Attached is an updated summary of the major provisions of each state law that have enacted security breach statutes. In the event of a security breach, you should consult legal counsel to ascertain the appropriate method of notification and other requirements. To date — forty-five states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information. States with no security breach laws include: Alabama, Kentucky, Mississippi, New Mexico, and South Dakota. Arkansas, California, Minnesota, and Texas now include health information within the scope of their respective security breach statutes by including health information within the definition of personal information. Eight states take an acquisition based approach when defining whether notice should be given, while the remaining states take a more pragmatic risk assessment of the likelihood of harm as controlling whether notice should be sent to consumers. [...]
|
|||||
|
September 15th, 2009 | Tags: choicepoint security breach, hipaa breach notification, information security breach and notification act, security breach disclosure, Security Breach Notification, security breach notification laws | Category: Privacy Law, State Privacy and Computer Security Laws, State Security Breach Laws |
3 comments
 Print This PostLargely in reaction to a devastating cyber attack against Google last week, and general concern about the vulnerability of the nations information superhighway, the house passes the Cybersecurity Enhancement Act of 2009 (available at http://thomas.loc.gov/cgi-bin/query/z?c111:h4061) 422 to 5. The companion bill in the senate is Cybersecurity Act of 2009, or Senate Bill 773, will “ensure the continued free flow of commerce within the United States and with its global trading partners through secure cyber communications, to provide for the continued development and exploitation of the Internet and intranet communications for such purposes, to provide for the development of a cadre of information technology specialists to improve and maintain effective cyber security defenses against disruption, and for other purposes.” The senate bill is much broader in scope (calling for example a cybersecurity [...] February 5th, 2010 | Tags: Cybersecurity Act of 2009, Cybersecurity Enhancement Act of 2009 . HR4061, SB773 | Category: Computer Security Law -- Federal, Cyber Security Enhancement Act of 2009, Expert Systems, Law and Technology, NIST |
Leave a comment
Print This PostOn December 1st, 2009 the Office of the Secretary of the Office of the National Coordinator (ONC) for Health Information Technology announced the creation of a new Chief Privacy Office and the Office of Economic Modeling and Analysis (among three others including the Office of Chief Scientist, Deputy National Coordinator for Programs & Policy, and Deputy National Coordinator for Operations). The New Chief Privacy Officer is a necessary creation under the ARRA (and the HITECH Act). This role is different from the other positions that seem to be a re-organization of roles and responsibilities that already existed to some extent just with more specificity around functions and duties. Aside from the Chief Privacy Officer the New Economic Modeling and Analysis Position seems like a timely creation given recent articles discussing whether Health Information Technology and more specifically Electronic Health Record Systems (EHRs) actually reduce the cost of care and/or increase the quality of care. Also of note, the new Office of the Deputy National Coordinator for Programs and Policy will be responsible for the open source Connect initiative and the National Health Information [...] December 10th, 2009 | Tags: ARB, ARC, ARD, ARF, ARRA, HITECT, Office of Economic Modeling and Analysis, Office of the Chief Privacy Officer, Office of the Chief Scientist, Office of the Deputy National Coordinator for Programs & Policy, ONC | Category: American Recovery and Reinvestment Act, HIPAA Privacy, HIPAA Security, HITECH Act, Health Information Technology, Health and Humans Services (HHS), Interoperability, Office of the National Coordinator for Health Information Technology |
Leave a comment
