1.  Group: GTR ver M  Grace Chen  Taru Singhal  Robert Szymanek  Michael Parker

2.  Identify the Problem  Compliance/Risk  Storage Options  Transmission Options  Feasibility Analysis  Final Recommendation

3.  Deficiencies in the process of storage/backup ◦ Is the current data stored? ◦ Is there a secure backup currently performed? ◦ Is current data encrypted? ◦ Currently how is data archived?  Deficiencies in the process of transmission ◦ What is the best way to transmit data? ◦ What Is the best encryption ◦ Is E-mail safe? ftp/sftp?

4.  Social Security numbers  Home addresses and telephone numbers  Personal and family health history  Bank accounts and credit card numbers

5.  The HIPAA Privacy Rule applies to: ◦ Health plans ◦ Healthcare clearinghouses, part of an HIO ◦ Healthcare providers that conduct covered transactions  Healthcare Information Organization (HIO) performs certain functions or activities which require access to PHI  Healthcare clearinghouses collect data such as PHI and data-mine them

6.  Federal Penalties ◦ The U.S. Department of Health & Human Services has the authority to impose penalties of $100 to $50,000 or more per violation.  Criminal Penalties ◦ The U.S. Department of Justice has the right to fine organizations and individuals who intentionally violate standards. The penalties range from $50,000 to $250,000, with various jail sentence lengths, depending on the offense.

7.  Encrypt data on servers and email  Restrict use of file sharing applications and portable devices  Provide protection against malware and attacks  Use comprehensive security policies  Log data points for compliance audits

8. Storage of Protected Health Information Opt 1: Data Center/Iron Mountain Opt 2: Citrix Solution/Iron Mountain

9.  SAN/Servers - $160,000  Cisco - $24,000  VMware/Failover - $26,000  Applications (VeriSign, sftp) - $10,500  Contractors - $9,400  Total - $229,900

10.  Citrix Access Gateway protects data using standards-based encryption technologies (SSL/TLS).  Secure remote access.  Leading SSL VPN performance and scalability.  Protect intellectual property with corporate policies.  Lets users work from anywhere.

11. Data Center (1,000 users) - $229,900  Same expense as for both solutions.

12.  Rapid recovery  Extremely high security  Reduce risk of server data loss and downtime  Continuous backup  Protection of open files and databases  Flexible retention periods  Access when and where you want it  http://www.ironmountain.com/health-information/health-server- backup.html http://www.ironmountain.com/health-information/health-server- backup.html

13.  $2.15 per GB per month  HIPAA Retention Period is 7 years 1 TB2 TB2.5 TB3 TB Price/GB $ 2.15 Price/Mo $ 2,150.00 $ 4,300.00 $ 5,375.00 $ 6,450.00 Price/Yr $ 25,800.00 $ 51,600.00 $ 64,500.00 $ 77,400.00 Extended (3 yr) $ 77,400.00 $ 154,800.00 $ 193,500.00 $ 232,200.00 Operating expense, non-capital

14. Transmission of Protected Health Information

15.  Secure FTP can be used as a technical mechanism, protecting data in motion within a distributed healthcare system.  Secure Shell password controls file access.  Secure Shell encryption controls confidentiality of the information.  Server Event logs facilitates a security audit.

16.  The primary rule within HIPAA that affects e-mail is the Security Rule.  Many encryption technologies require the user to become familiar with the use of plug-ins and other specialized “client-side” encryption software  Another issue faced by organizations is a lack of technological standards  The solution to each of these issues is to move the encryption responsibility from the individual user to a specialized server.

17.  The team is ready to implement a multi- layered system using the Data Center storage and Iron Mountain  Secure transmission using secure ftp and secure email for transmission of Protected Health Information.  Provision sufficient resources to implement a Citrix solution when needed, plan for FY 2012 or FY 2013.

18.  New Deployments (No teardown) ◦ Storage/backup ◦ Secure Email ◦ Secure FTP  Maintenance Considerations for IT staff ◦ Ensuring complete backups (Iron Mountain) ◦ Enforcing Data Center SLA standards ◦ Checking secure local storage ◦ Maintaining VeriSign certificates for email and FTP  Processes invisible to end users!

19.  Iron Mountain (2.5 TB) - $193,500  Iron Mountain is an annual operating expense at $64,500/year  Operating costs affect Income Statement  Data Center (Infrastructure required) - $229,900  A capital expense at depreciates at $45,980/year over 5 years  Capital expenses affect the Balance Sheet  Maintenance approx 10% of purchase price, capitalized  Total - $412,900

20. Thank You Questions?