first hipaa privacy-security officerclearwatercompliance.com/wp-content/uploads/2011...60.secure...

© 2010-11 Clearwater Compliance LLC | All Rights Reserved1

"Whatsoever things I see or hear concerning the life of men, in my attendance on the sick or even apart therefrom, which ought not to be noised abroad, I will keep silence thereon, counting such things to be as sacred as secrets."

- Hippocratic Oath, 4th Century, B.C.E.

Welcome to today’s Live Event… we will begin shortly… Please feel free to use “Chat” or “Q&A” to tell us any ‘burning’ questions you may have in advance

First HIPAA Privacy-Security Officer

© 2010-11 Clearwater Compliance LLC | All Rights Reserved

How to Develop Your HIPAA Security Policies

and Procedures

WEBINAR Bob Chaput615-656-4299 or [email protected] Compliance LLC

…Welcome to …

2

http://www.linkedin.com/in/BobChaput�


About HIPAA-HITECH Compliance

1. We are not attorneys!

2. HIPAA and HITECH is dynamic!

3. Lots of different interpretations!

So there!

3


Get Smart!

“On Demand” HIPAA HITECH RESOURCES, IF NEEDED: 1. http://AboutHIPAA.com/about-hipaa/resources/2. http://AboutHIPAA.com/webinars/

4

http://hipaasecurityassessment.com/hsa-toolkit-videos/�

http://abouthipaa.com/about-hipaa/resources/�

http://abouthipaa.com/webinars/�

http://abouthipaa.com/�


1. Understand the Requirements2. Learn How to Do It3. Get Started With Practical, Actionable Next

Steps

Session Objectives

5


Mega Session Objective

Policies and Procedures are a crucial part of HIPAA HITECH compliance!

6


• Actual OCR Letter

• Word document with Data Request

7

OCR Data Requests…


1. Huge Project; Get Started Now

Two-Minute Executive Summary

2. Policies and Procedures are an important part, but only part of a balanced Security Program

3. Large or Small: Consider Getting Help (Tools, Experts, etc)


Who’s this guy talking?Bob Chaput, MA, CHP, CHSS, MCSE

9

• President – Clearwater Compliance LLC• 30+ years in Business, Operations and Technology• 20+ years in Healthcare• Executive | Educator |Entrepreneur• Global Executive: GE, JNJ, HWAY• Responsible for largest healthcare datasets in world• Numerous Technical Certifications (MCSE, MCSA, etc)• Expertise and Focus: Healthcare, Financial Services, Legal

• Member: HIMSS, HCCA, ACHE, AHIMA, NTC, Chambers, Boards

http://hipaasecurityassessment.com/�



Our Passion

10

… And, keeping those same organizations off the Wall of Shame…!

…we’re helping organizations safeguard the very personal and private healthcare information of millions of fellow Americans…

We’re excited about what we do because…


Why Should You Care?

1. It’s the law…

11

3. You want to stay in business

2. Your stakeholders trust you to do this


Meet the ‘Wall of Shame’

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html

12

Wyoming District of Columbia Vermont North Dakota Alaska South Dakota Delaware Montana Rhode Island Hawaii Maine New Hampshire

10.78 MIL

06/22/2011•288 CEs

•57 Named BAs•10.99M Individuals

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html�







Steps

Session Objectives

13


Meet the Three Pillars of HIPAA-HITECH Compliance…

14

Priv

acy

Secu

rity

Dat

a B

reac

hN

otifi

catio

n

……

HITECHHIPAA


Health Information Technology for Economic and Clinical Health Act

HITECH = Hey It’s Time to End your Compliance Holiday

15


The HITECH Act

THREE absolute “game changers”:

1) More Enforcement2) Bigger fines3) Wider Net Cast

16


It’s the Law45 C.F.R. §164.316(a)Standard: Policies and Procedures. (a) Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in Sec. 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.

17


45 C.F.R. §164.316(b)(1)Standard: Documentation.

(i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and

(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.

(2) Implementation specifications: (i) Time limit (Required). Retain the documentation required by

paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

(ii) Availability (Required). Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.

(iii) Updates (Required). Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.

18

It’s the Law


Forget the law… why PnPs?

19

1. Articulate your values and behavior as an organization

2. Set the stage for needed tools, processes and defense

3. Key components of a Balanced Security Program


Key Parts of A Balanced Security Program

Policy defines an organization’s values.

People must include talented technical staff, supportive management and trained/aware end-users.

Procedures or process provide the actions

required to deliver on company values.

Technology includes the various families of technical security controls

including encryption, firewalls, antivirus, intrusion

detection, etc, etc.

