Encrypting health records

Patented next generation health encryption

HIPAA Security Rule and HITECH compliance requires implementation of a mechanism to protect all electronic protected health information (ePHI). The HITECH Act requires the disclosure of data breaches of “unprotected” (unencrypted) personal health records (PHR), including those by business associates, vendors and related entities. Source.

To determine when information is “unsecured” and notification is required by the HHS and FTC rules, HHS is issuing an update to its guidance. This update to regulations specifies encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.
Entities subject to the HHS and FTC regulations that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information.

Best Practice Guidelines recommended by security experts for data at rest, transmission & sharing:

Encryption – Data that is encrypted is “Out of scope of the Law”. De-identification, access controls, key management, policy based, auditing and monitoring. Whilst there are many frameworks such as PCI DSS or ISO27001 or others many like the PCI DSS due to its prescriptive guidance.

Overall goals for organizations when implementing solution:

Protect all 18 categories of ePHI data.
Install solutions in a way that does not change business processes or require user re-training.
Reduce initial and recurring compliance costs.
Reduce operational costs.
Ensure potential for security depth scaling as compliance requirements change