. Disaster recovery plan. Emergency mode operation plan. Testing and revision. Requirement Implementation

ADMINISTRATIVE PROCEDURES TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY - Continued 5. Information access control (all listed implementation features must be implemented). 6.Internal audit. 7.Personnel security (all listed implementation features must be implemented). 5. Information access control (all listed implementation features must be implemented). 6.Internal audit. 7.Personnel security (all listed implementation features must be implemented). Access authorization. Access establishment. Access modification. Assure supervision of maintenance personnel by authorized, knowledgeable person. Maintenance of record of access authorizations. Operating, and in some cases, maintenance personnel have proper access authorization. Personnel clearance procedure. Personnel security policy/procedure. System users, including maintenance personnel, trained in security. Access authorization. Access establishment. Access modification. Assure supervision of maintenance personnel by authorized, knowledgeable person. Maintenance of record of access authorizations. Operating, and in some cases, maintenance personnel have proper access authorization. Personnel clearance procedure. Personnel security policy/procedure. System users, including maintenance personnel, trained in security. Requirement Implementation

ADMINISTRATIVE PROCEDURES TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY - Continued 8.Security configuration mgmt. (all listed implementation features must be implemented). 9.Security incident procedures (all listed implementation features must be implemented). 8.Security configuration mgmt. (all listed implementation features must be implemented). 9.Security incident procedures (all listed implementation features must be implemented). Documentation. Hardware/software installation & maintenance review and testing for security features. Inventory. Security Testing. Virus checking. Report procedures. Response procedures. Documentation. Hardware/software installation & maintenance review and testing for security features. Inventory. Security Testing. Virus checking. Report procedures. Response procedures. Requirement Implementation

ADMINISTRATIVE PROCEDURES TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY - Continued 10. Security management process (all listed implementation features must be implemented). 11. Termination procedures (all listed implementation features must be implemented). 10. Security management process (all listed implementation features must be implemented). 11. Termination procedures (all listed implementation features must be implemented). Risk analysis. Risk management. Sanction policy. Security policy. Combination locks changed. Removal from access lists. Removal of user account(s). Turn in keys, token or cards that allow access. Risk analysis. Risk management. Sanction policy. Security policy. Combination locks changed. Removal from access lists. Removal of user account(s). Turn in keys, token or cards that allow access. Requirement Implementation

ADMINISTRATIVE PROCEDURES TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY - Continued 12. Training (all listed implementation features must be implemented). 12. Training (all listed implementation features must be implemented). Awareness training for all personnel (including mgmt). Periodic security reminders. User education concerning virus protection. User education to importance of monitoring log in success/failure, and how to report discrepancies. User education in password management. Awareness training for all personnel (including mgmt). Periodic security reminders. User education concerning virus protection. User education to importance of monitoring log in success/failure, and how to report discrepancies. User education in password management. Requirement Implementation

PHYSICAL SAFEGUARDS TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY 1.Assigned security responsibility. 2.Media controls (all listed implementation features must be implemented). 1.Assigned security responsibility. 2.Media controls (all listed implementation features must be implemented). Access control. Accountability (tracking mechanism). Data backup. Data storage. Disposal. Access control. Accountability (tracking mechanism). Data backup. Data storage. Disposal. Requirement Implementation

PHYSICAL SAFEGUARDS TO GUARD DATA INTEGRITY, CONFIDENTIALITY, AND AVAILABILITY - Continued 3.Physical access control (limited access) (all listed implementation features must be implemented). 4.Policy/guideline on work station use. 3.Physical access control (limited access) (all listed implementation features must be implemented). 4.Policy/guideline on work station use. Disaster recovery. Emergency mode operation. Equipment control (into and out of site). Facility security plan. Procedures for verifying access authorizations prior to physical access. Maintenance records. Need-to-know procedures for personnel access. Sign-in for visitors and escort, if appropriate. Testing and revision. Secure work station location. Security awareness training. Disaster recovery. Emergency mode operation. Equipment control (into and out of site). Facility security plan. Procedures for verifying access authorizations prior to physical access. Maintenance records. Need-to-know procedures for personnel access. Sign-in for visitors and escort, if appropriate. Testing and revision. Secure work station location. Security awareness training. Requirement Implementation

