hipaa training final draft

Information Technology UpdateInformation Technology UpdateHIPAA SECURITY RULEHIPAA SECURITY RULE

Faculty and Staff TrainingFaculty and Staff Training

HIPAA Security RuleHIPAA Security RuleAgendaAgenda

• What is the HIPAA Security RuleWhat is the HIPAA Security Rule– AuthorityAuthority– DefinitionDefinition– ScopeScope

• RequirementsRequirements– AdministrativeAdministrative– Physical Physical – Technical Technical – Individual ResponsibilitiesIndividual Responsibilities– EducationEducation– Security consciousnessSecurity consciousness– ReportingReporting– SanctionsSanctions

Information Technology SecurityInformation Technology SecurityNational Institute of Standards and TechnologyNational Institute of Standards and Technology

NIST SP 800-70: Security Configuration Checklists Program for IT NIST SP 800-70: Security Configuration Checklists Program for IT Products. Products.

““High Security:High Security: A High Security Environment is at high risk of A High Security Environment is at high risk of attack or data exposure, and therefore security takes precedence attack or data exposure, and therefore security takes precedence over usability. This environment encompasses computers that over usability. This environment encompasses computers that are usually limited in their functionality to specific specialized are usually limited in their functionality to specific specialized purposes. They may contain highly confidential information (e.g. purposes. They may contain highly confidential information (e.g. personnel records, medical records, financial information) or personnel records, medical records, financial information) or perform vital organizational functions (e.g. accounting, payroll perform vital organizational functions (e.g. accounting, payroll processing, web servers, and firewalls).”processing, web servers, and firewalls).”

HIPAAHIPAAHealth Insurance Portability and Accountability Act of 1996Health Insurance Portability and Accountability Act of 1996

Title IITitle II

Preventing Preventing Health Care Health Care Fraud and Fraud and

AbuseAbuse

Administrative Administrative SimplificationSimplification

Medical Medical Liability Liability ReformReform

SecuritySecurity• Administrative SafeguardsAdministrative Safeguards

• Physical SafeguardsPhysical Safeguards

• Technical SafeguardsTechnical Safeguards

Electronic Electronic Data Data

InterchangeInterchange

PrivacyPrivacy

HIPAA Security StandardsHIPAA Security StandardsWhat is the Security RuleWhat is the Security Rule

• Legislation designed to protect the confidentiality, Legislation designed to protect the confidentiality, integrity, and availability of electronic protected health integrity, and availability of electronic protected health information (ePHI).information (ePHI).

• Deadline for compliance Deadline for compliance April 20April 20thth, 2005, 2005!!

• Comprised of three main categories of “standards” Comprised of three main categories of “standards” pertaining to the pertaining to the administrative, physical, and technical administrative, physical, and technical aspects of ePHIaspects of ePHI

• Applies to the security and integrity of electronically Applies to the security and integrity of electronically created, stored, transmitted, received, or manipulated created, stored, transmitted, received, or manipulated personal health information.personal health information.

HIPAA Security StandardsHIPAA Security StandardsWhat is the Security RuleWhat is the Security Rule

Bottom Line:Bottom Line:

• We must assure that systems and applications We must assure that systems and applications operate effectively and provide appropriate operate effectively and provide appropriate confidentiality, integrity, and availability.confidentiality, integrity, and availability.

• We must protect information commensurate We must protect information commensurate with the level of risk and magnitude of harm with the level of risk and magnitude of harm resulting from loss, misuse, unauthorized access, resulting from loss, misuse, unauthorized access, or modification. or modification.

HIPAA Security StandardsHIPAA Security StandardsDefinitionsDefinitions

Confidentiality: “the property that data or information is Confidentiality: “the property that data or information is not made available or disclosed to not made available or disclosed to

unauthorized persons or unauthorized persons or processes.”processes.”

• Must protect against unauthorizedMust protect against unauthorized

– AccessAccess

– UsesUses

– DisclosuresDisclosures


Integrity: “the property that data or information has not Integrity: “the property that data or information has not been altered or destroyed in an been altered or destroyed in an

unauthorized unauthorized manner.” manner.”

