1. COMING TO THE HIPAA PARTY: TIPS FOR IT SUPERHEROES &
Schenck Price Smith & King, LLP
COMING TO THE HIPAA PARTY:
TIPS FOR IT SUPERHEROES &
COMPLIANCE TO COEXIST
Presented by:
Deborah A. Cmielewski, Esq.
March 2, 2016
© Schenck Price Smith & King, LLP

2. AGENDA Background: How did we get here? 2. The Security Rule C.F.R. § Where do we go from here?

3. SETTING THE STAGE
“…all the major healthcare data breaches of 2015 … were the result of the actions of hackers.”

4. HUMAN ERROR RESULTED IN BREACHES
Loss of devices
Equipment theft
Unauthorized disclosures
Improper disposal

5. RECENT ENFORCEMENT CONTINUES
Lahey
Triple-S
UWM
Lincare

8. “REQUIRED” vs. “ADDRESSABLE” SPECIFICATIONS
Required means you must do it
Addressable
Reasonable and appropriate
Must document decisions

9. 45 C.F.R. § 164.308 Administrative Safeguards
The Security Rule is flexible and scalable

11. SECURITY MANAGEMENT PROCESS (45 C.F.R. § 164.308(a)(1)(ii))
- Sanction Policy (R):
Apply appropriate sanctions for failure to comply
- IS Activity Review (R):
Regularly review records of IS activity

12. ID SECURITY OFFICIAL

13. WORKFORCE SECURITY (45 C.F.R. § 164.308(a)(3)(ii)
Authorization Supervision
Workforce Clearance
Termination Procedures

14. INFORMATION ACCESS MANAGEMENT (45 C.F.R. § 164.308(a)(4)(ii)
- Consistent with “minimum necessary”
- Role-based access

15. SECURITY AWARENESS AND TRAINING 45 C.F.R. § 164.308(a)(5)
- Training must be effective
- Often cited in regulatory actions

17. “Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.”

20. OCR CYBER-AWARENESS INITIATIVE

21. QUESTIONS?

22. Serving Our Clients And Community For Over 100 Years www. spsk
Serving Our Clients And Community For Over 100 Years Deborah A. Cmielewski, Esq. (973)