Balanced Security Program

Today’s Focus: Policies and Procedures



Steps

Session Objectives

21


DemoShow Policies & Procedures List

and How They Fit Into HIPAA Security Final Rule

22


Policies and Procedures for… Administrative Safeguards

23


Policies for… Physical Safeguards

24


Policies and Procedures for… Technical Safeguards, Policies and Procedures and Documentation

25

Total: 53 Core Policies and Procedures


Additional Policies and Procedures for…

26

Total: 4 Additional Policies and Procedures


DemoShow Policies & Procedure

Content / Outline

27


Essential Elements of Good

Policies & Procedures

28


1. Understand the Requirements2. Learn How to Do It3. Get Started With Practical, Actionable

Next Steps

Session Objectives

29


11 Steps to Develop HIPAA SecurityPolicies and Procedures

30

1. Form a Cross-Functional Policy Development Task Force

2. Set Business Risk Management Goals3. Get Educated – Learn the Regulatory

Requirements / and the Consequences4. Design your Outline / Standard Template5. Determine Specific Policies That Are Required 6. Evaluate Alternatives: “Build vs. Buy”7. Create a Project Plan for Development / Divide and Conquer8. Build a Change Management / Communications Subproject9. Create Review-Revise-Approve-Communication Process10.Integrate into Colleague On-Boarding and Ongoing Training11.Establish Maintenance Process to Stay Current


How Our HIPAA Security Policy and Procedure Templates Were Designed

31

1. Detailed readings of the HIPAA Security Final Rule

2. Used HIPAA Security Final Rule and NIST SP 800-66

3. Empowered you to edit, combine and tailor


HIPAA Security Policy ToolKit™ Demo

32


Contents of the HIPAA Security Policy and Procedure ToolKit™

Comprehensive HIPAA-HITECH Security Policy and Procedure template set (plus: Instructions, Glossary of Terms, Policies Checklist, Resources & References)

33

1. Over fifty (50) comprehensive HIPAA Security Policies and Procedures templates

2. Comprehensive HIPAA Security & Privacy Glossary of Terms

3. 60 minutes of complimentary email, telephone or web-meeting support

4. And, more…

http://clearwatercompliance.com/hipaa-compliance-software/hipaa-security-policy-template-toolkit/�


Policy & Procedure ToolKit™ Available“Do-It-Yourselfers” May Purchase the ToolKit™ and

Receive a Discount

SIMPLY VISIT:http://ClearwaterCompliance.com/eStore/

34

Regularly $1,987.00

Enter WEBINAR623 as Promotion Code to receive

$300 Discount to $1,687.00 for Complete

ToolKit™

Purchase by June 30, 2011

http://clearwatercompliance.com/eStore/�

http://hipaasecurityassessment.com/estore/�

http://clearwatercompliance.com/hipaa-compliance-software/hipaa-security-policy-template-toolkit/�


High Value – High Impact

HIPAA Security Policy Development WorkShop™

I. PREPARATIONA. Plan / GatherB. Read AheadC. Complete QuickScreen™

35

II. ONSITE ASSESSMENTA. FacilitateB. EducateC. Develop

III. FOLLOW UP SUPPORTA. ReviewB. ReviseC. Recommend

½ Day

½ Day

1 Day


Makes Decision to Move Forward A No-Brainer…

1. Save Thousands of Dollars in Consulting Fees

2. Jump Start Development Project

3. Take Strategic High Road on Critical Risk Management Issue

Clear Return on Investment…

36

Peace of Mind

http://hipaasecurityassessment.com/hipaa-compliance-software/hipaa-hitech-security-assessment-toolkit/�


1. Huge Project; Get Started Now

Summary

2. Policies and Procedures are an important part, but only part of a balanced Security Program

3. Large or Small: Consider Getting Help (Tools, Experts, etc)


Register Now! … at: http://abouthipaa.com/webinars/upc

oming-live-webinars/

38

Upcoming HIPAA HITECH Webinars

http://abouthipaa.com/webinars/upcoming-live-webinars/�







Bob Chaput

http://[email protected]

Phone: 800-704-3394 or 615-656-4299

Clearwater Compliance LLC

39

Contact


http://www.clearwatercompliance.com/�

mailto:[email protected]�

http://www.linkedin.com/in/bobchaput�

http://twitter.com/AboutHIPAA�

http://abouthipaa.com/feed/rss/�

http://www.vimeo.com/hipaahitechexpert�

http://www.slideshare.net/rchaput�


http://abouthipaali.org/�


Additional Information

40


Additional Policies and Procedures for…

41

58.Acceptable Use Policy 59.Network Security Policy60.Secure Application Development & Maintenance Policy61.Database Security Policy62.Remote Access Policy63.Change Control Policy64.Vulnerability Management Policy 65.Social Media Security Policy66.Vendor Management (Security) Policy67.Data Breach Notification Policy

