HIPAA des not address all security issues
alt="Security Manual - Sarbanes-Oxley" vspace=3 align=right
src="http://www.it-toolkits.com/images/Securitymanual.png"
longDesc="Security Manual Template - Sarbanes-Oxley">HIPAA places a
requirement on health care and insurance organizations to go further than simply
complying with regulations to protect health information. Although those
organizations deal with many types of government and professional regulations,
as adoption of electronic
health records (EHRs) progresses, they also need to form policies of their
own to secure patient data.
width=94 height=22>
src="http://www.it-toolkits.com/images/buttons/DownloadTableofContents.gif"
width=209 height=22>
Health care organizations have turned to government guidelines on security,
but they need their own security measures as well. These government security
guidelines include the 1996 Health Insurance Portability and Accountability Act
(HIPAA) and the 2009 Health Information Technology for Economic and Clinical
Health (HITECH) Act, which made penalties for data breaches more severe.
Evolving threats will always outpace even the most thorough regulatory requirements. For
that reason, organizations need to constantly assess their security risk levels
and evolve their policies and procedures to ensure that they are in the best
possible position to protect their patients and their bottom lines.
A large number of health care breaches reported to the U.S. Department of
Health and Human Services were also due to portable devices. The
expanded use of mobile devices offers new operational efficiencies and increased
vulnerabilities. Security steps for mobile devices should be included in the
action plans so that guidelines are set.
Leave a Reply