Not Just for Health Care Providers Any More - HITECH for Business Partners

Enacted on February 17, 2009, the Health Information Technology for Economic and Clinical Health Act, also known as the HITECH Act, was designed to protect the security and privacy of Personal Health Information (PHI). Although related to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act expands on the requirements to protect health information and has a wider scope for the entities that it covers. Under the HITECH Act, business partners of health care providers are now subject to HIPAA requirements and the penalties for violating the requirements. These new requirements for business partners become effective on February 17, 2010; one year to the day after the HITECH Act was signed into law by President Obama.

When many people think about data breaches and personal information, they tend to think about the loss of credit card information or Social Security numbers rather than medical information. However, over 220 data loss incidents recorded by the DataLossDB involved medical information over the last several years and there are certain to be countless other incidents that were either not publicly reported or have not yet been cataloged in the database. To this end, the HITECH Act will also establish a new breach notice requirement that will go into effect in September of 2010:

Sec. 13402. Notification In The Case Of Breach.
(a) In General.—A covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information (as defined in subsection (h)(1)) shall, in the case of a breach of such information that is discovered by the covered entity, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, or disclosed as a result of such breach.

It should be noted that many states do not include medical information in their data breach notification laws, but since the HITECH Act is federal legislation, all health care entities and their business partners are required to disclose a breach if it can be treated as “discovered”. Notification may include not only individual notices to those people affected, but also possibly notice to “prominent media outlets” and, where applicable, the Department of Health and Human Services.

As we mentioned in our blog post about Massachusetts 201 CMR 17, it is a good idea to know exactly where all of your sensitive information resides, regardless of whether it is inside your corporate network or "out in the field". According to the Department of Health and Human Services, “we have identified two methods for rendering PHI (personal health information) unusable, unreadable, or indecipherable to unauthorized individuals: encryption and destruction.” While data destruction is usually governed by individual corporate data retention policies, encryption now seems to be a prevalent concept across almost every industry and throughout the security community: encrypt all sensitive data, period.

Tenable’s Security Center, Log Correlation Engine (LCE), and Passive Vulnerability Scanner (PVS) and Nessus enable you to monitor logs and network traffic from your assets and alert you when a computer or other device has possibly fallen out of compliance with your security baselines or standards. The PVS can also look at many different types of network traffic and determine if data in transit is encrypted. Tenable provides content audit policy files for Nessus ProfessionalFeed to check for Windows system and user compliance with HIPAA, as well as a variety of file extensions that are used in medical insurance and claims through Electronic Data Interchange documents. If HIPAA and HITECH compliance auditing is of interest to your organization, you can request a copy of Tenable's HIPAA Application Notes and Product Evaluation guides that describe how specific HIPAA requirements can be monitored and reported on by using Tenable products. For additional information, you can also see NIST’s Special Publication 800-66 (Revision 1), An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.