• Must protect against improper destruction or alteration Must protect against improper destruction or alteration of dataof data

• Must provide appropriate backup in the event of a Must provide appropriate backup in the event of a threat, hazard, or natural disasterthreat, hazard, or natural disaster


Availability: “the property that data or information is Availability: “the property that data or information is accessible and usable upon accessible and usable upon

demand by an demand by an authorized person.” authorized person.”

• Must provide for ready availability to authorized personnelMust provide for ready availability to authorized personnel

• Must guard against threats and hazards that may deny Must guard against threats and hazards that may deny access to data or render the data unavailable when needed.access to data or render the data unavailable when needed.

• Must provide appropriate backup in the event of a threat, Must provide appropriate backup in the event of a threat, hazard, or natural disasterhazard, or natural disaster

• Must provide appropriate disaster recovery and business Must provide appropriate disaster recovery and business continuity plans for departmental operations involving continuity plans for departmental operations involving ePHI.ePHI.

HIPAA Security StandardsHIPAA Security StandardsWhat Constitutes PHI – Eighteen IdentifiersWhat Constitutes PHI – Eighteen Identifiers

• NameName

• Address -- street address, city, Address -- street address, city, county, zip code (more than 3 digits) county, zip code (more than 3 digits) or other geographic codesor other geographic codes

• Dates directly related to patient Dates directly related to patient

• Telephone NumberTelephone Number

• Fax NumberFax Number

• email addressesemail addresses

• Social Security Number Social Security Number

• Medical Record NumberMedical Record Number

• Health Plan Beneficiary Number Health Plan Beneficiary Number

• Account NumberAccount Number

• Certificate/License NumberCertificate/License Number

• Any vehicle or device serial numberAny vehicle or device serial number

• Web URL, Internet Protocol (IP) Web URL, Internet Protocol (IP) AddressAddress

• Finger or voice prints Finger or voice prints

• Photographic imagesPhotographic images

• Any other unique identifying Any other unique identifying number, characteristic, or code number, characteristic, or code (whether generally available in the (whether generally available in the public realm or not)public realm or not)

• Age greater than 89 (due to the 90 Age greater than 89 (due to the 90 year old and over population is year old and over population is relatively small)relatively small)

HIPAA Security StandardsHIPAA Security StandardsDefinitions continued…Definitions continued…

ePHI: data in an electronic format that contains any of the ePHI: data in an electronic format that contains any of the 18 identifiers18 identifiers

• This may include but is not limited to the following:This may include but is not limited to the following:

– Data stored on the network, internet, or intranetData stored on the network, internet, or intranet

– Data stored on a personal computer or personal digital Data stored on a personal computer or personal digital assistant ie. Palm pilotassistant ie. Palm pilot

– Data stored on “USB keys,” memory cards, external hard Data stored on “USB keys,” memory cards, external hard drives, CDs, DVDs, floppy disks, tapes, or digital drives, CDs, DVDs, floppy disks, tapes, or digital cameras/camcorderscameras/camcorders

– Data stored on your Data stored on your HOMEHOME computer computer

– Data utilized for researchData utilized for research

HIPAA Security StandardsHIPAA Security StandardsAdministrative SafeguardsAdministrative Safeguards

• Administrative Safeguards – “Administrative actions, policies, Administrative Safeguards – “Administrative actions, policies, and procedures to manage the selection, development, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect implementation, and maintenance of security measures to protect ePHI and to manage the conduct of the covered entity’s ePHI and to manage the conduct of the covered entity’s workforce in relation to the protection of that information.”workforce in relation to the protection of that information.”

• Bottom Line:Bottom Line:

– University Specialty Clinics must adopt policies and University Specialty Clinics must adopt policies and procedures to control access to ePHI.procedures to control access to ePHI.

– Each employee must be familiar with these policies and Each employee must be familiar with these policies and procedures at the institution and departmental levels.procedures at the institution and departmental levels.

