HIPAA Security – Required or Addressable

By Jay Masci

Compliance deadline for the HIPAA Security Rule, finalized and published February 20, is February 21, 2005. If you were required to comply with the Privacy Rule or Electronic Trasactions and Code Sets Rule, you are a "covered entity" and must also comply with the Security Rule.

The Department of Health and Human Services (DHHS) provides flexibility to covered entities by stating whether a specification is "required" or "addressable."

If the specification is "required," the covered entity must implement the specification as stated in the Security Rule.

If the specification is "addressable" then the covered entity must:

1. Assess whether the specification is a reasonable and appropriate safeguard in its environment and is likely to contribute to protecting the entity's electronic protected health information.

2. Implement the specification or document why it would not be reasonable and appropriate and implement an equivalent alternative measure if reasonable and appropriate.

Implementation Specifications
(R)=Required, (A)=Addressable

Administrative Safeguards

Standards

Security Management Process  

• Risk Analysis (R)
• Risk Management (R)
• Sanction Policy (R)
• Information System Activity Review (R)

Assigned Security Responsibility (R)

Workforce Security  

• Authorization and/or Supervision (A)
• Workforce Clearance Procedure (A)
• Termination Procedures (A)

Information Access Management  

• Isolating Health Care Clearinghouse Function (R)
• Access Authorization (A)
• Access Establishment and Modification (A)

Security Awareness and Training  

• Security Reminders (A)
• Protection from Malicious Software (A)
• Log-in Monitoring (A)
• Password Management (A)

Security Incident Procedures

•  Response and Reporting (R)

Contingency Plan

• Data Backup Plan (R)
• Disaster Recovery Plan (R)
• Emergency Mode Operation Plan (R)
• Testing and Revision Procedure (A)
• Applications and Data Criticality Analysis (A)

Evaluation (R)

Business Associate Contracts and Other Arrangement

•  Written Contract or Other Arrangement (R) 

Physical Safeguards

Standards 

Facility Access Controls

• Contingency Operations (A)
• Facility Security Plan (A)
• Access Control and Validation Procedures (A)
• Maintenance Records (A)

Workstation Use (R)

Workstation Security (R)

Device and Media Controls

•  Disposal (R)
•  Media Re-use (R)
•  Accountability (A)
•  Data Backup and Storage (A)

Technical Safeguards

Standards  

Access Control

•  Unique User Identification (R)
•  Emergency Access Procedure (R)
•  Automatic Logoff (A)
•  Encryption and Decryption (A)

Audit Controls (R)

Integrity

•  Mechanism to Authenticate Electronic PHI (A)

Person or Entity Authentication (R)

Transmission Security

•  Integrity Controls (A)
•  Encryption (A)

Organizational Safeguards

Standards  

Business Associate Contracts or Other Arrangements (R)

Group Health Plans (R)

Policies and Procedures (R)

Documentation

• Time Limit (R)
• Availability (R)
• Updates (R)

This article is informational only and does not constitute the rendering of legal, financial, or other professional advice or recommendations by Provaliant or individual members. If you require legal advice, you should consult with an attorney.

Jay Masci is the principal consultant of Provaliant, which provides IT consulting services including HIPAA compliance and customized training. Visit www.provaliant.com or contact Provaliant at 480.952.0656.

	HIPAA Security and the Organizational Safeguards - April 2004 DC Direct
	HIPAA Security and the Physical Safeguards - November 2003 DC Direct
	HIPAA Security and the Administrative Safeguards—Part 2 - October 2003 DC Direct
	HIPAA Security and the Administrative Safeguards—Part 1 - August 2003
	HIPAA and the Business Associate Puzzle - July 2003 Exclusively Online
	Here Comes HIPAA Security - May 2003 DC Direct
	HIPAA: How to Handle a Vendor Selling HIPAA Services and Products - April 2003 So what do you say when sales representatives call to sell their company’s HIPAA services and products? DC Direct
	HIPAA Privacy: Are You Ready to Comply? - March 2003 Exclusively Online

Table Of Contents - July 2003

	Prosthetic Components: Making the Right Choice in the 'Fitting Game' Patient input is, of course, vital to the success of the fitting process--but what about the influence of marketing hype on patients? Feature
	There’s More Than One Way To Fit a Patient Feature
	Got FAQs? This informative column will help providers and their staff with a better understanding of billing procedures and reimbursement strategies.
	ACPOC Explores What’s New in Pediatric Rehab Association Spotlight
	HIPAA and the Business Associate Puzzle Exclusively Online
	HIPAA Security – Required or Addressable DC Direct
	Amputees Across America 2003 Sports Page
	Drag Racing: How It Parallels O&P Sports Page
	Frank Caruso, CO Profiles
	ACA’s Roots Perspective
	From the Editor Viewpoints