Key Issues in HIPPA Security Compliance Management
Wednesday, November 25, 2009 at 03:18PM A 360 Degree Approach to HIPAA Compliance
An effective approach to meeting HIPAA security compliance requirements begins with a security management solution - one that enables real-time monitoring, compliance reporting and control management. Technology alone however, is not the answer. The best route to compliance is a 360 degree approach that integrates existing people, processes, and policies with technology. The foundation of a compliance solution for all healthcare organizations is an enterprise-class Security Information Management (SIM) solution.
Seven Critical HIPAA Initiatives
1. Policy
Define a policy-driven security management program that can be incorporated early on into business processes - Identify the people and technology controls needed to satisfy an organization's security mission and ensure HIPAA compliance. Also, ensure that security initiatives are integrated into business processes at their onset, rather than after the fact.
2. Security Controls
Validate security controls - Provide for the monitoring and reporting of controls on human actions and decisions, process controls, and information technology controls.
3. Risk Management
Implement a risk management approach to information security - Comprise active monitoring of risk as defined and measured by key control indicators (KCIs) and key risk indicators (KRIs), correlating the relative value of information assets, the threats to the confidentiality, integrity, and availability of the assets, and the vulnerability of the systems and architecture that store and carry the assets.
4. Due Diligence
Demonstrate due diligence in the application of internal controls - Create a link between the security infrastructure and policy by capturing all security events from all network hosts, devices, and assets in an auditable database.
5. Incident Management
Develop and implement an effective security-incident management process - Demonstrate that the proper steps were taken to correct systems and adjust policy if a non-compliant situation is identified.
6. Reporting
Enable reporting that can help demonstrate compliance - Demonstrate the ongoing security of compliance-related assets over a period of time, recreating the organization's security posture if needed to obtain HIPAA certification, and enabling security performance management against metrics that can be leveraged for corporate governance initiatives.
7. Preserving Data
Establish capabilities for archiving and preserving data - Preserve near-term and long-term data in its purest form for forensics and evidentiary presentation. By leveraging SIM to implement effective, comprehensive policies and procedures for establishing accountability and consistent reporting practices, healthcare organizations can successfully meet HIPAA regulatory compliance directives.
Example: Security Information Management and HIPAA Compliance
Wheaton Franciscan Healthcare a nonprofit healthcare organization based in Wheaton, Illinois needed to enhance their visibility into network security and improve reporting capabilities to enable HIPAA compliance. The organization size created enormous challenges.
With 17 hospitals and more than 70 clinics in Colorado, Illinois, Iowa, and Wisconsin, the initiative involved nearly100 security devices, including firewalls, intrusion protection systems, virtual private network concentrators, and authentication services..The organization manually reviewed many of its security devices, though some were unmanageable due to the enormous volume of event log data. Wheaton turned to a leading Security Information Management solution to bring its security initiatives under control.
Wheaton was able to reduce its monitoring workload and minimize downtime by leveraging this solution to react more quickly to threats. With improved visibility into the network and the ability to assess its risk posture at any given point in time, Wheaton raised security and reporting to the level required for HIPAA compliance.
Katherine Janiszewski plays a crucial role as Marketing Manager of netForensics. Founded in 1999, netForensics is based on a culture of excellence and innovation. Their team of leading experts understands the ever-evolving security threat and compliance needs of today's organizations, including HIPAA Compliance. For more information, visit netForensics.com.
Article Source: http://EzineArticles.com/?expert=Katherine_Janiszewski
NOTICE - This article is the opinion of the author or reports the news and opinions of others and is NOT INTENDED TO OFFER ADVICE. This story/article/feature may be an opinion piece — and should be treated accordingly — or reporting on the opinions of others, and should never be considered as a sole source of information or as a suggestion, instruction or prescription. For crime stories, always read the word "allegedly" in any story mentioning "suspects" or "persons of interest". For money/trade and exchange stories, this magazine and its writers accept no responsibility for accuracy — always check with other sources for important decisions. In the case of food/health stories, these facts have not been evaluated by the United States Food and Drug Administration (FDA). Information stated here should be NOT be considered as medical, health, psychological or behavior advice. All information in this story and on this site is provided for educational or entertainment purposes ONLY. Always seek the advice of experts, including doctors for medical opinions. Only a licensed medical doctor can offer medical advice. Legal advice or other expert advice is best referred to experts in their respective fields. The publishers and editors, authors, researchers, employees, heirs and assigns accept no responsibility whatsoever for any advice, facts, opinions in this story, nor for resulting actions of readers of this information. ALL READERS ACCEPT THAT THIS INFORMATION IS PRESENTED ONLY AS EDUCATION, ENTERTAINMENT OR OPINION/INFORMATION AND AGREE IN READING THIS STORY OR THIS SITE THAT USE OF THIS INFORMATION IS SOLELY THE RESPONSIBILITY OF THE READER. Copyright by the author unless otherwise indicated. EXCERPTS from other magazines or media sources are posted under fair use doctrine, on the basis of no more than 5-10% of content with links and credit to source for the complete story. These are posted in the interest of providing interesting links (description as excerpt) with navigation to the source. Likewise, we encourage our many subscribers to excerpt with credit and links to our e-zines, up to 10% of content. To use more content than 10%, please contact the e-zine for permission. ALL RIGHTS RESERVED except as stipulated herein.
Persona Corp. and Blogertize publishes several e-zines for entertainment and information, but cautions readers to read the NOTICE above:
• Advance Magazine
* Secure Network News
Sponsored Advertisers
Jameson Bank – Canada's "It's Taken Care Of" Bank
Amer.com – Technology for Life
View Printer Friendly Version
Email Article to Friend
Reader Comments