Encrypting health records
Patented next generation health encryption
To determine when information is “unsecured” and notification is required by the HHS and FTC rules, HHS is issuing an update to its guidance. This update to regulations specifies encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.
Entities subject to the HHS and FTC regulations that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information.
Best Practice Guidelines recommended by security experts for data at rest, transmission & sharing:
Encryption – Data that is encrypted is “Out of scope of the Law”. De-identification, access controls, key management, policy based, auditing and monitoring. Whilst there are many frameworks such as PCI DSS or ISO27001 or others many like the PCI DSS due to its prescriptive guidance.
Overall goals for organizations when implementing solution:
- Protect all 18 categories of ePHI data.
- Install solutions in a way that does not change business processes or require user re-training.
- Reduce initial and recurring compliance costs.
- Reduce operational costs.
- Ensure potential for security depth scaling as compliance requirements change
- Address, City, County, ZIP Code
- Elements of dates
- Telephone numbers
- Fax numbers
- Email addresses
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers
- Device identifiers
- IP Address
- Biometric identifiers
- Full face images
- Any other unique identifying data
Latest news and articles
This week the news broke that Mandiant (an incident response firm) attributed the recent cyberattack campaign targeting customers utilizing Barracuda’s Email Security Gateway to hackers