TECHNICAL SECURITY SERVICES TO GUARD DATA INTEGRITY CONFIDENTIALITY, AND AVAILABILITY 1.Access control (The following implementation feature must be implemented: Procedure for emergency access. In addition, at least one of the following three implementation features must be implemented: Context-based access, Roll-based access, User- based access. The use of Encryption is optional). 2.Audit controls. 3.Authorization Control (At least one of the listed implementation features must be implemented). 1.Access control (The following implementation feature must be implemented: Procedure for emergency access. In addition, at least one of the following three implementation features must be implemented: Context-based access, Roll-based access, User- based access. The use of Encryption is optional). 2.Audit controls. 3.Authorization Control (At least one of the listed implementation features must be implemented). Context-based access. Encryption. Procedure for emergency access. Role-based access. User-based access. Role-based access. User-based access. Context-based access. Encryption. Procedure for emergency access. Role-based access. User-based access. Role-based access. User-based access. Requirement Implementation

TECHNICAL SECURITY SERVICES TO GUARD DATA INTEGRITY CONFIDENTIALITY, AND AVAILABILITY - Continued 4.Data Authentication. 5.Entity Authentication (The following implementation features must be implemented: Automatic logoff, Unique user identification. In addition, at least one of the other listed implementation features must be implemented). 4.Data Authentication. 5.Entity Authentication (The following implementation features must be implemented: Automatic logoff, Unique user identification. In addition, at least one of the other listed implementation features must be implemented). Automatic logoff. Biometric. Password. PIN. Telephone callback. Token. Unique user identification. Automatic logoff. Biometric. Password. PIN. Telephone callback. Token. Unique user identification. Requirement Implementation

TECHNICAL SECURITY MECHANISMS TO GUARD AGAINST UNAUTHORIZED ACCESS TO DATA THAT IS TRANSMITTED OVER A COMMUNICATIONS NETWORK Communications/network controls (The following implementation features must be implemented: Integrity controls, Message authentication. If communications or networking is employed, one of the following implementation features must be implemented: Access controls, Encryption. In addition, if using a network, the following four implementation features must be implemented: Alarm, Audit trial, Entity authentication, Event reporting). Communications/network controls (The following implementation features must be implemented: Integrity controls, Message authentication. If communications or networking is employed, one of the following implementation features must be implemented: Access controls, Encryption. In addition, if using a network, the following four implementation features must be implemented: Alarm, Audit trial, Entity authentication, Event reporting). Access controls. Alarm. Audit trail. Encryption. Entity authentication. Event reporting. Integrity controls. Message authentication. Access controls. Alarm. Audit trail. Encryption. Entity authentication. Event reporting. Integrity controls. Message authentication. Requirement Implementation

ELECTRONIC SIGNATURE Digital signature (if digital signature is employed, the following three implementation features must be implemented: Message integrity. Non-repudiation, User authentication. Other implementation features are optional). Digital signature (if digital signature is employed, the following three implementation features must be implemented: Message integrity. Non-repudiation, User authentication. Other implementation features are optional). Ability to add attributes. Continuity of signature capability. Counter signatures. Independent verifiability. Interoperability. Message integrity. Multiple Signatures. Non-repudiation. Transportability. User authentication. Ability to add attributes. Continuity of signature capability. Counter signatures. Independent verifiability. Interoperability. Message integrity. Multiple Signatures. Non-repudiation. Transportability. User authentication. Requirement Implementation

Compliance Deadline April 2003 (The rule became effective on April 14, 2001). April 2003 (The rule became effective on April 14, 2001).