The Department of Health and Human Services (HHS) issued their interim final rule for breach notification standards on August 19. Federal Trade Commission (FTC) issued their final rule of breach notification standards on August 17. The HHS rule covers all healthcare covered entities (CEs) and business associates (BAs). The FTC rule covers all personal health record (PHR) vendors and their service providers…
Archive for August, 2009
I received a very interesting question yesterday, and I wanted to share it and my response here because it is a great HIPAA topic to discuss that I have not seen written about before. I’ve removed the identifying information, and modified the situation details enough so that this cannot be tied to the actual situation…
I’ve had some technical difficulties with my blog site over the past few weeks. I just noticed that all the comments from June 26 through to around the second week of August were lost!
I’m very sad; there were some great comments, insights and links provided within the. To those of you whose comments disappeared, my sincere apologies! I miss being able to see and reference them.
After a few days unable to make time to post to the blog, or technical difficulties preventing me when I did make time, I’m happy to resume my posting!
Today I want to offer a few thoughts about the breach notice rules that were released last week by the HHS and the FTC in compliance with the HITECH Act requirements…
My blog hosting service was down from last Thursday through Monday, so I wasn’t able to post to the blog during that time.
Now my blog service is back, but I’ve been consumed with MSIA teaching, HIPAA/HITECH and PCI work the past few days…plan to get back to regular posting soon! Sorry for what has been my longest blog break ever.
I’m in Houston this week giving my class “Security and Privacy: Trends, Tools and Techniques.”
There’s been a lot in the news lately about “Web 2.0” security and privacy problems. A lot of folks, though, don’t know what that term really means. Do your personnel know what it means? Probably not. This is certainly understandable since Web 2.0 really is a reference to many different things. The common link is that Web 2.0 represents what is considered to be the “second generation” of Internet activities and tools…
I get a bit irritated when I see a vendor touting their “compliance solution” products as making organizations “HIPAA Compliant” or “PCI DSS Compliant” or whatever your regulation of choice happens to be, and then, upon inspection of their products, see that they are just taking something they already had, slapping some marketing language into the description, picking a few of the regulatory requirements that their product may do (fully or partially) and then calling it a “compliance solution.”
Monday the HHS announced they were moving responsibility for both HIPAA Security Rule and Privacy Rule under the OCR.
That same day they also announced they were expanding the HIPAA “privacy enforcement team.” (Scroll down on this page to see the full verbiage of the announcement.)