HIPAA Security StandardsHIPAA Security StandardsAdministrative - AccessAdministrative - Access

• Access to ePHI is granted only to authorized individuals with a Access to ePHI is granted only to authorized individuals with a “need to know.”“need to know.”

• SOM computer equipment should only be used for authorized SOM computer equipment should only be used for authorized purposes in the pursuit of accomplishing your specific duties.purposes in the pursuit of accomplishing your specific duties.

• Installation of software without prior approval is prohibited. Installation of software without prior approval is prohibited.

• Disclosure of ePHI via electronic means is strictly forbidden Disclosure of ePHI via electronic means is strictly forbidden without appropriate authorization.without appropriate authorization.

• Do not use computer equipment to engage in any activity that is Do not use computer equipment to engage in any activity that is in violation of the SOM/USC policies and procedures or is illegal in violation of the SOM/USC policies and procedures or is illegal under local, state, federal, or international law. under local, state, federal, or international law.


• USCSOM will monitor logon attempts to the network.USCSOM will monitor logon attempts to the network.

• Inappropriate logon attempts should be reported to the Inappropriate logon attempts should be reported to the respective departmental level security designee. respective departmental level security designee.

• All USCSOM computer systems are subject to audit. All USCSOM computer systems are subject to audit.

• Access to the SOM network will be monitored.Access to the SOM network will be monitored.


• All computers should be manually locked, locked via a All computers should be manually locked, locked via a screen saver, or logged off when unattended.screen saver, or logged off when unattended.

• Computers with older operating systems (anything Computers with older operating systems (anything other than Windows 2000 or Windows XP) should:other than Windows 2000 or Windows XP) should:

– Utilize a “boot” passwordUtilize a “boot” password

– Utilize a screen saver with passwordUtilize a screen saver with password

– Shut down your computer when you leave for an Shut down your computer when you leave for an extended period of time.extended period of time.


• You must access University Specialty Clinics You must access University Specialty Clinics information utilizing information utilizing YOURYOUR username and username and password – password – NO PASSWORD SHARINGNO PASSWORD SHARING..

• You are personally responsible for access to any You are personally responsible for access to any information utilizing your password.information utilizing your password.

• You are subject to disciplinary action if You are subject to disciplinary action if information is accessed inappropriately utilizing information is accessed inappropriately utilizing your password.your password.

HIPAA Security StandardsHIPAA Security StandardsAdministrative – PasswordsAdministrative – Passwords

• Your user id and password are critical to ePHI security.Your user id and password are critical to ePHI security.

• Maintain your password in a secure and confidential Maintain your password in a secure and confidential mannermanner

– DO NOT keep an unsecured paper record of your passwords.DO NOT keep an unsecured paper record of your passwords.

– DO NOT post your password in open view e.g. on your monitor.DO NOT post your password in open view e.g. on your monitor.

– DO NOT share your password with anyone.DO NOT share your password with anyone.

– DO NOT use the same passwords for USCSOM and your DO NOT use the same passwords for USCSOM and your personal accountspersonal accounts

– DO NOT include passwords in automated logon processesDO NOT include passwords in automated logon processes

– DO NOT use “weak” passwordsDO NOT use “weak” passwords


• Passwords must be changed every 90 days.Passwords must be changed every 90 days.

• Passwords should be changed whenever there is a Passwords should be changed whenever there is a question of compromise.question of compromise.

• Strong passwords must be utilized when possibleStrong passwords must be utilized when possible

– A minimum of 8 characters in lengthA minimum of 8 characters in length

– Must contain a component from at least 3 of the 4 following Must contain a component from at least 3 of the 4 following categoriescategories

• Upper caseUpper case

• Lower caseLower case

• NumeralsNumerals

• Keyboard symbolsKeyboard symbols


Examples:Examples:

• I like to play with computers 2!I like to play with computers 2!

– Using the first letter of each word yields “Iltpwc2!”Using the first letter of each word yields “Iltpwc2!”

• I wish these silly passwords would go away!I wish these silly passwords would go away!

– Using the first letter of each word and a $ symbol Using the first letter of each word and a $ symbol yields “I$wtsPwga!”yields “I$wtsPwga!”

