Health Information Privacy and Security Flashcards
health insurance portability and accountability act (HIPAA)
- 1996
- privacy and security measure in healthcare
- privacy rule mandates to de-identify data by removing 18 identifiers (name, DOB, address, phone number, ID, etc.) and getting consent
- safeguards in place to ensure data is not compromised, and that it is only used for intended purpose
- should not impede treatment of patients:
- health plans (health insurers)
- health care providers
- health care clearinghouses- empires
american recovery and reinvestment act (ARRA)
- 2209
- after HIPAA
- HITECH follows
what image do we use in health care
DICOM
HIPAA is not required for
- life insurers
- employers
- schools and school districts
- many law enforcement agencies
administrative requirements
- written privacy policies and procedures
- privacy official
- workforce training and management
- mitigation strategy for privacy breaches
- data safeguards
- designate a complaint official and procedure to file complaints
- documentation and record retention- 6 years
data safeguard
-administrative, technical, and physical
document retention
- must hold records for 21 years when you are born
- mammography’s are kept forever
- after the first 21st years your records are kept every 6 years
administrative safegaurds
- security management processes to reduce and vulnerabilities
- security personnel
- information access management
- workforce training and management
- evaluation of security policies and procedures
physical safeguards
facility access
-workstation and device security policies and procedures covering transfer, removal, disposal, and re-use of electronic media
technical safeguards
- access control that restricts access to authorized personnel
- audit controls for hardware, software, and transactions
- transmission security to protect against unauthorized access to data transmitted on networks and via email
- ID, fingerprint, retinal scan, face scan, blood
confidentiality
- prevention of data loss
- usernames, passwords, and encryption are common measures
availability
- system and network accessibility
- power loss or network connectivity outages (Natural or accidental)
- backup generators, peripheral network security equipment
integrity
- trustworthiness and permanence of data
- data backup and archival tools
tools
- physical
- networks and information resources
- firewall, authentication
authentication and identity management
-photo identification, biometrics, smart card technologies, tokens, and the old standard; user name and password
basic authentication
- vary depending on sensitivity of data
- something one knows, something one has, or something that one is
- username and password combination
- grid card, smart card, USB token, one time password (OTP)
- token, or OTP and PIN
single sign on
- one set of credentials (mechanism) to easily access many of the resources one uses every day securely
smart cards
- vital information with a self-contained processor and memory
- low cost, ease of use, portability and durability, and ability to support multiple applications
- encrypted patient information, biometric signatures and personal identification (PIN)
- lack of standardization and positive identification
digital signature
- legal
- copy pasting signature is not as good
- writing your name with a pin and birthday is more securee
certificate based encryption
- obscure the content of a message
- recipients public key by sender encrypts message
digital and information rights management (DRM and IRM)
- users roles, permission, and access
- limit any unnecessary access
biometric authentication
- physical user identifier
- fingerprint, retinal scan, voice imprint
standards, compliance and law
- ignorance of the law is no excuse
- detailed list of standards and laws in textbook
security breaches and attacks
- identity theft on the rise
- physical theft- stolen laptop from VA (computers, storage devices, servers)
theft countermeasures
- render data unusable to thieves
- encryption standards
- hardware and software encryption techniques
physical or logical access
-insider employees and staff
accidental or negligent disclosure
- inadequate control of paper records
- inadvertent release of sensitive information to unauthorized parties
- through overheard coversations
- poor housekeeping practices around copiers, fax machines, and recycling bins
intrusions and attack
-attack on physical and wireless networks attempting to compromise machines and user accounts through disguised email messages, corrupted PDF files and exploited webpages
