Front cover image for Guide to HIPAA security and the law

Guide to HIPAA security and the law

Stephen S. Wu, American Bar Association
Print Book, English, ©2007
View all formats and editions
ABA Section of Science & Technology Law, [Chicago], ©2007
xviii, 324 pages ; 23 cm
9781590317488, 1590317483
145431819
Computer Security legislation & jurisprudence
Confidential communications
Confidentiality
Data protection Law and legislation
Data protection Law and legislation United States
Dossiers médicaux Accès Contrôle États-Unis
Dossiers médicaux États-Unis Sécurité Mesures
Health Insurance Portability and Accountability Act of 1996 (United States)
Insurance, Health legislation & jurisprudence
Medical Records legislation & jurisprudence
Medical records Access control
Medical records Access control United States
Medical records Law and legislation
Medical records Law and legislation United States
Medical records Security measures United States
Secret professionnel
Security Measures
United States
Prefacexi
About the Editorxv
About the Contributorsxvii
Introduction
1(4)
Kathryn Coburn
Background and History of HIPAA
5(4)
Steven Fleisher
HIPAA Privacy and Security
9(4)
Francoise Gilbert
Relationship Among HIPAA, the Privacy Rule, and the Security Rule
9(1)
HIPAA Statutory Requirement for Security
10(2)
Security Requirements in the Privacy Rule
12(1)
Scope and Applicability of the Security Rule
13(12)
John Christiansen
Scope of Information Protected Under the Security Rule
13(3)
Entities Regulated by the Security Rule
16(9)
Business Associates and Business Associate Contracts; Governmental Interagency Arrangements
18(2)
Health Plan Sponsors
20(1)
Hybrid Entities and Health Care Components
21(1)
Affiliated Covered Entities
22(1)
Organized Health Care Arrangements
23(2)
The Security Rule
25(70)
Mike Jerbic
Stephen Wu
General Rules
25(2)
Administrative Safeguards---Section 164.308
27(35)
Security Management Process (Standard)---Section 164.308(a)(1)(i)
29(1)
Risk Analysis (Required)---Section 164.308(a)(1)(ii)(A)
29(5)
Risk Management (Required)---Section 164.308(a)(1)(ii)(B)
34(2)
Sanction Policy (Required)---Section 164.308(a)(1)(ii)(C)
36(1)
Information System Activity Review (Required)---Section 164.308(a)(1)(ii)(D)
36(1)
Assigned Security Responsibility (Standard)---Section 164.308(a)(2)
37(1)
Workforce Security (Standard)---Section 164.308(a)(3)(i)
38(1)
Authorization and/or Supervision (Addressable)---Section 164.308(a)(3)(ii)(A)
38(1)
Workforce Clearance Procedure (Addressable)---Section 164.308(a)(3)(ii)(B)
39(1)
Termination Procedures (Addressable)---Section 164.308(a)(3)(ii)(C)
40(1)
Information Access Management (Standard)---Section 164.308(a)(4)(i)
41(1)
Isolating Health Care Clearinghouse Functions (Required)---Section 164.308(a)(4)(ii)(A)
41(1)
Access Authorization (Addressable)---Section 164.308(a)(4)(ii)(B)
42(1)
Access Establishment and Modification (Addressable)---Section 164.308(a)(4)(ii)(C)
43(1)
Security Awareness and Training (Standard)---Section 164.308(a)(5)(i)
44(1)
Security Reminders (Addressable)---Section 164.308(a)(5)(ii)(A)
44(1)
Protection from Malicious Software (Addressable)---Section 164.308(a)(5)(ii)(B)
45(1)
Log-in Monitoring (Addressable)---Section 164.308(a)(5)(ii)(C)
46(1)
Password Management (Addressable)---Section 164.308(a)(5)(ii)(D)
46(1)
Security Incident Procedures and Responses---Section 164.308(a)(6)
47(1)
Security Incident Procedures (Standard)---Section 164.308(a)(6)(i)
47(2)
Response and Reporting (Required)---Section 164.308(a)(6)(ii)
49(1)
Contingency Plan (Standard)---Section 164.308(a)(7)(i)
50(1)
Data Backup Plan (Required)---Section 164.308(a)(7)(ii)(A)
51(1)
Disaster Recovery Plan (Required)---Section 164.308(a)(7)(ii)(B)
52(1)
Emergency Mode Operation Plan (Required)---Section 164.308(a)(7)(ii)(C)
52(2)
Testing and Revision Procedures (Addressable)---Section 164.308(a)(7)(ii)(D)
54(1)
Applications and Data Criticality Analysis (Addressable)---Section 164.308(a)(7)(ii)(E)
55(1)
Evaluation (Standard)---Section 164.308(a)(8)
55(3)
Imposing Security Requirements on Business Associates---Section 164.308(b)
58(1)
Business Associate Contracts and Other Arrangements (Standard)---Section 164.308(b)(1)
58(1)
Exceptions to the Business Associate Standard---Section 164.308(b)(2)
59(1)
Violations of the Standard---Section 164.308(b)(3)
60(1)
Implementation Specifications: Written Contract or Other Arrangement (Required)---Section 164.308(b)(4)
60(1)
