HIPAA PHI Compliance » PHI Secuity

HIPAA Penetration Testing

admin — Wed, 31 Aug 2011 17:19:05 +0000

Is your (PHI) patient data secured? Are you in compliance with all HIPAA Regulations? The only real way to know is to preform extensive system penetration testing. Penetration testing of both internal and external systems is an extremely important step towards compliance and it serves as a valuable tool. Standard testing includes real world hacking techniques, the results of which can help an organization understand and address system vulnerabilities before a security breach occurs.

Testing often reveals actual, exploitable security threats. Identifying these issues early will allow you to safely identify which vulnerabilities are critical, which are insignificant, and which are false positives. Make informed decisions about the real risks to your network and assists you in prioritizing remediation efforts.

HIPAA IT security compliance regulations and guidelines require an organization to conduct independent testing of the Information Security Program, to identify vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information.

Best Practices recommend that each organization perform an Internal and external Penetration Tests in addition to regular Security Assessments in order to ensure the security of their internal & external networks.

Disk Encryption, Data Security & RAM

admin — Fri, 19 Aug 2011 13:27:52 +0000

It’s no secret that computer scientists have discovered ways to bypass many of the popular forms of encryption used to secure the local hard disk in your desktop or laptop computer. Of course, fully realizing this is a little concerning, especially when you are in the IT field, and needing to protect and secure PHI.

Understanding the way disk encryption works will help you to understand some of the vulnerabilities. Without getting into the finer details encryption, keeping the technical jargon on the sideline, let’s just say successful encryption is based on a pair of keys, if the keys match the data is unlocked, it is really that simple. Not much different than how a lock in a door works. What if someone stole or copied your key? Well if it were your house key it would mean someone has access to your house and its contents and if it were your computer the reality isn’t much different.

Computers systems encryption technologies store the secret encryption key in memory (RAM) once the disk has been authenticated (unencrypted). The fact is that while the data (Secret key) is loaded into RAM, it is venerable. Unfortunately, there are no technologies that protect keys that are already in memory. This is a pretty serious issue if you use a laptop that contains sensitive information (PHI or HIPAA related protected information) and you travel with it in sleep mode because the RAM (random access memory) still contains the secret key. If your laptop were stolen by someone with the knowhow and bad intentions your data is not safe. However, if the computer is shut off while in transit, the random access memory is cleared within a few minutes under normal operating temps, and your data would be secure. This scenario applies to office computers that are encrypted but utilize the sleep feature rather than be shut down at night. Various methods, all including physical access to the encrypted PC (Firewire, USB, Serial Port access) have been used to discover secret encryption keys. Since these issues require physical access (unless otherwise infected with something that allows a remote attacker) the computer laptops are the greatest concern.

HIPAA Compliance Training – Online Certification Courses

admin — Fri, 14 Jan 2011 16:48:54 +0000

There is no shortage of companies claiming to provide HIPAA certification courses online. The bullet points below represent the types of services these companies claim to provide. It makes me wonder if any of them really provide proper HIPAA compliance certifications as their advertisements suggest. Some companies offer a HIPAA Compliance Free Download. To my surprise much of the online course material is good. Like anything else we found you do get what you pay for. Do you homework, compare a few companies offerings, and you can get valuable HIPAA training online.

• HIPAA Online Training $25, 3 Levels of Training, Basic $25 Advance $45 & Masters $75
• Train Online with WebEx, Deliver High-Impact Training to Global Employees. Learn More Now!
• HIPAA Training – $3.95, Online Courses From $3.95 to $7.95 Per Training. 50 Training Minimum.
• HIPAA Compliance Free Download – Top 5 Ways To Automate HIPAA Compliance
• HIPAA Compliance Ensure Protection of Patient Data & HIPAA Compliance. Free Data Sheet
• HIPAA Masters Course $75, HIPAA Masters Degree, The Highest Level of HIPAA Training.
• Compliance Training, E-learning compliance courses for financial institutions.
• HIPAA Training at $29.99 Online Training and Certification Get Certified in Less Than 1 Hour.

We can not endorse any one particular HIPAA Compliance Training Course but we do encourage you to explore all of your options before picking the right online solution for your organization.

Government Encryption Standard | Advanced Encryption Standard (AES)

admin — Sat, 06 Mar 2010 21:45:58 +0000

Government data encryption standards require health care providers, health insurance companies and business associates who transmit, store or access protected health information in electronic form to utilize a standardized level of data encryption. The Advanced Encryption Standard (AES) is Federal Information Processing Standards (FIPS) approved cryptographic algorithm used to protect electronic data. The Advanced Encryption Standard (AES) is widely used across the healthcare industry to secure data-at-rest, data-in-motion and data-in-transit. To be in compliance with Government regulations many software applications are rapidly incorporating the AES algorithm into current and future products.

What is AES?
Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) information. Encryption converts data to an unintelligible form called ciphertext; decrypting the ciphertext converts the data back into its original form, called plaintext. The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits.

History of AES:
Advanced Encryption Standard (AES) is an encryption standard adopted by the U.S. government. The standard comprises three block ciphers, AES-128, AES-192 and AES-256, adopted from a larger collection originally published as Rijndael. Each AES cipher has a 128-bit block size, with key sizes of 128, 192 and 256 bits, respectively. The AES ciphers have been analyzed extensively and are now used worldwide, as was the case with its predecessor, the Data Encryption Standard (DES).

2009 HIPAA Regulations – Security and Privacy Measures

admin — Wed, 23 Sep 2009 14:50:08 +0000

Most health care organizations are now actively interested in implementing the security and privacy measures called for by the HIPAA regulations and are wondering how to get started with this complex, long-lived, and expensive task. This document was developed to help organizations that handle PHI address the HIPAA security and privacy regulations.

Awareness is important at all levels of the organization, but at the early stages it is most essential for middle and upper management. HIPAA planning cannot move forward in any substantial way until the stakeholders of the organization are actively engaged in creating plans and organizational approaches and developing cost estimates. HIPAA is a compliance issue; treat it as one.

It is important for everyone, especially senior managers, to understand that HIPAA is a
regulatory compliance project rather than simply an IT initiative. Treating it as a compliance issue is much more likely to lead to the appropriate organization, attention level, and allocation of resources. Resources need to be in the budget cycle for the upcoming fiscal year in order to meet the aggressive timeline.

Standardize your Approach:
Many of the security and privacy requirements can best be met by creating guidelines, principles, templates, and checklists that are then used consistently in each domain (e.g., system, department, division); This will save staff time by creating an efficient, consistent approach. Consistency will make the system more understandable to those who work across various domains and will make the approach more defensible to those with oversight roles (e.g., risk managers, external auditors, JCAHO).

Success Requires Cultural Change:
To run a successful HIPAA-compliant operation, most organizations will have to go through a cultural change in how they manage privacy and security until the new methods become systematic and reflexive. Responses that are not common now will need to become so for a large percentage of the workforce. Many of the HIPAA requirements point up the need for this kind of “new common sense.” Widespread cultural change requires commitment and leadership across an organization.