Chapter 4: HIPAA Security Rule Concepts

American Recovery and Reinvestment Act of 2009 (ARRA)

Federal legislation that included significant funding for health information technology and provided for significant changes to the HIPAA Privacy Rule

Self-encrypted hard drives

Hard drives that protect their own data through keys that reside on the drive itself.

A former employee is angry at the CE because he was terminated. He hacked into the EHR and destroyed ePHI. What type of threat is this?

Intentional

Access privilege is what allows an individual to enter a computer system for an authorized purpose. TRUE or FALSE?

TRUE

What does Security Rule require covered entities to do under Physical Safeguards?

To establish policies and procedures that will provide physical safeguards for ePHI

Audit trail

(1) A chronological set of computerized records that provides evidence of information system activity (log-ins and logouts, file accesses), used to determine security violations (2) A record that shows who has accessed a computer system, when it was accessed, and what operations were performed.

Contingency plan

(1) Documentation of the process for responding to a system emergency, including the performance of backups, the line-up of critical alternative facilities to facilitate continuity of operations, and the process of recovering from a disaster;(2) A recovery plan in the event of a power failure, disaster, or other emergency that limits or eliminates access to facilities and electronic protected personal health information (ePHI).

Cryptography

(1) The art of keeping data secret through the use of mathematical or logical functions that transform intelligible data into seemingly unintelligible data and back again (2) The study of encryption and decryption techniques

Authentication

(1) The process of identifying the source of health record entries by attaching a handwritten signature, the author's initials, or an electronic signature; (2) Proof of authorship that ensures, as much as possible, that log-ins and messages from a user originate from an authorized source

Integrity

(1) The state of being whole or unimpaired; (2) The ability of data to maintain its structure and attributes, including protection against modification or corruption during transmission, storage, or at rest. Maintenance of data integrity is a key aspect of data quality management and security.

What are the four implementation specifications for Facility Access Controls?

-Contingency Operations-Facility Security Plan-Access Control and Validation Procedures-Maintenance Records

The Security Rule requires covered entities to:

-Ensure confidentiality, integrity, and availability of all electronic PHI (ePHI) created, received, maintained, or transmitted -Protect against reasonably anticipated threats or hazards that might affect the security or integrity of ePHI -Protect against reasonably anticipated uses or disclosures of ePHI that is not permitted or required -Ensure workforce compliance

What are the two implementation specifications for Transmission Security?

-Integrity Controls-Encryption

The following list provides examples of noncompliance with the HIPAA Security Rule

-Leaving a sheet of paper containing PHI at the front desk which is visible to other -A computer screen that is unattended and logged in to PH -Knowingly releasing PHI to unauthorized individual-Selling PHI to marketing firms

What are the five categories of HIPAA Security Rule standards?

-Physical safeguards -Technical safeguards -Administrative safeguards -Organizational requirements -Policies and procedures and documentation requirements

HIPAA Security Rule

-Regulates maintenance and transmission of electronic protected health information (ePHI) rather than regulating all PHI (paper, electronic, oral) -Places greater emphasis on technology

Context-based access control (CBAC)

A access control system which limits users to accessing information not only in accordance with their identity and role, but to the location and time in which they are accessing the information.

AHIMA has a Disaster Planning and Recovery Toolkit that contains:

-Steps to draft a business continuity plan including communications, management, protecting health information, use and disclosure of health information, and recovery-Same contingency plan, staff competency list, immediate and short term concerns checklist, and sample emergency privilege application and release form

Transmission security

A HIPAA Security Rule technical safeguard that provides for measures to be taken to protect ePHI against unauthorized access during transmission via an electronic communications network.

Flexible

A characteristic of the HIPAA Security Rule that allows a covered entity (CE) to use any security measures that allow it to reasonably and appropriately implement the Security Rule's standards and implementation specifications.