Conclusion Regarding Administrative Safeguards
61(1)
Physical Safeguards---Section 164.310
62(14)
Facility Access---Section 164.310(a)
63(1)
Facility Access Controls (Standard)---Section 164.310(a)(1)
63(3)
Facility Access Controls Implementation Specifications---Section 164.310(a)(2)
66(1)
Contingency Operations (Addressable)---Section 164.310(a)(2)(i)
66(1)
Facility Security Planning (Addressable)---Section 164.310(a)(2)(ii)
67(1)
Access Control and Validation (Addressable)---Section 164.310(a)(2)(iii)
68(1)
Maintenance Records (Addressable)---Section 164.310(a)(2)(iv)
69(1)
Workstation Use (Standard)---Section 164.310(b)
70(1)
Workstation Security (Standard)---Section 164.310(c)
71(1)
Device and Media Controls---Section 164.310(d)
72(1)
Device and Media Controls (Standard)---Section 164.310(d)(1)
72(1)
Device and Media Controls Implementation Specifications---Section 164.310(d)(2)
73(1)
Disposal (Required)---Section 164.310(d)(2)(i)
73(1)
Media Re-Use (Required)---Section 164.310(d)(2)(ii)
74(1)
Accountability (Addressable)---Section 164.310(d)(2)(iii)
74(1)
Data backup and storage (Addressable)---Section 164.310(d)(2)(iv)
75(1)
Conclusion Regarding Physical Safeguards
75(1)
Technical Safeguards---Section 164.312
76(13)
Access Control Safeguards---Section 164.312(a)
77(1)
Access Control (Standard)---Section 164.312(a)(1)
77(2)
Access Control Implementation Specifications---Section 164.312(a)(2)
79(1)
Unique User Identification (Required)---Section 164.312(a)(2)(i)
79(1)
Emergency Access Procedure (Required)---Section 164.312(a)(2)(ii)
79(1)
Automatic log-off (Addressable)---Section 164.312(a)(2)(iii)
80(1)
Encryption and Decryption (Addressable)---Section 164.312(a)(2)(iv)
80(1)
Audit Controls (Standard)---Section 164.312(b)
81(1)
Integrity
81(1)
Integrity (Standard)---Section 164.312(c)(1)
81(2)
Implementation Specification: Mechanism to Authenticate Electronic Protected Health Information (Addressable)---Section 164.312(c)(2)
83(1)
Person or Entity Authentication (Standard)---Section 164.312(d)
83(3)
Transmission Security---Section 164.312(e)
86(1)
Transmission Security (Standard)---Section 164.312(e)(1)
86(1)
Transmission Security Implementation Specifications---Section 164.312(e)(2)
87(1)
Integrity Controls (Addressable)---Section 164.312(e)(2)(i)
87(1)
Encryption (Addressable)---Section 164.312(e)(2)(ii)
87(1)
Conclusion Regarding Technical Safeguards
88(1)
Policies, procedures, and documentation---Section 164.316
89(6)
Policies and Procedures (Standard)---Section 164.316(a)
89(2)
Documentation---Section 164.316(b)
91(1)
Documentation (Standard)---Section 164.316(b)(1)
91(1)
Documentation Implementation Specifications---Section 164.316(b)(2)
92(3)
Implementation
95(6)
Steven Fleisher
Stephen Wu
The Process of Implementing the Security Rule
95(1)
The State of Compliance
96(5)
Enforcement
101(26)
Francoise Gilbert
No Cumulative Civil and Criminal Penalties
102(1)
Civil Violations
102(2)
Criminal Violations
104(3)
Private Right of Action
107(1)
Final Rule for the Imposition of Civil Money Penalties
108(19)
Regulatory Background
109(1)
Development of the Final Enforcement Rule
109(2)
Comparing the Final Enforcement Rule with Prior Drafts
111(1)
Detailed Review of the Final Enforcement Rule
111(1)
Applicability
111(1)
HHS Oversight
111(1)
Investigations and Compliance Review under the Enforcement Rule
112(1)
Investigational Subpoenas
113(1)
Request for Documents
113(1)
Affirmative Defenses
114(1)
Secretarial Action Regarding Complaints and Compliance Reviews
115(1)
Notice of Proposed Determination
116(1)
Failure to Request a Hearing
116(1)
Hearing before Administrative Law Judge
117(1)
Response to Notice
117(1)
Discovery
117(1)
Hearing and Decision
118(2)
Appeal of the Administrative Law Judge's Decision
120(2)
Civil Money Penalties
122(1)
Basis for Civil Money Penalties
122(1)
Amount of Civil Money Penalties
123(1)
Violation of an Identical Requirement or Prohibition
124(1)
Factors Considered in Determining the Amount of Civil Money Penalties
124(1)
Collection of the Penalty
125(1)
Waiver and Settlement
126(1)
Third-Party Notification
126(1)
Liability and Litigation
127(10)
Kathryn Coburn
Liability and Litigation Overview
127(6)
Risk Management
133(4)
Conclusion
137(2)
Stephen Wu
Appendix 1 HIPAA Administrative Simplification Provisions139(24)
Appendix 2 HIPAA Security and Privacy Regulations163(146)
Appendix 3 HIPAA Security Resources on the Internet309(4)
Index313
Table of contents