Hot answers tagged

56

You haven't actually provided enough details to say one way or the other. The fact that you didn't see an authentication prompt doesn't preclude there from being one. The remote access tools I use in my job (which also deals with HIPAA) both require me to authenticate with my domain admin credentials and do not prompt users to accept the connection, ...


28

HIPAA does not get to specifics of policy, the substance of it is that organization have to have sufficient controls in place to protect data. There's nothing inherently wrong with an unprompted takeover from a HIPAA perspective, as long as other controls (authentication, authorization, access control lists, access logging and auditing, antimalware on the ...


10

HIPPA isn't a certification, it is a set of regulations for proper handling of personal health information. The requirements vary based on what your role is and what data you handle. I would recommend visiting the Health Information Privacy section of the Health & Human Services site for more info. It also might not hurt to hire someone to evaluate ...


9

The Health Insurance Portability and Accountability Act better known as HIPAA, has been called to live by the government to protect patient's private information. HIPAA is aimed at healthcare professionals and staff who have access to patient information. HIPAA certification is a certification designed by private firms accompanied by training and testing. ...


8

Disclaimer: My company makes a HIPAA-compliant iPod application. I'm responsible for the compliance... The iPhone actually meets many HIPAA requirements out of the box. Once a passcode is set on the device, the contents are encrypted -- which takes care of many HIPAA requirements, notably encryption at rest. For downloading the data, you must use a TLS ...


6

I had a similar issue in the past. Security is a rapidly-changing field, and it's easy for small companies to convince themselves they don't need to worry about security breaches. (and well...if you don't stay up to date with security information, it's easy to remain ignorant!) As an American company, HIPAA is a great source for information on security and ...


5

Most legislation and regulations will not prescribe specific time frames for preserving logs. For example the National Archives Records Control Schedules (RCS) vary according to the document type and are adjustable by agency mission and organic legislation. If you can't find better, the FEDERAL RCS are an authoritative basis for specifying retention time ...


5

An ordinary website, such as one advertising office hours, contact information and related media should be fine, so long as it is completely separate from the HIPAA-compliant network & systems that serve the doctor's office. This also means that you cannot use this webserver for any remote-access services (ie: VPN portal), regardless of the fact that ...


5

You probably want to look at two classes of products: Data Leakage Protection (DLP) and intrusion detection systems (IDS). To detect ePHI on a system, you are more or less going to be checking for some common things based upon patterns. For example, in your EMR if you identify patients using a 10 digit code that starts with 4 letters followed by 6 numbers, ...


5

I would ask for exactly what you've suggested you expect to see. An audit report would be ideal, a compliance policy listing the controls that are in place would be minimally sufficient. If it's something that you consider to be significantly important to your business, then make it a requirement for them to provide this documentation before you can ...


5

If you're using CloudBerry backup, enable the client-side encryption so that the files are encrypted before they reach Amazon S3. Encrypted Data outside of HIPAA scope You do not need a Business Associate Agreement (BAA) if you are sending encrypted data to a third party provider. Note this encryption must be done with FIPS 140-2 compliant ciphers such as ...


5

Yes, an HTML based report can be HIPAA compliant. The format in which the report is presented has no significant consequence to compliance. The behavior of the system that is generating the report is what you should be focusing on.


4

...falls under HIPAA's domain? If you're dealing with PHI then the answer is probably yes. Check out this page from the US Government Department of Health & Human Services Security Rule Guidance Material for some more information. are there guidelines I need to follow in the application design - the browser component? The back end I am confident is ...


4

Assuming the subject of each event is medical, you're essentially mapping real names (which are considered identifying information, i.e. part of PII) to a medical subject that is likely relevant to their personal health issues. As such, I'd almost certainly say that you're falling into HIPAA territory, and should get everything checked out by a lawyer and ...


4

HIPAA doesn't specifically prohibit shared infrastructure. If you are going to be a neutral firm offering SaaS to numerous practices, this architecture will be fine. Ensure that your logical security is top notch such that no client can access data for any other client. This is fairly easy, but needs to be a deliberate, documented and demonstrable process....


4

As Schroeder has mentioned there are a few security standards and frameworks which can be used. One thing you absolutely are REQUIRED to comply with by LAW in the U.S. (I see you live in New York) is HIPAA. Aside from that the ISO 27001 can provide you with a certification that you have a controlled security organization. There are different bodies that ...


4

It depends on a number of factors. Because the Medical Record Number (MRN) is Protected Healthcare Information (PHI), you are responsible for its Confidentiality, Integrity, and Availability and are responsible to identify and protect against reasonably anticipated threats to its security (and integrity) AND against reasonably anticipated impermissible ...


4

Yes, full-disk encryption using AES-256 would be considered HIPAA compliant encryption. It is so because it is a FIPS 140-2 compliant cipher, and data encrypted with FIPS 140-2 cipers is considered "encrypted" under the HIPAA Security Rule. As to whether this qualifies as good enough for "data at rest," that is up to your organization's interpretation of ...


4

Yes, they can - but not only due to name and DOB. Those alone only constitute personally identifiable information (PII). However, combined with a unique identifier that can be used to link to health information, the data set could be classified as protected health information (PHI). For example, if the proprietary ID is a primary key that links tables in a ...


3

SOX has a 7-year requirement. This SANS Whitepaper (2010) might not be authoritative, but it highlights the matrix of best-practices between various requirements.


3

HIPAA compliance is a little more complicated. There are minimum security standards with regards to configuration in the network, systems and physical security domains which must be met before your organization may be certified "HIPAA Compliant". There are too many to list here, but to give you an idea, here's a few line items. On the network side, such ...


3

So, according to the HHS security guidelines, a username and password combination is a sufficient mechanism for authenticating an individual. However... Storing user passwords in plaintext in a config file is not usually a recommended design pattern. Certainly not a list of every individual user allowed to access the database along with their plaintext ...


3

Here's the answer to the technical part of the question. As for the legal bit, well... here's the technical bit: All three services are encrypted, but there's some concern about the scope of that encryption: Client-only encryption: Me Provider You +-------+ +----------+ +-------+ | Plain |========| Plain |=======|...


3

SQL Server itself provides a number of compliance tools that you can take advantage of to secure and audit your database and data. There's a Compliance page on the SQL Server site and Microsoft has written a Compliance whitepaper that will get you started. Additionally, there are huge number of third-party auditing packages available for SQL Server. A ...


3

Have you tried a Google search or logging into hhs.gov? They even have a handy checklists.


3

There is at least one Exchange compatible Android client that stores the enterprise information in a separate encrypted file and wipes only that file when a device wipe request is issued by Exchange. The down side was I do recall it being something like $50 a seat. Presumably there are similar options for iPhone. The ability to remote wipe their data is ...


3

Physically, it isn't difficult to make them read at a greater distance - get a decent antenna and power level and you can make it work. Some people locators in offices do this - not for access control, but for logging as you pass through doorways. There is a very good reason why this is not done for access control - it presents a couple of considerable ...


3

I am sure there is... Question is if it is that important you invest in the big $$'s I am sure such software would cost - which I know the cost of HIPAA violations here in the US, are you sure you would feel it is reliable? Seriously? Think about it... PHI is not just terms, it is the association of terms, and other terms. It is also specific types of terms (...


3

Do we need to encrypt MySQL database in order to keep HIPAA compliance? Depending on how the entire system is built, it may not be required, but I hope that you do encrypt it. First you need to identify what PHI (Protected health information) resides in your system and how it may travel through your system. Unless your clients already de-identified or ...


Only top voted, non community-wiki answers of a minimum length are eligible