<img style="float: right;" src="https://opedge.com/Content/OldArticles/images/2003-12_04/jay_masci.jpg" hspace="4" vspace="4" /> In the last article we covered the physical safeguard standards and have technical safeguards and organizational safeguards remaining. In this article we will cover the five technical safeguard standards in detail and how each one will affect your O&P organization. The standards in this article are more technical in nature and can be implemented by utilizing several different approaches. So if you have someone on staff who maintains your system, keep them handy to talk to them about options. Otherwise you may want to write down some questions to ask your information technology provider. <h2>1. Access Control Standard</h2> The Access Control Standard implements technical policies and procedures for electronic information systems that maintain electronic protected health information (PHI) to allow access only to those persons or software programs that have been granted access rights as specified in the administrative safeguard standards. <h3>Unique User Identification (Required)</h3> <b>Implementation specification:</b> Assign a unique name and or number for identifying and tracking user identity. <b>What it means to your organization:</b> Your organization should assign a unique name or number for every staff member that has access via a computer or other electronic device. Based on the assigned name or number, limit and grant access according to the administrative safeguard "information access management" standard. Basically "who" has access to "what information" and "what can they do with the information" (view, update, add, or delete). <h3>Emergency Access Procedure (Required)</h3> <b>Implementation specification:</b> Establish--and implement as needed--procedures for obtaining necessary electronic PHI during an emergency. <b>What it means to your organization:</b> In situations when normal environmental systems, including electrical power, have been severely damaged or rendered inoperative due to a natural or manmade disaster, procedures should be established beforehand to provide guidance on possible ways to gain access to needed electronic PHI. <h3>Automatic Logoff (Addressable)</h3> <b>Implementation specification:</b> Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. <b>What it means to your organization:</b> Your organization must implement procedures that logs a user off after a specific amount of inactivity or use an equivalent measure. For example, locking up the computer with a "password protected" screensaver after a specific amount of inactivity. <h3>Encryption and Decryption (Addressable)</h3> <b>Implementation specification:</b> Implement a mechanism to encrypt and decrypt electronic PHI. <b>What it means to your organization:</b> First note that this standard applies to electronic PHI that is at rest and NOT being transmitted. The use of encryption, as a method of access control, should be based on your organization's risk analysis. Encryption will require new software or updates to your existing system, and I strongly suggest talking to an information technology (IT) firm to help with your implementation. <h2>2. Audit Controls Standard (Required)</h2> <b>Implementation specification:</b> Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic PHI. <b>What it means to your organization:</b> Your organization is required to record uses within your electronic information system. Basically you must provide audit trail capability within your system which means being able to record and retrieve information on "who" did "what" to electronic PHI and "when" within your system. <h2>3. Integrity Standard (Addressable)</h2> <b>Implementation specification:</b> Implement policies, procedures, and mechanisms to protect electronic PHI from improper alteration or destruction. <b>What it means to your organization:</b> Often your system has integrity already built in that you may not be aware of, such as error-correcting memory and magnetic disc storage which are ubiquitous in hardware and operating systems today. For your organization, you want to make sure that, if data is updated (altered) or deleted, it is done through a process that ensures integrity, such as an audit trail or processes that employ digital signature or check sum technology. Most of your software will employ such integrity standards, and if your organization utilizes such software exclusively to alter or delete electronic PHI, you would meet this standard. <h2>4. Person or Entity Authentication (Required)</h2> <b>Implementation specification:</b> Implement procedures to verify that a person or entity seeking access to electronic PHI is the one claimed. <b>What it means to your organization:</b> Your organization must be able to authenticate that the person that is accessing the electronic PHI is who he or she claim to be. A simple approach is to require a password that the user must enter to log in. Other approaches are to use a "biometric" identification system, "digital signatures," or a "token" system that uses a physical device for user identification. <h2>5. Transmission Security</h2> Implement technical security measures to guard against unauthorized access to electronic PHI that is being transmitted over an electronic communications network. <h3>Integrity Controls (Addressable)</h3> <b>Implementation specification:</b> Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of. <b>What it means to your organization:</b> This basically restates the "integrity" standard we discussed earlier in this article, but it is being applied to electronic PHI data that is being transmitted. <h3>Encryption (Addressable)</h3> <b>Implementation specification:</b> Implement a mechanism to encrypt electronic PHI whenever deemed appropriate. <b>What it means to your organization:</b> The Department of Health & Human Services (DHHS) is encouraging organizations that transmit electronic PHI over the Internet to consider the use of encryption technology. If your organization is using dial-up lines, there is less of chance for a breach of security. Your organization should look at its risk assessment/analysis to determine the sensitivity of the data being transmitted and the method of transmission when determining how to address the encryption standard. In the next article, we will cover the organizational safeguard standards. This will complete the detailed look at all of the Security Rule standards and how each one will affect your O&P organization. While all information in this article is believed to be correct at the time of writing, this article is informational only and does not constitute the rendering of legal, financial, or other professional advice or recommendations by Provaliant or individual members. If you require legal advice, you should consult an attorney. <i>Jay Masci is the principal consultant of Provaliant, a company providing IT consulting services, including HIPAA compliance and customized training. Visit www.provaliant.com or contact Provaliant at 480.952.0656.</i>
