HIMemo

NIST releases draft guide for HIPAA security rule

The National Institute of Standards and Technology (NIST) released the draft publication SP 800-66 Rev1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, on May 1.

The publication discusses security considerations and resources that covered entities may find valuable as they comply with the security rule. This included educating readers on security terms and concepts used and discussed in the security rule, according to the NIST Web site.

The publication is available on the NIST Web site. Comments will be accepted until June 13.

To view the publication, click here.

For more information or to comment on the publication, click here.

CMS releases final HIPAA Security Educational Paper

CMS released its final paper in the HIPAA Security Educational Paper Series, entitled "Security Standards Implementation for the Small Provider," on December 12, 2007. The final paper is intended to assist small healthcare providers' HIPAA security rule compliance, according to the CMS Web site.

The other papers in the series include:

• Security 101 for Covered Entities
• Security Standards Administrative Safeguards
• Security Standards Physical Safeguards
• Security Standards Technical Safeguards
• Security Standards Organizational, Policies and Procedures and Documentation Requirements
• Basic of Risk Analysis and Risk Management

To view the paper, click here.

[ via HIPAA Weekly Advisor ]

AHIMA, AMIA issue statement on privacy pre-emption

The American Health Information Management Association and the American Medical Informatics Association have teamed up to renew their positions in favor of a federal pre-emption of state health care privacy laws. The announcement was made in a joint policy statement released Sept. 7 on privacy and the development of a national health information network. The statement came as Congress prepares to reconcile two key healthcare information technology bills, one of which, H.R. 4157, until recently, contained federal pre-emption language.

The organizations' position on pre-emption has added significance as the groups' leaders, Jill Callahan Dennis, president of AHIMA, and Don Detmer, president and chief executive officer of AMIA, both sit on a new privacy work group of the American Health Information Community, an advisory panel to HHS Secretary Mike Leavitt. Current federal healthcare privacy provisions allow states to maintain their own healthcare privacy laws as long as they are more stringent than those in the federal rule.

The organizations argue that a uniform set of privacy rules is essential to the development of the national health information network. Following pressure from privacy advocates, however, language that would have given HHS the power to pre-empt state privacy laws for healthcare information was stripped from H.R. 4157 in July just before the bill passed the House. Its Senate counterpart, S. 1418, does not contain federal pre-emption language.

[ via Modern Healthcare's Daily Dose ]

Does HIPAA require us to keep the server room locked at all times?

Q: Does HIPAA require us to keep the server room locked at all times?

A: No. The HIPAA security rule does not include that much detail. Covered entities (and noncovered entities interested in adhering to sound security practices) may or may not choose to lock the server room door or, in larger organizations, the door to the data center.

It is important that you establish proper policies, procedures, and processes to limit server room access to only those who need it. Although HIPAA does not require that you lock server room and data center doors at all times, it is a beneficial security practice. Only work force members with a defined need to access the server room or data center should have key or swipe-card access.

Note: Chris Apgar, CISSP, president of Portland, OR-based Apgar & Associates, LLC, answered this question. This is not legal advice. Consult your attorney for legal matters.

[ via HIPAA Weekly Advisor ]