Archive for October, 2009

CEs and BAs: Be HIPAA/HITECH Compliant Or Pay A Hefty Penalty

Thursday, October 29th, 2009

The HHS released HITECH Act Enforcement Interim Final Rule today…


Smart Grid Privacy: Laws and Implications

Wednesday, October 21st, 2009

I was recently asked several questions about my work with the NIST Smart Grid privacy group and associated issues. Here are a couple of those questions, and my answers to them…


6 Critical Factors for Effective Information Security & Privacy Policies

Wednesday, October 14th, 2009

I’ve been feeling bad about not posting to my blog as often as I have historically…


Who Are Your Business Associates?

Thursday, October 8th, 2009

Since just before HIPAA went actively into effect I’ve done a lot of HIPAA compliance work for covered entities (CEs). In the past few years I’ve done around 200 business associate (BA) information security and program reviews for just one CE, and these don’t even scratch the surface for how many BAs each CE has…


HIPAA/HITECH Etc. Retention: Does Your Reality = Your Requirements?

Tuesday, October 6th, 2009

Last month I had the great pleasure of being a guest on Scott Draughon and Anyck Turgeon’s radio show for a segment entitled, “Is encryption enough to achieve privacy?”
I was pleasantly surprised to see a large number of great follow-up questions following the show!
I covered one of them in my post, “Don’t Throw Your Privacy Out The Window; Know How Your PII Is Used” Here are a couple more of those many questions I want to answer in this post…


Proposed HIPAA Privacy Rule Change Explicitly Makes Genetic Info PHI

Friday, October 2nd, 2009

An important element of data protection compliance is knowing, identifying and inventorying the applicable information…