MIS Planning

1
MIS Planning

• HIPAA Security

2
Are You Planning To

• Have an MIS?
• Comply with HIPAA Security rules?

3
MIS Planning

• Plan the work,thenWork the plan

4
What to Plan?

• I keep six honest serving men.
• They taught me all I know.
• Their names are What and Why and When
• and How and Where and Who.
• Rudyard Kipling

5
MIS Planning Questions

• What
• Why
• When
• How
• Where
• Who

6
What to Plan - The SCY GFA

• Development/adoption and maintenance of a
  Management Information System (MIS) that will
  facilitate collaboration and formation of a
  network of providers who can share appropriate
  information about youth for whom substance abuse
  services are being provided, and provide a
  mechanism for youth and their families to access
  information and services.

7
What to Plan - The SCY GFA

• Development/adoption (and)
• Maintenance of a Management Information System
  (MIS) (that will)
• Facilitate collaboration (and)
• Formation of a network of providers (who can)
• Share appropriate information about youth for
  whom substance abuse services are being provided,
  (and)
• Provide a mechanism for youth and their families
  to access information and services.

8
MIS Plan Contents (suggested)

• Requirements Analysis
• Acquisition/Development Plan
• Schedule
• Budget
• Staffing Plan
• Operations Plan
• Security Plan
• Training Plan

9
Its Your Plan

• Its iterative a living document
• Guides budgeting, staffing, scheduling
• Identifies the critical path
• Provides management control(i.e., Is it time to
  panic yet?)

10
HIPAA Security Rule
11
The Whole HIPAA
12
Security Fundamentals

• Access
• Integrity
• Availability

13
HIPAA Security Regulations

• The apple pie and Motherhood of information
  security best practices
• Not yet final (expected in August 2002)
• Effective 24 months after finalization
• Find the proposed rule athttp//aspe.hhs.gov/adm
  nsimp/

14
(No Transcript)
15
(No Transcript)
16
(No Transcript)
17
HIPAA Security Rule Matrix

• Taken directly from the proposed rule
• Will not be included as part of the CFR
• Details may change when rule is finalized

18
(No Transcript)
19
(No Transcript)
20
(No Transcript)
21
(No Transcript)
22
(No Transcript)
23
(No Transcript)
24
The Bottom Line

• Planning is not optional CSAT and HIPAA
  require it, and anyway, seat of the pants just
  doesnt work.
• Iteration is inevitable Youll never get
  everything the first time around.
• It never ends Theres always something.