The Barking Seal

HITECH business associate deadlines looming

10Feb
Author: ben Categories: IT Management, Security Comments: 0
We wrote about the HITECH act and its impact on business associates a little less than a year ago. By February 18, business associates are required to:
- Comply with the HIPAA security and privacy rules
- Provide medical information breach notifications
- Work with the Department of Health and Human Services to perform compliance audits as requested
- Train employees on HIPAA and its requirements for business associates
BAs, I hope you’re taking note. Violations can incur fines for as much as $1.5 million per year and, in the most serious circumstances, may include prison time. According to HITECH, DHHS audits are also mandatory beginning 2/18/2010. (See sections 13410 and 13411).

Most of the associates that I’m familiar with haven’t made many changes in the past year to improve HIPAA compliance. So what should any self-respecting business associate, now subject to these somewhat draconian and certainly expensive rules, do to avert heavy fines and lost productivity? Avoid becoming a business associate at all costs.

First, re-evaluate whether the business truly qualifies as an associate, for one. In the past, BAAs had very few directly applicable requirements, and those that were in place were rarely or never audited and enforced. Businesses should no longer haphazardly sign BAAs when they aren’t strictly necessary.

If the business has determined that they are indeed an associate, what can be changed to eliminate that status? If there isn’t a dire business need for access to medical records, but they’re being collected incidentally, eliminate that dependency and escape the compliance game. Of course, most health care organizations don’t freely distribute health records, and most organizations don’t want them unless they need them.

If the business is resigned to being an associate subject to HIPAA courtesy of HITECH, it’s time to get to work. Start at www.hipaasurvivalguide.com, an excellent resource for learning the regulation and applying its teachings.

And never forget the old proverb (that I’m making up right now): more regulation always improves security. Emphasis added.
Tags: Compliance series, HIPAA, regulations, Security
Compliance Series: PCI Data Security Standard

28May
Author: ben Categories: IT Management, Security Comments: 1

I’ll kick off my much-delayed series on compliance and regulation with the Payment Card Industry’s Data Security Standard. This highly visible, widely applicable standard applies to any company that processes credit card data. Importantly, the standard was developed by the industry rather than congress. This is in direct contrast to many other industries (such as health care and finance) that are regulated by the federal government.

The standard consists of 12 requirements, each with a number of sub-requirements, ranging from firewall configuration to security policy to ongoing vigilance. There are four tiers of merchants, and slightly different requirements apply depending on the tier. Read on for details and tips.

Read more »

Tags: Compliance series, regulations, Security
Compliance in Information Security (Series Introduction)

22Jan
Author: ben Categories: IT Management, Security Comments: 0

I have a love/hate relationship with standards and regulations. On the one hand, they pay my bills, and I like having my bills paid. Without them, infosec would be mostly ignored, especially in large enterprises, and that’s not good for anyone. Our personal data would constantly be at risk without oversight or hope for improvement.

On the flip side, despite the existence nine meaty, enforceable regulations that I plan to blog about in this series, we still have large scale compromises on a regular basis. Compliance costs billions of dollars to organizations of all shapes and sizes, and to what end? A single large-scale breach that affects tens or hundreds of millions of individuals, such as the recent Heartland breach, can undo most of that effort. Furthermore, many of the regulations are impractical, vague, or not enforced.

In the end, however, I agree with Bruce Schneier who says that “more important than the specific list of countermeasures is a process of continual security improvement.” I’ll support any effort that protects my privacy and yours.

So, without further adieu, I present a list of ten regulations that those of us in information security have come to know and love.

Read more »

Tags: Compliance series, regulations, standards