HIPAA Security StandardsHIPAA Security StandardsAdministrative – AccessAdministrative – Access

• Termination and/or transfer proceduresTermination and/or transfer procedures

– Administrative directors are responsible for informing the Administrative directors are responsible for informing the appropriate IT administrator of changes in an employee’s appropriate IT administrator of changes in an employee’s employment status. employment status.

– Upon termination of employment all USCSOM network Upon termination of employment all USCSOM network and PC access is terminated.and PC access is terminated.

– All ePHI and computer equipment (laptops, PDAs, etc.) All ePHI and computer equipment (laptops, PDAs, etc.) should be retrieved.should be retrieved.

– The use of a prior employee’s user-ids and passwords is The use of a prior employee’s user-ids and passwords is strictly forbidden. “Generic” user-ids are strictly forbidden.strictly forbidden. “Generic” user-ids are strictly forbidden.

HIPAA Security StandardsHIPAA Security StandardsAdministrative – Remote AccessAdministrative – Remote Access

• All ePHI stored or accessed remotely must be maintained All ePHI stored or accessed remotely must be maintained under the same security guidelines as for data accessed under the same security guidelines as for data accessed within the USCSOM network proper.within the USCSOM network proper.

• This applies to home equipment and Internet-based storage This applies to home equipment and Internet-based storage of data.of data.

• All ePHI should be kept in such a fashion as to be All ePHI should be kept in such a fashion as to be inaccessible to family members.inaccessible to family members.

HIPAA Security StandardsHIPAA Security StandardsAdministrative – Malicious SoftwareAdministrative – Malicious Software

Pirated software, “viruses,” “worms,” “Trojans,” Pirated software, “viruses,” “worms,” “Trojans,” “spyware,” and file sharing software e.g. Kazaa“spyware,” and file sharing software e.g. Kazaa

• All software installed on USCSOM equipment must be All software installed on USCSOM equipment must be approved by the department chairperson, administrative approved by the department chairperson, administrative director or their designee – typically the department level director or their designee – typically the department level security officer.security officer.

• Installation of software on USCSOM computers must be in Installation of software on USCSOM computers must be in compliance with USC software policy and applicable licensing compliance with USC software policy and applicable licensing agreements.agreements.

• Installation of personal software or software downloaded from Installation of personal software or software downloaded from the Internet is prohibited.the Internet is prohibited.


• Approved anti-virus software must be installed Approved anti-virus software must be installed and kept current on:and kept current on:

– All USC computer systems.All USC computer systems.

– Home equipment utilized to access the USCSOM Home equipment utilized to access the USCSOM network.network.

• Never disable anti-virus software.Never disable anti-virus software.

• Suspicious software should be brought to the Suspicious software should be brought to the attention of the IT technical support personnel attention of the IT technical support personnel immediately. immediately.


• Emails with attachments should not be opened if:Emails with attachments should not be opened if:

– The sender is unknown to youThe sender is unknown to you

– You were not expecting the attachmentYou were not expecting the attachment

– The attachment is suspicious in any wayThe attachment is suspicious in any way

– Do not open non-business related email attachments Do not open non-business related email attachments or suspicious web URLsor suspicious web URLs

– Do not open file attachments or URLs sent via instant Do not open file attachments or URLs sent via instant messaging.messaging.

HIPAA Security StandardsHIPAA Security StandardsAdministrative – Backup and RecoveryAdministrative – Backup and Recovery

• A system must be in place to ensure recovery from any A system must be in place to ensure recovery from any damage to computer equipment or data within a reasonable damage to computer equipment or data within a reasonable time period based on the criticality of function.time period based on the criticality of function.

• Each department must determine and document data Each department must determine and document data criticality, sensitivity, and vulnerabilities.criticality, sensitivity, and vulnerabilities.

• Each department must devise and document a backup, Each department must devise and document a backup, disaster recovery, and business continuity plan.disaster recovery, and business continuity plan.

• Backup data must be stored in an off-site location.Backup data must be stored in an off-site location.