Technology neutral

A characteristic of the HIPAA Security Rule that allows an organization to develop as their technological capabilities allow rather than requiring or prescribing certain technologies. specific technologies are not prescribed in the rules, which allows the use of the latest and appropriate technology

Audit log

A chronological record of electronic system(s) activities that enables the reconstruction, review, and examination of the sequence of events surrounding or leading to each event and/or transaction from its beginning to end. Includes who performed what event and when it occurred.

Risk managment

A comprehensive program of activities intended to minimize the potential for injuries to occur in a facility and to anticipate and respond to ensuring liabilities for those injuries that do occur. The processes in place to identify, evaluate, and control risk, defined as the organization's risk of accidental financial liability.

Workstation

A computer designed to accept data from multiple sources in order to assist in managing information for daily activities and to provide a convenient means of entering data desired by the user at the point of care.

"Break the glass"

A computer system capability that allows an individual who otherwise would not have access privileges to ePHI to access it through an alternative method in limited, necessary situations such as patient care emergencies.

Firewall

A computer system or a combination of systems that provides a security barrier or supports an access control policy between two networks or between a network and any other traffic outside the network.

Role-based access control (RBAC)

A control system in which access decisions are based on the roles of individual users as part of an organization.

Full disk encryption

A process that signifies all data on a disk is encrypted.

Person authentication

A process, required by the HIPAA Security Rule, that requires a person is who he is in order to prevent unauthorized users from accessing ePHI.

User-based access control (UBAC)

A security mechanism used to grant users of a system access based on identity

Technical safeguards

A set of five standards defined by the HIPAA Security Rule that can be implemented from a technical standpoint using computer software; access controls, audit controls, data integrity, person or entity authentication, and transmission security to protect ePHI.

Administrative safeguards

A set of nine standards defined by the HIPAA Security Rule. Administrative actions such as policies and procedures, documentation retention to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information.

HIPPA requires the covered entities to review their security rule standards and implementation specifications for each security safeguard and decide if it is required or__________ which allow an equivalent method to be used.

Addressable

Public key infrastructure is a less secure method of encryption because the key that decodes the information is transmitted with the data. True or False?

False

Public key infrastructure

Also called asymmetric encryption; uses two keys to encrypt and transmit a message; the sending computer uses a private key to code (scramble) the message and a public key is given to the receiving computer to decode (unscramble) the message.

Private key infrastructure (PKI)

Also called symmetric or single-key encryption, occurs where both the sending and receiving computers use software that assigns a secret code or key; this encryption is less secure that public key encryption because same key is transmitted with the data after the sending computer codes (scrambles) the data so the receiving computer can decode (unscramble) the data

The capture of data by a hospital's data security system that shows multiple invalid attempts to access the patients' database is an example of what type of security control? a. Audit log b. Access Control c. Auto-Authentication d. Override Function

Audit log

___ identifiers are based on physical characteristics such as retinas, fingertips, palms and face recognition

Biometric

Antivirus software packages

Computer programs that search for malicious software (malware) that can damage an information system; anti-virus software package prevent, detect or remove viruses.

Implementation specifications

Descriptions that define how HIPAA standards are to be implemented.

Metadata

Descriptive data that characterize other data to create a clearer understanding of their meaning and to achieve greater reliability and quality of information. Consist of both indexing terms and attributes. Data about data. Ex: Creation date, date sent, date received, last access date, last modification date.

What term is also used to denote the HIPAA requirement of Contingency Planning? a. Data Backup b. Data Recovery c. Disaster Planning d. Emergency Mode of Operation

Emergency Mode of Operation

Sharing log in information with another employee is an example of a security___________ and a virus introduced by a disgruntled employee would be considered a security___________

Event, incident

While a covered entity is legally responsible for their employees, they are not responsible for the actions of business visitors. TRUE or FALSE?

FALSE

Coding Professionals Working at Home:

Many coding professionals access protected health information from home. It is not unusual for organizations to perform a home office evaluation to ensure compliance with policies and procedures. Security measures such as eliminating the print function on a coder's computer and closely monitoring computer activity may be implemented to manage the risk of unauthorized disclosure of PHI.

