Safeguards: A Case Study

The Health Insurance Portability and Accountability Act (HIPAA) secures protected health information (PHI) from unsanctioned access. PHI comprises any identifiable facts regarding a patient that may be composed of their address, name, and medical records number. HIPAA offers regulations that are needed for enhanced data security that is increasingly distinct to the health care industry. Usually, patients are the main

The Health Insurance Portability & Accountability Act of 1996 (HIPAA), was put in effect to help maintain the confidentiality of individuals in certain settings. The summary of the HIPPA Security Rule goes through the key elements of who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US law aimed to advance the portability and continuity of health insurance coverage in both the group and individual markets, and to combat waste, fraud, and abuse in health insurance and health care delivery as well as other purposes26. The Act defines security standards for healthcare information, and it takes into account a number of factors including the technical capabilities of record systems used to maintain health information, the cost of security measures, the need for training personnel, the value of audit trails in computerized record systems, and the needs and capabilities of small healthcare providers. A person who maintains or transmits health information

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting electronic patient health information (e-PHI) (The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules). Entities must: 1) ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain, or transmit; 2) identity and protect against reasonable anticipated threats to the security or integrity of the information; 3) protect against reasonable anticipated , impermissible users or disclosures; and 4) ensure compliance in the workplace. Entities must review and modify security measures to continue protecting e-PHI in a changing environment. They are required to run risk assessments as part of security measures, implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level, and designate a security officer responsible for developing and implementing its security policies and procedures.

Since the adoption of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, there had been some modifications and interpretations made to its provisions to ensure that the requirements of the law are strictly adhered to. Thus, the “two sets of federal regulations were implemented… the Privacy Rule and the Security Rule” (McGonigle & Mastrian, 2015, p. 157). Briefly, the Privacy Rule addresses the limited use and disclosure of patients’ health information, while the Security Rule refers to the need to safeguard “patients’ health information from improper use or disclosure” (McGonigle & Mastrian, 2015, p. 157). The case scenario discussed in this paper relates to the Privacy Rule and Security Rule of HIPAA.

HIPAA Security & Privacy Rule instructs entities who have administrative control over patient’s personal information implement technical and non-technical strategies to mitigate or eliminate vulnerabilities. Statue permits hospital and other entities to use any security measures that is judicious, pertinent, and effectively deployed ("HHS.gov," 2015).

The Health Insurance Portability and Accountability Act (HIPAA) was implemented in 1996 and it required the Secretary of the U.S. Department of Health and Human Services (HHS) to promote regulations that maintains and follow procedures that ensure the privacy and security of health information and protects patients' personal or protected health information (PHI). The HIPAA Privacy Rule regulations require health care providers and organizations, and their business associates to protect all individually identifiable health information when it is handled, transmitted, received, or shared. This information applies to all forms of protected health information (PHI), including digital, paper or oral. In addition, the information

The HIPAA Security Standards for the Protection of Electronic Protected Health Information (the security rule) “establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity” (U.S. Department of Health and Human Services, n.d.). The security rule requires that specific standards be established and implemented into three categories; compliance in one category may overlap into another:

Health Insurance Portability and Accountability Act of 1996 (HIPAA) – Regulations protecting the privacy and security of certain health information

HIPAA Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronically protected health information.

The HIPAA Security Rule was published in 2003. “The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information(ePHI) that is created, received, used, or maintained by a covered entity.”(HHS.gov). HIPAA Security Rule requires nine different standards that must be met in order for the HIPAA security rule to protect individuals ePHI correctly and to develop an overall security plan for the organization. “Well established and well- implemented administrative, physical, and technical safeguards are essential for any health care organization.”(Wager, 355). The nine standards are

With the proliferation of small personal and business computers in the 1990s, records were moving more and more from paper based records that were in the doctor’s offices to digital records stored on hard drives on computers. Many of these computers were also becoming connected to networks and to the internet by this time also. With these new technologies being mixed in with medical records that were previously locked in file cabinets it all of a sudden became much easier for a patients information to be transmitted out of the doctor’s office. (HIPAA Privacy Rule and Public Health, 2003) Of course, this was not a bad thing today we all depend on the ability of our records to be easily transmitted when needed from all sorts of agencies and

Health care is a hot topic in today’s society- everything from reforming the industry so that people are not denied health coverage to finding ways that patients’ medical records can be accessed electronically for more convenience. Moreover, epidemics such as HIV/AIDS spotlights the issues surrounding public health agencies use of maintenance and storage of electronic health records (EHR). Myers, Frieden, Bherwani, and Henning (2008) state that although there are security breaches when personal health information is stored in electronic form, the data can be better secured than paper records because authentication, authorization, auditing, and accountability

Almost every healthcare organization uses some type of Electronic Health Record (EHR), Electronic Medical Record (EMR) or Patient Data Management System (PMS). These EMR/EHR/PMS data structures are to be readily available to Medical Practitioners, diagnosticians, pharmacists and other medical personnel. As the data comprises of sensitive patient information, data security is one of the key concerns of data managers handling Electronic Health Records.

created by applying security safeguards deal with the to security helplessness and dangers recognized by the association. A safeguard is just a component or part of the security framework. Safeguards can be seen in two fundamental classifications of physical Safeguards psychological safeguards Although one can separate amongst psychological and physical control, most physical controls additionally give a component of psychological