Chapter 12 (Security) Flashcards
three states of data protection
Data must be protected in its three states: data at rest, data in motion, and data in use.
Data at rest is when the data is stored on an electronic media such on a computer’s hard drive.
Data in motion is data that is moving from point A to point B such as being shared between a hospital and an insurer.
Data in use is when the data is being accessed for review, updates, or other purposes.
administrative simplification
a term mentioned in the Patient Protection and Affordable Care Act
It means to use technology to reduce clerical work and to standardize rules and achieve greater legal compliance.
covered entity (CE)
Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards
clearinghouse
(1) an establishment maintained by banks for settling claims and accounts
(2) a central agency for the collection, classification, and distribution of information
claim (health insurance/finances)
a demand for something due or believed to be due
healthcare clearinghouse
a company that collects billing data and processes it for the healthcare provider. The healthcare clearinghouse then submits the claim to the health plan for payment
health plan
a plan that pays for the healthcare provided to the individuals covered under the plan. These plans include medical, dental, vision, and other forms of health plans.
Transaction and Code Sets rules
A set of rules designed to standardize transactions performed by covered entities. These standards apply to electronic transactions only, such as claim submission, eligibility queries, and many more insurance-related functions
designated standard maintenance organizations (DSMOs)
organizations named by the Secretary of Health and Human Services (HHS) to maintain standards adopted under HIPAA and to receive and process requests to adopt new standards or modify existing standards
addressable standards vs required standards (HIPAA)
In each HIPAA Security Rule, implementation specifications are either “addressable” or “required” HIPAA requirements and describe how standards should be executed.
“Required” rules are quite cut and dried. Either you implement them, or you automatically fail to comply with the Security Rule. These mandatory rules represent 48% of the HIPAA Security Rule.
“Addressable” constitutes 52% of Security Rule specifications, and many entities do not fully understand what that entails.
Addressable requirements are often technical, and allow organizations the flexibility to implement different security controls to accomplish the requirement’s objective.
For example, if I had addressable specifications to cook a turkey, I could cook it in the oven like the recipe dictates, or I could BBQ, deep-fry, smoke, or microwave it. It doesn’t matter how I cook it, just that it gets cooked (and doesn’t give me food-poisoning).
threat (computer security)
a potential negative action or event facilitated by a vulnerability that results in an unwanted impact to a computer system or application
vulnerability (computer security)
a weakness which can be exploited by a threat actor, such as an attacker, to cross privilege boundaries within a computer system. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness.
risk analysis
the process of identifying possible security threats to a computer system and identifying which risks should be promptly addressed and which are lower in priority
risk management
The process of identifying, assessing and controlling threats to an organization’s capital and earnings. These threats, or risks, could stem from a wide variety of sources, including financial uncertainty, legal liabilities, strategic management errors, accidents and natural disasters.
security management plan
a plan that describes how the organization will provide and maintain a safe physical environment and manage staff activities to reduce the risk of personal injury and property loss
sanction policy
a set of policies that addresses how employees will be penalized for failing to follow security policies and procedures
information system activity review
a review that monitors for the inappropriate use or disclosure of electronic personal health information
HIPAA does not mandate the frequency of this review nor the way this review is to be conducted. These reviews should include logs, access, and incident reporting. People should monitor audit logs, the incident log, and other internal and external documentation to identify all successful and unsuccessful attempts to access ePHI.
chief privacy official (CPO)
a corporate executive charged with developing and implementing policies designed to protect employee and customer data from unauthorized access
information access management
action that involves implementing policies and procedures to determine which employees have access to what information
workforce clearance procedure
a policy that ensures that each employee’s level of access is appropriate
The access determination should be based on risk analysis and each employee’s job description. This would require the CE to evaluate each user and their need for data and functionality.
termination process
a policy to eliminate an employee’s access to the information system when that person’s employment with the company ends—either through resignation or through termination (firing)
security incident
any single event involving the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system
forensics
relating to or dealing with the application of scientific knowledge to legal problems or criminal investigation
five steps of forensic investigation
Policy and procedure development (including strict guidelines) Evidence assessment (determining what should be looked for) Evidence acquisition (how evidence will be captured) Evidence examination (analyzing data obtained) Documenting and reporting (documenting all activities performed)
security event
any observable occurrence that is relevant to information security
The security event does not have to result in a breach of electronic personal health information. Security events include noncompliance with security policies, errors made by employees, leaving computer without logging out, writing down passwords, and so forth.
contingency plan
a set of policies and procedures that identify how a hospital will react in the event of an information system emergency, such as power failure, natural disaster, a hacker, malware, or an information system failure. HIPAA calls this an emergency mode operation plan.
contingent (adjective)
(1) dependent on or conditioned by something else
(2) likely but not certain to happen
(3) happening by chance or unforeseen causes
(4) not logically necessary
redundancy
Intentional duplication of data, hardware, cables, or other hardware components of the information system.
Example: As data are entered, it is also saved onto a second computer server, creating a way to access an operational information system with little to no downtime. It can also be used for networks, computers, and other hardware. For example, a large urban hospital may have multiple network cables that connect buildings by using cables that are buried under the street. If one cable fails, another cable takes its place in transmitting data.
business associates (BAs)
organizations that conduct business on behalf of a company (e.g. hospital)
Examples of BAs are contract coders, application service providers, transcription services, and billing services. These associates require access to health information in order to do their jobs. Therefore, BAs are subject to the HIPAA Security Rule.
business associate agreement (BAA)
in reference to healthcare, it is an agreement between a hospital and a hospital’s business associate
The BAA spells out the BA’s responsibilities and how it should protect health information. The BAA should also allow the hospital to terminate the contract if the BA fails to meet the responsibilities in the BAA. The BAA must address certain required elements (HIPAA).
