After a few days unable to make time to post to the blog, or technical difficulties preventing me when I did make time, I’m happy to resume my posting!
Today I want to offer a few thoughts about the breach notice rules that were released last week by the HHS and the FTC in compliance with the HITECH Act requirements…
Posts Tagged ‘policies and procedures’
HIPAA/HITECH Breach Notice Rule: Applies To PHI of Deceased Individuals + Training A Key Element
Monday, August 24th, 2009Hidden Privacy & Security Risks of Web 2.0
Monday, August 10th, 2009There’s been a lot in the news lately about “Web 2.0” security and privacy problems. A lot of folks, though, don’t know what that term really means. Do your personnel know what it means? Probably not. This is certainly understandable since Web 2.0 really is a reference to many different things. The common link is that Web 2.0 represents what is considered to be the “second generation” of Internet activities and tools…
You Need These Things When You Get HIPAA Audited!
Friday, August 7th, 2009I get a bit irritated when I see a vendor touting their “compliance solution” products as making organizations “HIPAA Compliant” or “PCI DSS Compliant” or whatever your regulation of choice happens to be, and then, upon inspection of their products, see that they are just taking something they already had, slapping some marketing language into the description, picking a few of the regulatory requirements that their product may do (fully or partially) and then calling it a “compliance solution.”
OCR Adding To Staff For Increased HIPAA Compliance Enforcement Activities
Wednesday, August 5th, 2009Monday the HHS announced they were moving responsibility for both HIPAA Security Rule and Privacy Rule under the OCR.
That same day they also announced they were expanding the HIPAA “privacy enforcement team.” (Scroll down on this page to see the full verbiage of the announcement.)
HIPAA Enforcement Will Improve With OCR Responsible for Both Privacy Rule & Security Rule
Monday, August 3rd, 2009Today the US Department of Health and Human Services (HHS) announced that the OCR will now be responsible for both the HIPAA Privacy Rule and the Security Rule.
Perhaps this is an indicator of more enforcement to come. As a quick review…
(Lack Of) Encryption Is A Basis For Notification Under The HITECH Act
Friday, July 31st, 2009This week one of my tweeps asked me the following: “What’s your interpretation of encryption obligations for PHI data-at-rest under HITECH? Many parties are sweating this now.” Great question!
Is This A Breach Under The HITECH Act Definition?
Monday, July 27th, 2009This week I want to take a closer look at some of the issues and requirements within the HITECH Act, which dramatically expands the reach and requirements under the U.S. Health Insurance Portability and Accountability Act (HIPAA)…
New MO Breach Notice Law: Encryption Safe Harbor? Yes. Encryption Def Good? No!
Wednesday, July 22nd, 2009On July 9, 2009 the Missouri governor signed House Bill No. 62 into law, and it included section 407.1500, which is the requirement for giving privacy breach notice.
Since I’m focusing this week on encryption laws, I want to take a moment and point out the horrible way in which encryption is defined within this new Missouri law..
Has Massachusetts Encryption Law Stopped It’s Evolution?
Monday, July 20th, 2009This week I want to take a look at encryption laws. Only a few short years ago no law or regulation really had explicit encryption requirements. HIPAA, passed in 1996 with effective compliance deadline requirements in 2003 (Privacy Rule) and 2005 (Security Rule) included withint the Security Rule that encryption was “addressable” based upon the results of risk assessment.
However, encryption became a more hotly debated topic with the more recent Massachusetts and Nevada laws that explicitly require organizations to encrypt personally identifiable information (PII). Now the question of whether or not the Massachusetts law will indeed be enforced upon the current compliance date of January 1, 2010 is once more in the news…
What is PII? How About “Publicly Available” Info?
Thursday, July 16th, 2009There is much debate about what specific types of items should be considered as personally identifiable information (PII). A common topic of debate is; if information can be found publicly does that mean it is not PII?