Physical safeguards

Measures such as locking doors to safeguard data and various media from unauthorized access and exposures; a set of four standards defined by the HIPAA Security Rule including facility access, controls, workstation use, workstation security, and device and media controls.

A HIPAA Officer may also be called

Privacy Officer

Account lockout

Prohibited access to an electronic account after an established number of attempts have been made.

type of malicious software that prohibits access to the hospital own information system unless they pay money to gain access

Ransomware

Decryption

Restoration of scrambled or encoded data to meaningful, readable data.

Intrusion detection systems

Software that analyze network traffic, sending an alarm if they detect potentially inappropriate attempts to access a network or particular account; require human intervention to monitor alarms and determine their validity.

Intrusion prevention systems

Software that identify inappropriate electronic traffic and block its passage in a mechanism similar to a firewall; require human intervention to monitor alarms and determine their validity.

What does Organizational Requirements implement?

They implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of the covered entity.

Entity authentication

The corroboration that an entity is who it claims to be.

Addressable specifications

The implementation specifications of the HIPAA Security Rule that are designated "addressable" rather than "required;" to be in compliance with the Rule, the covered entity must implement the specification as written, implement an alternative, or document that the risk for which the addressable implementation specification was provided either does not exist in the organization, or exists with a negligible probability of occurrence.

Required specifications

The implementation specifications of the HIPAA Security Rule that are designated "required" rather than "addressable"; required standards must be present for the covered entity to be compliance.

Scalable

The measure of a system to grow relative to various measures of size, speed, number of users, volume of data, and so on. the concept that based on the size of the Covered Entity, the threshold of compliance varies

Audit controls

The mechanisms that record and examine activity in information systems.

differentiate public key infrastructure and private key infrastructure

The private key is used to both encrypt and decrypt the data. This key is shared between the sender and receiver of the encrypted sensitive information. The public key is used to encrypt and a private key is used decrypt the data. The private key is shared between the sender and receiver of the encrypted sensitive information. The public key is also called asymmetric cryptography.

The Evaluation standard mandates that an organization determines whether their security plans actually protect ePHI adequately. True or False?

True

Electronic protected health information (ePHI)

Under HIPAA: All individually identifiable health information created or received electronically by a covered entity (i.e., healthcare provider) or business associate.

Invalid log-on attempt

Use of an incorrect user name or password to enter a network or particular account.

Single-factor authentication

Use of one of three mechanisms to corroborate the identity of who an individual claims to be; the three mechanisms include (1) what the person knows (password); (2) what the user has (token); (3) what the use is (biometrics); less secure than two factor authentication.

Two-factor authentication

Use of two of three mechanisms to corroborate the identity of who an individual claims to be; the three mechanisms include: (1) what the person knows (password), (2) what the user has (token), (3) what the use is (biometrics); is more secure than single-factor authentication.

the Security Rule defines facility

as the premises and the interior and exterior of buildings. All locations where there is physical access to ePHI must be considered including the homes of workforce members and other physical locations.

When staff have a need for emergency access to information in the electronic health record that they may not have access to, the procedure to allow emergency access is often called

break the glass

Methods for actually destroying electronic data include ___________, where ePHI is disrupted or actually erased through exposure to a strong magnetic field.

degaussing

destruction of electronic media include:

disintegration, pulverizing, melting, incinerating, or shredding

HIPAA Security Rule four standards of Physical safeguards

facility access controls, workstation use, workstation security, and device and media controls

Erasing or deleting a file does sufficiently remove the ePHI. true or false?

false

The HIPAA Security rule is technology neutral. What does this mean?

new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems, allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care.

The facility access control used in the EHR requires a user name and password This is an example of ________ authentication

one factor

Encryption

scrambles or encodes data, protecting it from being comprehended by unauthorized individuals

The HIPAA Security rule is scalable. what does this mean?

so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity's particular size, organizational structure, and risks to consumers' e-PHI.

The Security Rule permits reuse of electronic media. true or false?

true