Print This PostThis article discusses techniques for implementing the updated requirements of the HIPAA Security Rule, with particular focus on strategies for assessing the effectiveness of implemented security controls to support compliance and audit, as well as a covered entity’s (or business associate) overarching risk management program in the context of HIPAA Compliance. Covered entities are becoming more pro-active in monitoring their business associate compliance with HIPAA privacy and security regulations and the recent changes largely the product of the HITECH Act. In the past I have used a series of questions to ascertain the compliance status of business associates to comply with HIPAA privacy and security rules. I find it useful to map security controls to NIST Special Publication 800-53. The National Institute of Standards and Technology has collaborated with the military and intelligence communities to produce the first set of security controls for all government information systems, including national security systems. The controls are included in the final version of Special Publication 800-53, Revision 3 “Recommended Security Controls for Federal Information Systems and Organizations,” released in August of 2009. (Available at http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf). [...] November 29th, 2009 | Tags: 800-53, 800-66, compliance, HIPAA, HITECH Act, NIST, security controls | Category: American Recovery and Reinvestment Act, Data Hemorrages, Destruction, Encryption, FIPS 140-2, Federal Agencies, HIPAA Security, HITECH Act, Health Information Technology, Health Reform, Health and Humans Services (HHS), Individually identifiable health information, Interoperability, Meaningful Use, Media Sanitization, NIST, Office of Civil Rights, Privacy, SSL VPNs, anonymization, unsecured protected health information |
5 comments
Print This PostNext year should be interesting. From Red Flag compliance, federal breach reporting requirements, significantly augmented HIPAA penalties, and HIPAA security standards that are based on NIST guidelines will change the traditional compliance model for Covered Entities and Business Associates. Hot topics for enforcement next year (based on recent CMS audits of their business partners) will likely be in the areas encryption of portable media devices, remote access by employees to protected health information, and failure to document a rational risk management [...] November 17th, 2009 | Tags: ARRA, breach, EHR, Encryption, enforcement actions, FISMA, HIPAA, Interoperability, NIST, OIG, security | Category: American Recovery and Reinvestment Act, EMR, Encryption, FIPS 140-2, HIPAA Security, HITECH Act, Health Information Technology, Health and Humans Services (HHS), Interoperability, Meaningful Use, NIST, unsecured protected health information |
2 comments
Print This PostOn October 7, 2009 HHS announced proposed rulemaking to modify the HIPAA privacy rule to comply with Section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA) regarding the privacy and confidentiality of genetic information. Generally, the HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The HIPAA Privacy Rule requires a covered entity (and beginning next year Business Associates) to implement reasonable and appropriate administrative, technical and physical safeguards to protect the privacy of personal health information (PHI). The HIPAA privacy rule more generally sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request [...] October 15th, 2009 | Tags: genetic information, Genetic Information Nondiscrimination Act of 2008, gina, HIPAA, PHI | Category: Deidentified Health Information, Federal Agencies, Genetic Information Nondiscrimination Act of 2008, HIPAA Privacy, HITECH Act, Health and Humans Services (HHS), Office of Civil Rights, Privacy, Privacy Law, State Privacy and Computer Security Laws, anonymization |
Leave a comment
Print This PostGenerally in the event of a “breach” of “unsecured” PHI, a covered entity must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, breached. (45 C.F.R. § 164.404(a)(1).) Despite the obvious utility of the new harm standard, a few privacy advocates (and four United States congressmen) have expressed displeasure with the new HHS harm standard. An October 1st letter from congressional leaders sent to HHS Secretary Sebelius argues that the ARRA did not imply a harm standard in the breach notification requirements, and requests that HHS repeal the harm standard that was included in the interim final regulations on Breach Notification for Unsecured Protected Health Information. [...] October 12th, 2009 | Tags: ARRA, Computer Security, congress, Democrat, Dingell, harm standard, HIPAA, HITECH, Pallone, rangel, Waxman | Category: HIPAA Security, HITECH Act, Health Reform, Health and Humans Services (HHS), Privacy |
4 comments
