|
|
vii | |
|
|
ix | |
Foreword |
|
xi | |
Preface |
|
xiii | |
Acknowledgments |
|
xvii | |
About the Author |
|
xix | |
|
Chapter 1 Why Information Security Is Important |
|
|
1 | (16) |
|
|
2 | (1) |
|
|
2 | (2) |
|
Drivers for Enhanced Security |
|
|
4 | (2) |
|
Electronic Health Record Adoption |
|
|
6 | (3) |
|
Health Information Exchange |
|
|
9 | (1) |
|
Identity Theft and Medical Identity Theft |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
Security for Important Information |
|
|
13 | (1) |
|
Make Information Security a Way of Life |
|
|
14 | (1) |
|
|
14 | (3) |
|
Chapter 2 Overview of HIPAA and HITECH |
|
|
17 | (16) |
|
|
17 | (1) |
|
HIPAA Administrative Simplification |
|
|
18 | (2) |
|
Purpose of the Privacy Rule |
|
|
20 | (3) |
|
Mini-Security Rule in the Privacy Rule |
|
|
23 | (4) |
|
|
27 | (2) |
|
Overview of the Security Standards |
|
|
29 | (2) |
|
|
31 | (1) |
|
|
31 | (2) |
|
Chapter 3 Your Approach to Security |
|
|
33 | (14) |
|
|
33 | (12) |
|
Step 1 Create a Culture of Privacy and Security, Awareness |
|
|
34 | (2) |
|
Step 2 Ensure a Solid Understanding of the Security Rule |
|
|
36 | (1) |
|
Step 3 Assign/Affirm Responsibility for Information Security |
|
|
37 | (1) |
|
Step 4 Conduct/Update a Risk Analysis |
|
|
37 | (1) |
|
Step 5 Develop/Maintain an Information Security Plan |
|
|
38 | (1) |
|
Step 6 Select Applicable Vendors for Security Services |
|
|
38 | (3) |
|
Step 7 Implement Security Policies, Procedures, and Services |
|
|
41 | (2) |
|
Step 8 Document Information Security Compliance |
|
|
43 | (1) |
|
Step 9 Develop/Manage Ongoing Security Monitoring |
|
|
44 | (1) |
|
Step 10 Incorporate Security Compliance into Overall Compliance Program |
|
|
44 | (1) |
|
Take a Positive Approach for Positive Results |
|
|
45 | (1) |
|
|
46 | (1) |
|
Chapter 4 Organizing for HIPAA |
|
|
47 | (18) |
|
|
47 | (1) |
|
|
48 | (2) |
|
Organizational Relationships |
|
|
50 | (4) |
|
|
54 | (1) |
|
|
55 | (7) |
|
Risk-Based Decision Making |
|
|
62 | (1) |
|
|
62 | (3) |
|
Chapter 5 Security Risk Analysis |
|
|
65 | (18) |
|
|
65 | (1) |
|
Risk Analysis and Risk Management Requirements |
|
|
65 | (1) |
|
Risk Analysis and Risk Management Process |
|
|
66 | (14) |
|
|
80 | (1) |
|
|
80 | (3) |
|
Chapter 6 HIPAA Security Administrative Safeguards |
|
|
83 | (34) |
|
|
83 | (2) |
|
Security Management Process Standard |
|
|
85 | (2) |
|
Workforce Security Standard |
|
|
87 | (6) |
|
Information Access Management Standard |
|
|
93 | (4) |
|
Security Awareness and Training Standard |
|
|
97 | (4) |
|
Security Incident Procedures Standard |
|
|
101 | (2) |
|
Contingency Plan Standard |
|
|
103 | (11) |
|
|
114 | (1) |
|
Importance of Administrative Safeguards |
|
|
115 | (1) |
|
|
115 | (2) |
|
Chapter 7 Business Associate Contracts and Other Arrangements Standard |
|
|
117 | (22) |
|
|
117 | (2) |
|
Business Associate Inventory |
|
|
119 | (1) |
|
Business Associate Contracts and Other Arrangements |
|
|
119 | (12) |
|
HIE Participating Agreements |
|
|
131 | (3) |
|
|
134 | (1) |
|
|
135 | (2) |
|
Importance of Business Associate and Other Relationships |
|
|
137 | (1) |
|
|
137 | (2) |
|
Chapter 8 HIPAA Security Physical Safeguards |
|
|
139 | (18) |
|
|
139 | (1) |
|
Physical Vulnerabilities and Threats |
|
|
140 | (1) |
|
Facility Access Controls Standard |
|
|
140 | (9) |
|
|
149 | (1) |
|
Workstation Security Standard |
|
|
149 | (2) |
|
Device and Media Controls Standard |
|
|
151 | (1) |
|
Apply Physical Controls to All PHI |
|
|
152 | (2) |
|
Physical Security and Safety |
|
|
154 | (1) |
|
|
155 | (2) |
|
Chapter 9 HIPAA Security Technical Safeguards |
|
|
157 | (32) |
|
|
157 | (1) |
|
|
158 | (5) |
|
Access Control Implementation Specifications |
|
|
163 | (3) |
|
|
166 | (4) |
|
|
170 | (3) |
|
Person or Entity Authentication Standard |
|
|
173 | (7) |
|
Transmission Security Standard |
|
|
180 | (2) |
|
|
182 | (4) |
|
Security Supports Confidentiality, Integrity, and Availability |
|
|
186 | (1) |
|
|
187 | (2) |
|
Chapter 10 Practical Tips for Applying Security Controls |
|
|
189 | (16) |
|
|
189 | (1) |
|
Budgeting for Security Controls |
|
|
190 | (2) |
|
Options for Managing Security Services |
|
|
192 | (3) |
|
Technical Security Controls Selection, Implementation, and Maintenance |
|
|
195 | (3) |
|
Responding to an OCR Complaint or Request for Audit |
|
|
198 | (3) |
|
|
201 | (2) |
|
|
203 | (1) |
|
|
203 | (2) |
Appendix: HIPAA Security Rule (Federal Register) |
|
205 | (8) |
Glossary |
|
213 | (12) |
Answer Key |
|
225 | (2) |
About the CD-ROM |
|
227 | (4) |
Index |
|
231 | |