HIPAA Overview

Controls applicable to our organization

Index

# Contents Slide No.

1 Introduction 3

2 Security Vs Privacy 4
3 Administrative Safeguards 5
4 Physical Safeguards 6
5 Technical Safeguards 7
6 Incident Management 8
7 HITECH Amendment 9

Private & Confidential 2

Introduction

• HIPAA stands for Health Insurance Portability and Accountability Act, 1996

• HIPAA defines policies, procedures and guidelines for maintaining the privacy and
security of Health Information

• HIPAA outlines the following security rules:

o Administrative Safeguards
o Physical Safeguards
o Technical Safeguards

• Appropriate safeguards for handling privacy and PHI

Private & Confidential 3

Security Vs Privacy

• The word "security" should not be confused with "privacy.“

• Security is to protect the privacy of electronic patient information

• Information stored electronic media

• Information transmitted through electronic means

• Privacy covers the confidentiality of PHI in all formats. The physical

security of PHI in all formats is an element

Private & Confidential 4

Administrative Safeguards

• Designed to guard the confidentiality, integrity, and availability

• 7 sections to the required administrative procedures
• Assigned Security
• Contingency Plan
• Information Access Management
• Training & Awareness
• Security Management
• Workforce Security
• Security Incident Procedures

Private & Confidential 5

Physical Safeguards

• Steps for ensuring information on computers is secure

• Require log-ins
• Protect IDs and passwords - never share them
• Screensavers (recommended to be less than 5 minutes)
• Log off the computer before leaving it unattended
• Position computer monitors away from public areas to avoid observation
by visitors
• Hard drives are appropriately “cleansed” before de-commissioning or
transfer

Private & Confidential 6

 Technical Safeguards

• Access Control
o Limit access.
o Unique user identification
o Emergency access procedure
o Automatic logoff
o Encryption and decryption

• Audit Controls
o Defines this requirement as implement of hardware, software, and/or procedural mechanism that record
and examine activity in information systems that contain or use.
o Appears that flexibility does not extend to having no audit trail mechanisms at all

• Integrity
o Policies and procedures to protect e-PHI from improper alteration or destruction

• Authentication and Transmission

o e-PHI is not improperly modified without detection until disposed off
o Mechanisms to encrypt e-PHI deemed appropriate

* e-PHI stands for Electronic PHI

Private & Confidential 7

Incident Management

• Any activity that harms the resources or can cause harm to the
Organization and / or:
o Unauthorized changes or access of PHI or ePHI
o Criminal activity or natural disaster

• Employees follow ‘in place’ Security Incident procedures and notify:

o The respective supervisor / manager
o The Compliancy Officer or designate
o The Information Security if PHI is involved

Private & Confidential 8

HITECH Amendment

• HITECH - Health Information Technology for Economical and Clinic Health Act

• HITECH act expands HIPAA Privacy and Security Rules further to the
Administrative, Physical and Technical Safeguards:
o Policies and Documentation
o New security breach reporting requirement
o Privacy Requirements
 Health Information Exchange Organizations and Regional Health
Information Organizations (HIEs and RHIOs)
 Criminal and Civil penalties: The act makes HIPAA’s criminal and civil
penalties applicable to business associates
o Security Breach reporting by covered entities (all associated individuals /
entities / organizations /

Private & Confidential 9

 CALIBER POINT BUSINESS SOLUTIONS LTD.
Corporate Office:
Building No. 3, Sector II, Millennium Business Park, “A” Block, Mahape,

Thank you Navi Mumbai 400 710, INDIA

Phone : +91 22 2778 3300
Web : www.caliberpoint.com