HIPAA Security Final Rule Overview for HIPAA Summit West June 5, 2003Karen Trudel

Publication Information  Printed in Federal Register 2/20/03  Compliance Date 4/21/05 (4/21/06 for Small Health Plans)  Document can be located at

Purpose  Ensure integrity, confidentiality and availability of electronic protected health information  Protect against reasonably anticipated threats or hazards, and improper use or disclosure

Scope  All electronic protected health information (EPHI) –NOT oral and paper PHI  In motion AND at rest  All covered entities

Security Standards General Concepts  Flexible, Scalable –Permits standards to be interpreted and implemented appropriately from the smallest provider to the largest plan  Comprehensive –Cover all aspects of security – behavioral as well as technical  Technology Neutral –Can utilize future technology advances in this fast- changing field

Recent WEDI Policy Advisory Group  Assessed need to request changes/guidance  Result: a few clarifications needed; outreach needed  Clarifications: –Relief from burdensome security incident reporting requirement –Clarify status of NIST Guidance documents  Consensus was to preserve flexibility by not requesting official guidance

Implementation Process  Reminiscent of Y2K  Phases: –Education –Assessment –Remediation –Testing/Validation

Assessment Phase Critical  Standard: Security Management Process –Risk Analysis – What are the various risks? How severe? How likely? –Risk Management – What solutions best reduce risk to an acceptable level  Remember: No such thing as absolute security

Where to Start?  Leverage progress made in privacy implementation –Identified PHI –Identified business associates  Build on “mini-security rule” in privacy

What Next?  Add on issues related to integrity and availability  Brings into play requirements like disaster recovery

Filling the Gaps  Look at entire range of options  Assess –Relative risk –How well various options mitigate the risk –Cost  High tech high cost options aren’t necessarily safer

Example: Security Awareness Training  Could be done by various means: –Develop curriculum and send staff to formal classes –Develop web-based training –Take advantage of “teachable moments” New staff orientation Regular department meetings ed reminders Articles in company newsletter

Remember  Technology is not always the answer…many of the standards are administrative  Important to: –Make supportable decisions –Document those decisions –Revisit decisions periodically to assure they are still valid

Enforcement - General  Complaint driven  Penalties –$100 for each violation –Maximum of $25,000 per year for all violations of an identical requirement

Enforcement – Issues  Still studying – will be defined in Substantive Rule  NPRM scheduled for publication this winter  Issues include: –What is a “violation” and how are they counted –Are all standards weighed the same?

Conclusion  Concentrate on the assessment phase  Consider staging remediation –“low hanging fruit” –Areas of significant risk