<img style="float: right;" src="https://opedge.com/Content/OldArticles/images/2003-05_06/Masci-Joe.jpg" hspace="4" vspace="4" /> So you just finished your Privacy Rule compliance effort and are finalizing your Electronic Transaction and Code Set testing and now you hear rumors about the HIPAA Security Rule being finalized. Is it true? Yes. The Security Rule was finalized and published on February 20, and if you are a covered entity, you will have to comply with it. The good news is that the compliance date for the Security Rule is not until February 21, 2005. So as an O&P organization, why worry about the Security Rule now? What are the basics that your organization has to do in order to meet this rule? And just what is being secured? Over the next several months, I will provide you with facts, requirements and the steps to help you with your HIPAA Security compliance efforts. By starting your Security compliance efforts now, you can plan appropriately for the resources, training, and budget that will be needed to meet the Security requirements. So grab a folder, label it "Security," and file away a copy of The O&P EDGE every month. <h1>Do You Have To Comply?</h1> This is a simple determination. If you were required to comply with the Privacy Rule or Electronic Transactions and Code Sets Rule, you are a covered entity and will have to comply with the Security Rule also. <h1>What Will Be Protected by the Security Rule?</h1> Protected Health Information (PHI) that is transmitted or maintained electronically. Electronic media includes electronic storage media such as memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as a magnetic tape or disk, optical disk or a digital memory card. It also includes transmission media used to exchange information such as the Internet, an extranet, leased lines, dial-up lines, private networks and the physical movement of the removable/transportable electronic storage media. Electronic media does not include paper, fax, and voice via telephone. <h1>General Requirements</h1> An O&P organization that is a covered entity must do the following: <ul> <li>Ensure the confidentiality, integrity, and availability of all electronic protected health information that the covered entity creates, receives, maintains, or transmits;</li> <li>Protect against any reasonably anticipated threats or hazards to the security or integrity of such information;</li> <li>Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required by the Security Rule; and</li> <li>Ensure compliance of the Security Rule by its workforce.</li> </ul> <h1></h1> <h1>Required and Addressable Requirements</h1> The Department of Health and Human Services (DHHS) allows the covered entity to be flexible in its approach to reasonably and appropriately put into effect the standards and implementation specifications. DHHS provides the flexibility by stating whether a Security Rule is "required" or "addressable." <b>Required Specifications</b> If the specification is "required," the covered entity must implement the specification as stated in the Security Rule. <b>Addressable Specifications</b> If the specification is "addressable," then the covered entity must: 1. Assess whether the specification is a reasonable and appropriate safeguard in its environment and is likely to contribute to protecting the entity's electronic protected health information, and 2. Implement the specification or document why it would not be reasonable and appropriate. Implement an equivalent alternative measure if reasonable and appropriate. <h1>Next Article</h1> In our next article we will look into the Security Rule and its "required" and "addressable" implementation specifications. <i>While all information is believed to be correct at the time of writing, this article is informational only and does not constitute the rendering of legal, financial, or other professional advice or recommendations by Provaliant or individual members. If you require legal advice, you should consult with an attorney.</i> <i>Jay Masci is the principal consultant of Provaliant, a company providing IT consulting services including HIPAA compliance and customized training. Visit www.provaliant.com or contact Provaliant at 480.952.0656.</i>