Total: 4 Additional Policies and Procedures

Others: in our development pipeline


“The WorkShop™ process made a very complicated process and subject matter simple. The ToolKit™ itself was excellent and precipitated exactly the right discussion we needed to have.” –outside Legal Counsel, national research consortium

"The HIPAA Security Assessment ToolKit™ and WorkShop™ are a comprehensive approach that effectively guided our organization’s performance against HIPAA-HITECH Security requirements.” -- SVP and Chief Compliance, national hospice organization

What Our Customers Say…

42

“… The WorkShop™ process expedited assessment of gaps in our HIPAA Security Compliance program, began to address risk mitigation tasks within a matter of days and… the ‘ToolKit’ was a sound investment for the company, and I can't think of a better framework upon which to launch compliance efforts.” – VP & CIO, national care management organization

“…the process of going through the self-assessment WorkShop™ was a great shared learning experience and teambuilding exercise. In retrospect, I can't think of a better or more efficient way to get started than to use the HIPAA Security Assessment ToolKit.“ – CIO, national kidney dialysis center firm

“…this HIPAA Security Assessment Toolkit is worth its weight in gold. If we had to spend our time and resources creating this spreadsheet, we would never complete our compliance program on time…” — Director, Quality Assurance & Regulatory Affairs

http://hipaasecurityassessment.com/hipaa-compliance-software/hipaa-hitech-security-assessment-toolkit/�


An overwhelming amount of patients wanted the following:• EHRs (69%) • Making it possible for EHRs to be shared between physicians, hospitals, and

ancillary providers (74%) • Email access to their doctor so they can ask questions and discuss their health

via electronic mail (71%) • Electronic prescription processing to allow health care providers and

pharmacies to communicate without paper (76%)

But the patients also worried about the security of their electronic patient records. They are concerned with:• Their health data being safely and securely stored (69%) • Their health data being transmitted over the internet (66%) • Hospitals and providers adhering to privacy laws (such as HIPAA) (66%)

69% of patients wanted EHRs AND 69% also worried about their records being safely and securely storedThe Dell Executive and Patient Survey

Dell Executive & Patient Survey

43

http://i.dell.com/sites/content/business/large-business/merchandizing/en/Documents/the-dell-executive-and-patient-survey.pdf�


A second survey sponsored by the National Opinion Research Center (NORC) at the University of Chicago shows similar desires and concerns:Despite the fact that 48% of Americans are concerned about the privacy of medical records, fully 64% said that the benefits of EMRs outweigh privacy concernsSo it is clear that patients want doctors to use EHRs but they are also very concerned with the privacy and security of their records. Many medical practices and health organizations are pushing forward with the use of EHRs so understanding and realizing patient’s concerns is really important. But what if medical practices and health organizations were to use patient’s concerns as a competitive advantage over other health organizations?What if instead of looking at HIPAA Security regulations as something that is mandatory and required by the government, a medical practice sees HIPAA and patient security as a way of addressing patient concerns?

National Opinion Research Center Survey

44

http://www.norc.uchicago.edu/News/HIT+Release+2011Jan31.htm�


Policies & Procedures Study• Majority of respondents admit to serious non-compliant workplace

behaviors that place their companies at risk. (E.G., insecure use of USB memory sticks, use of Web-based email, sharing passwords, turning off security settings, etc.

• 69% of employees said that they copy confidential or sensitive business information onto USB devices, while only 13 percent of respondents said their companies have a policy that allows this, showing a 48 percent non-compliance rate.

• 61% admitted to copying confidential or sensitive business information onto USB devices, and then transferring the information to another computer that is not part of the corporate network.

• Over 50% said that they download personal Internet software to their company computers, increasing the risk of introducing viruses, worms and other malware into an organization's network.

• 58% said that their companies do not provide adequate training about compliance with data security policies, and about the same number said the data security policies are ineffective.

• About 50% said their corporate data security policies are largely ignored by employees and management, and that the policies are too complex to understand.

• Compared with a similar study conducted by Ponemon Institute in 2007, the rate of non-compliant employee behavior appears to be getting worse over time.

45

Trends in Insider Compliance with Data Security Policies: Employees Evade and Ignore Security Policies is a survey of U.S.-based end-users of corporate information technologies. Results were derived from 967 responses from a sampling frame of 17,021 (5.7% response rate).


“69% of patients want EHRs AND69% also worried about their records being safely and securely stored…”The Dell Executive and Patient Survey

“Despite the fact that 48% of Americans are concerned about the privacy of medical records, fully 64% said that the benefits of EMRs outweigh privacy concerns…”National Opinion Research Center (NORC) at the University of Chicago

Good News – Bad News

46

http://i.dell.com/sites/content/business/large-business/merchandizing/en/Documents/the-dell-executive-and-patient-survey.pdf�

http://www.norc.uchicago.edu/News/HIT+Release+2011Jan31.htm