Healthcare Information Privacy and Security

Develop Solutions
Chapter 3: Assembling the Team
You will need to bring all of the right people to the table. No security program can exist without the support of key stakeholders and users - from executives to administrators. Once your team is assembled, and you know what you are dealing with, you can begin the work of implementing solutions. This chapter helps you assemble a crack team and ensure each person is in the right job.
Chapter 4: Sifting Through the Wreckage - The Security Audit
Quite often, in an effort to comply with regulations, a single person is charged with the task of “implementing a privacy and security program” in the enterprise. This is a good start since someone needs to take charge of the issues at hand, but without an accurate picture of current processes, it is virtually impossible to correct deficiencies. This chapter steps you through the audit procedure so you know exactly where you and your organization stand.
Chapter 5: Reviewing Policies and Developing a Plan
Once you know what you are facing, and who is on your team, you can begin the task of identifying a broad plan to address the problems. Knowing what level of risk your organization is willing to accept, what sort of funding you can expect, and what kind of human and IT resources are at your disposal, will be essential to the process of developing a realistic plan of attack. This chapter helps you assess risk, budget realities, and your other resources to start working on your plan.
Part III: Sustainable Solutions
Chapter 6: Identity and Access Management
At the core of every security concern in the healthcare world is the question, “Who is accessing the data that we need to protect?” The most basic way to assure the integrity of access is to develop an identity and access management system (this can be automated, or as simple as a spreadsheet). Role-Based Access Control (RBAC) is the preferred method of controlling access in the enterprise. Without the most basic controls in place to assure that you know who is in your system, many other aspects of security are irrelevant. This chapter explains the identify and access system and how to implement one customized for your situation.
Chapter 7: Application Design
Assigning access to a “role” in the organization is only meaningful insofar as the application is designed appropriately. A cardinal rule in the HIPAA Privacy Rule from 1996 is the “Minimum Necessary Requirement.” (45 CFR 164.502(b), 164.514(d) While it might be simplest to deploy an EHR system broadly, where everything is accessible to all (and only used based on job function), the Minimum Necessary rule precludes broadly designed access as a viable option. This chapter explains how to design a system that reflects the law’s intent.
Chapter 9: Physical and Environmental Safeguards
The security of patient data is paramount, and sometimes software solutions to security concerns are the right answer. However, safeguards of patient data in a clinical environment can include environmental considerations including physical isolation and proximity badge access. This chapter covers current safeguarding practice and technology.
Chapter 10: Systemwide and Client Based Security Configuration
How your system behaves, and protects patient data, can be managed with settings that control the behavior of the computers and devices in your organization. Factoring all of these system settings into your security plan will ensure that you utilize all controls at your disposal, and help to assure that you don’t neglect a setting that creates a vulnerability that you did not know existed. This chapter provides an overview of systemwide security and how your plan can ensure the results you seek.
Chapter 11: Safeguarding Patient Data from Prying Eyes
The most basic task you must undertake in the process of safeguarding patient data is ensuring that the right people are looking at the right data for the right reasons. If you don’t consider all of the locations where your patient data resides, then your larger plan of data protection might not be as effective as you think it is. This chapter is all about how you can safeguard patient data.
Chapter 12: People - the Most Crucial Element in a Successful Security Program
With all of the technical safeguards in place, an organization can still be vulnerable to security risks if the people using the system are not properly educated and audited. Know your user base, and control for user-based risks with a proper educational program. This chapter shows how to keep your people in check while training them and auditing their practices going forward.
Part IV: From Project to Program - Transitioning to a Sustainable Support Model
Chapter 13: Security Project v. Operational Support
It is tempting to think that working through a laundry list of items to address will lead to a secure environment, but it is essential that a transition to operational support includes checks on the systems and processes implemented during your security project. A regular review of new regulations, changes in your environment, and the use of new technology is necessary if you want to ensure that the work of securing your organization is viable in the long-term. This chapter shows how to build awareness of changes (including new or enhanced regulations) into your governance and policy practices.
Chapter 14: Putting the Plan in Place - Ongoing Maintenance and Policy Updates
Now that you are armed with all of the tools that you need to begin putting a security program in place, how do you start? The answer will be different for each organization because each organization is different. What is important is making a plan, and implementing it to the extent that you are able. This chapte. The Evolution of a Monsterr is about the rubber meeting the road: Putting your plan into action and keeping it working as you intended.