Gear Up For Enforcement Of Security Breach Regs

By Author: Janu Paul
Total Articles: 53
Comment this article

On February 22, the ARRA/HITECH's breach notification regulations will become enforceable. So are you ready for this?


The regs, published in August 2009, specifically cover health information that is contained in Personal health records - electronic records, managed by or for individual patients that draw information from multiple sources. The new term, personal health records, thus enlarges HIPAAs scope to cover more than traditional health care providers. Entities like Google Health, Microsoft Health and others will be required to keep data secure under the regs.


With February 22 just round the corner, it's highly important that your office gears up for it. Here are a few tips that will help you in this direction:


The best thing you can do is to encrypt your patient records, notwithstanding where they are. The breach notification regs don't apply to ...
... the loss of properly encrypted data; so if you can encrypt, that is what you want to do. Encryption must meet the federal info processing standard, FIPS 140-2. See to it that the company you hire to do your encryption has this credential.

Second, see to it that you have sound policies and procedures in place to deal with breaches if and when they occur. It would be good thing if all you had to do was seal the information, but you need to be prepared to notify a range of people if something does happen.

In fact, you should be prepared to notify not only patients whose unsecured information was lost, but the media and HHS as well if more than 500 patient records went missing.

You should start thinking now about revising your contracts with your business associates.