Beginning on February 18, HHS will have the legal authority to enforce the breach notification laws set forth last year as part of section 13402 of the HITECH Act,  within the American Recovery & Reinvestment Act (ARRA). The penalties can now be up to $1.5 million and require media notification in cases where 500 or more records are breached. Business associates, as well as covered entities, must now comply with the HITECH Act breach notification rule (which essentially makes modifications to the HIPAA Security Rule).

1. Perform an extensive security review and indentify where electronic protected health information (PHI or ePHI) resides on your IT systems.
2. Create a plan on protecting PHI.
   • Data encryption provides a safe harbor from breach notification. Determine where PHI can be encrypted.
   • Identify public facing extranet portals and web applications that can allow access to PHI.
   • Identify databases that hold PHI.
   • Execute the plan
3. Implement data encryption where practical.
   • For databases, implement a database security product to monitor database requests and protect from intrusion.
   • For web apps, implement a web application security product to protect from cross-site scripting and various attacks to access databases to PHI.
   • Protect endpoints such as laptops, tablets, etc with data at rest encryption by implementing whole disk encryption,

Experior Data helps customers plan and execute data security assessments and technology implementation for healthcare. Our proprietary Technical Security Audit includes a personalized review of your IT systems and well as a vulnerability scan of all your network components.

Related articles by Zemanta

• HITECH Act security breach rules now effective; federales give a six-month pass. Now’s the time to kick compliance efforts into high gear (healthblawg.typepad.com)
• HITECH and State Breach Notification (slideshare.net)
• Using Encryption Garners Exemption For Data Breach Notification (yro.slashdot.org)
• Son of HIPAA Breach Notification Rules and Business Associate Requirements: Who’s Ready? (healthblawg.typepad.com)
• The Cost of Fear | Why Docs Don’t Embrace Technology (Dr. Rob) (hunscher.typepad.com)
• PGP Corporation to Announce Acquisition (newswire.ca)