Print This PostThe Secretary has delayed enforcement of the Security Breach Rules to give covered entities and business associates a reasonable amount of time to come into compliance. However, in anticipation of covered entities’ new reporting obligations, HHS on October 7th, released an online form (OMB No. 0990-0346) that appears to be the exclusive mechanism by which a covered entity can provide the required notice to the Secretary in the event of a security breach. (The form is available at http://transparency.cit.nih.gov/breach/index.cfm). The form is intended only for security breach submissions by covered entities to the Secretary; breaches involving business associates must be reported directly to the Secretary by the affected covered entity and not by the business [...] October 12th, 2009 | Tags: Department of Health and Human Services, Freedom of Information Act, health information, HIPAA, HITECH Act, security breach | Category: HITECH Act, Health Information Technology, Health Reform, Health and Humans Services (HHS), Office of Civil Rights, unsecured protected health information |
Leave a comment
Print This PostI am a little unclear as to why privacy advocates and security vendors believe that the harm standard, found within the new HHS regulations for security breaches, in any way hampers the HITECH Act’s security breach notice rule for covered entities and business associates. Many states use a similar risk based type analysis, in fact only seven states have a strict acquisition based standard, of those only a couple of these states link their definition of encryption to FIPS 140-2. In comparison to risk based states where one assesses the potential risk to a consumer resulting from theft of sensitive informatioin, the federal standard is more helpful in the sense that it highlights key criteria to be evaluated in assessing risk to consumers. [...] September 22nd, 2009 | Tags: fear mongering, FIPS 140-2, FISMA, harm standard, HIPAA, OMB, Risk Analysis, security incident | Category: Computer Security Law -- Federal, Data Hemorrages, Encryption, FIPS 140-2, HIPAA Privacy, HIPAA Security, HITECH Act, Health and Humans Services (HHS), Identity Theft, Individually identifiable health information, NIST, Privacy, State Security Breach Laws, unsecured protected health information |
One comment
Print This PostThe Ninth Circuit rejected an employer’s argument that a former employee violated the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, when he emailed company client lists and financial data to himself for personal use. LVRC Holdings LLC v. Brekka, ___ F.3d ___, 2009 WL 2928952 (9th Cir. 2009). Superficially this decision is at odds with another decision in the Seventh Circuit. The employer in LVRC Holding based its theory on the 7th Circuit’s application of agency law as a basis for finding liability under the CFAA. However, the 9th Circuit decision seems sound and consistent with avoiding turning the CFAA into a catchall basis for finding criminal and/or civil liability in the absence of other relevant legal authority. While I disagree with the reasoning of the 7th Circuits decision, I believe justice was served in both cases, and the 9th Circuit laid out a logically more stable basis for assessing liability under the [...] September 18th, 2009 | Tags: 18 USC 1030, agency, Brekka, CFAA, Citrin, Computer Fraud and Abuse Act, congress, IAC, intent, LVRC Holdings LLC, motivation | Category: 18 USC 1030, 7th Circuit, 9th Circuit, Circuit Courts, Computer Security Law -- Federal, Forensic Tools |
Leave a comment
Print This PostImprove the web with Nofollow Reciprocity. |
|||||
|
Copyright © 2010 Law Blog 2.0 - Robert Hudock, Esq., CISSP - All Rights Reserved - This Blog is a personal blog of Robert Hudock. |
|||||
Booz Allen Hamilton, Inc Receives Non-Competitively Awarded Contract to Develop Certification and Accreditation Program for testing EHR Systems
The National Institute of Standards and Technology awarded Booz Allen Hamilton Inc. a contract to develop a testing method and processes for certifying electronic health record systems on January 13th. Omitted from the announcement and underlying justification for a non-competitively awarded contract is that CCHIT already has an existing framework for testing EHR systems. The $400,000 contract, announced on January 13, will result in a testing framework for health IT, a certification “process document” and other planning tools. This probably means that we will not see such certification standards until at least April 2010 or later. It is not clear how said standards and testing framework can be effectively deployed at a national level and implemented by EHR vendors and hospital systems by 2011. Given the urgent time line it is time to for direct coordination of efforts between NIST and CCHIT to push out a workable plan for certification of EHR [...]