HIPAA's security requirements affect companies that store and transmit protected health information electronically. This includes healthcare providers, insurers and clearinghouses.

Enterprises that serve clients in the healthcare industry -- laboratories, collection agencies and lawyers, for example -- must also implement protections to secure There's no cookie-cutter approach for everyone. The standards don't specify any particular technology to adopt. They outline what must be done, not how to do it.

 

Organizations trying to figure out how to apply the standards must take into account their size, complexity, capabilities, compliance costs and the potential risks to their electronically protected health information.

Generally speaking, HIPAA security requires that:

• Administrative safeguards be in place to manage the selection and execution of security measures.
• Physical safeguards be in place to protect electronic systems and related buildings and equipment from environmental hazards and unauthorized intrusion.
• Technical safeguards be in place, including an automated processes to protect data and control access to it.
• Risk assessments are conducted and that security policies and procedures are documented.
• Organizations have a device to screen traffic from the Internet such as a firewall.

Covered entities with the exception of small health plans must comply with the security requirements by April 21. Small health plans -- those with fewer than 50 employees -- must comply by April 21, 2006.

 

< Prev		Next >