I was recently asked several questions about my work with the NIST Smart Grid privacy group and associated issues. Here are a couple of those questions, and my answers to them…
Archive for the ‘Laws & Regulations’ Category
Smart Grid Privacy: Laws and Implications
Wednesday, October 21st, 2009Who Are Your Business Associates?
Thursday, October 8th, 2009Since just before HIPAA went actively into effect I’ve done a lot of HIPAA compliance work for covered entities (CEs). In the past few years I’ve done around 200 business associate (BA) information security and program reviews for just one CE, and these don’t even scratch the surface for how many BAs each CE has…
HIPAA/HITECH Etc. Retention: Does Your Reality = Your Requirements?
Tuesday, October 6th, 2009Last month I had the great pleasure of being a guest on Scott Draughon and Anyck Turgeon’s MyTechnologyLawyer.com radio show for a segment entitled, “Is encryption enough to achieve privacy?”
I was pleasantly surprised to see a large number of great follow-up questions following the show!
I covered one of them in my post, “Don’t Throw Your Privacy Out The Window; Know How Your PII Is Used” Here are a couple more of those many questions I want to answer in this post…
Proposed HIPAA Privacy Rule Change Explicitly Makes Genetic Info PHI
Friday, October 2nd, 2009An important element of data protection compliance is knowing, identifying and inventorying the applicable information…
Is Encryption Enough to Achieve Privacy?
Thursday, September 10th, 2009Of course the answer is no. But there are many reasons! Tune in this afternoon at 4:00pm Pacific time to hear Anyck Turgeon, Scott Draughon and me discuss this topic and talk about encryption laws and the impacts to privacy. Here is the information about the event…
HITECH Impacts Over 734,178 “Small Business” HIPAA Covered Entities
Wednesday, September 9th, 2009The Department of Health and Human Services (HHS) 45 CFR Parts 160 and 164: “Breach Notification for Unsecured Protected Health Information; Interim Final Rule” (Breach Notice Rule) has been written about a lot. But much of what is written overlooks some of the very interesting prologue within that document that is very important to consider to frame the context within which the regulation was written…
HITECH Act Virtual ToC
Friday, September 4th, 2009This was another very busy week, and I didn’t have a chance to post as much as I would have liked. Part of what kept me busy was an unusually increased amount of email…
HHS & FTC Breach Notice Rules: First Time NIST Standards Specifically Referenced
Monday, August 31st, 2009The Department of Health and Human Services (HHS) issued their interim final rule for breach notification standards on August 19. Federal Trade Commission (FTC) issued their final rule of breach notification standards on August 17. The HHS rule covers all healthcare covered entities (CEs) and business associates (BAs). The FTC rule covers all personal health record (PHR) vendors and their service providers…
Fired Because Photo of Surgery Room Was A “HIPAA Violation”
Friday, August 28th, 2009I received a very interesting question yesterday, and I wanted to share it and my response here because it is a great HIPAA topic to discuss that I have not seen written about before. I’ve removed the identifying information, and modified the situation details enough so that this cannot be tied to the actual situation…
HIPAA/HITECH Breach Notice Rule: Applies To PHI of Deceased Individuals + Training A Key Element
Monday, August 24th, 2009After a few days unable to make time to post to the blog, or technical difficulties preventing me when I did make time, I’m happy to resume my posting!
Today I want to offer a few thoughts about the breach notice rules that were released last week by the HHS and the FTC in compliance with the HITECH Act requirements…
