Information Security for HIPAA

1
Information Security for HIPAA

• First Meeting for
• Researchers
• Michael Caputo
• December 17, 2002

2
What Information?
Electronic Computers PDAs (i.e. Palm
Pilots) Servers Back-up Disks Websites Documents
Hard Copy Reports Papers Lab
tests Photographs Video tapes Files
3
Computer Systems

• Passwords
• Must have passwords
• Must be complex
• Must expire
• Who needs access?
• Saving Files
• NOT on the hard drive
• Server with appropriate level of security
• Added responsibility for System Administrators
• Screen saver
• Must time out and require password
• 5 minutes

4
Computer Systems (Continued)

• Personal Digital Assistants (PDAs)
• Palm Pilot, Ipaq, etc.
• Must establish a policy for security
• Passwords
• Limited number of logon attempts
• Auto deletion of information
• E-mail
• Policy for regular email (no PHI)
• Policy for secure email
• Encryption
• Low impact for COM FAHC, High impact for outside

5
Physical Security

• Restricted Access
• Locked file cabinets
• Locked Doors
• Back-ups kept in secure areas
• Tapes, disks, reports, etc.
• Common Sense
• Do not leave files in common areas
• Desk, conference room, lab, or in the mail
• Shred information no longer needed
• Dont toss it in the trash
• Passwords should be kept secret

6
Training

• Training specific to researchers
• Online training programs
• Will record user ID
• Test
• Grade will be recorded
• May require periodic retesting

7
What NOT to do (or continue to do)

• Password on a yellow sticky on your computer
• Password on a yellow sticky under your keyboard
• Password on a piece of paper in your desk
• Password on a piece of paper in your wallet
• Let someone logon using your password
• Give someone your office key
• Keep PHI files on your home computer