• Backup data must be maintained with the same level of Backup data must be maintained with the same level of security as the original data.security as the original data.

HIPAA Security StandardsHIPAA Security StandardsAdministrative – Incident ReportingAdministrative – Incident Reporting

• All known and suspected security violations must be All known and suspected security violations must be reported. reported.

• Security incidents should be reported to the departmental Security incidents should be reported to the departmental Administrative Director or their designee. Administrative Director or their designee.

• SOM IT personnel should be contacted immediately to SOM IT personnel should be contacted immediately to initiate the appropriate investigative processes.initiate the appropriate investigative processes.

• Security incidents must be fully documented to include Security incidents must be fully documented to include time/date, personnel involved, cause, mitigation, and time/date, personnel involved, cause, mitigation, and preventive measures.preventive measures.

• Site surveys will be requiredSite surveys will be required– Semi-annually basis to reassess compliance, risks, and Semi-annually basis to reassess compliance, risks, and

vulnerabilities.vulnerabilities.

– When a new type of threat emergesWhen a new type of threat emerges

• Backup, disaster recovery, and business continuity Backup, disaster recovery, and business continuity procedures will be reviewed and tested to determine procedures will be reviewed and tested to determine their adequacy.their adequacy.

• Any changes or additions to departmental electronic Any changes or additions to departmental electronic assets must be made in conjunction with SOM IT assets must be made in conjunction with SOM IT personnel and after performance of a proper risk personnel and after performance of a proper risk assessment.assessment.

Information Technology SecurityInformation Technology SecurityAdministrative –AssessmentsAdministrative –Assessments

HIPAA Security StandardsHIPAA Security StandardsPhysical SafeguardsPhysical Safeguards

• Physical Safeguards – “the security measures to protect a Physical Safeguards – “the security measures to protect a covered entity’s electronic health information systems and covered entity’s electronic health information systems and related buildings and equipment from natural and environmental related buildings and equipment from natural and environmental hazards and unauthorized intrusion.”hazards and unauthorized intrusion.”


– Electronic assets must be protected from physical damage and Electronic assets must be protected from physical damage and thefttheft..

HIPAA Security StandardsHIPAA Security StandardsPhysical – Media and DevicesPhysical – Media and Devices

• All electronic devices containing ePHI should be All electronic devices containing ePHI should be secured behind locked doors when applicable.secured behind locked doors when applicable.

• All applicable SOM electronic media containing ePHI All applicable SOM electronic media containing ePHI should be marked as confidential.should be marked as confidential.

• Special security consideration should be given to Special security consideration should be given to portable devices (PDAs, laptops, smart cell phones, portable devices (PDAs, laptops, smart cell phones, digital cameras, digital camcorders, external hard digital cameras, digital camcorders, external hard drives, CDs, DVDs, USB “drives,” and memory cards) drives, CDs, DVDs, USB “drives,” and memory cards) to protect against damage and theft.to protect against damage and theft.

HIPAA Security StandardsHIPAA Security StandardsPhysical – Media and DevicesPhysical – Media and Devices

• Private Health Information must never be stored on Private Health Information must never be stored on mobile computing devices or storage media unless the mobile computing devices or storage media unless the following minimum requirements are met:following minimum requirements are met:

– Power-on or boot passwordsPower-on or boot passwords

– Auto logoff or password protected screen saversAuto logoff or password protected screen savers

– Encryption of stored data by acceptable encryption Encryption of stored data by acceptable encryption software approved by the IT Security Officer or software approved by the IT Security Officer or designee e.g. designee e.g. TrueCryptTrueCrypt®®

Information Technology SecurityInformation Technology SecurityPhysical Facilities and HIPAAPhysical Facilities and HIPAA

§ 164.310 Physical safeguards.§ 164.310 Physical safeguards.A covered entity must, in accordance with § 164.306:A covered entity must, in accordance with § 164.306:

Standard: Facility access controls. Standard: Facility access controls. Implement policies and Implement policies and procedures to limit physical access to its electronic procedures to limit physical access to its electronic information systems and the facility or facilities in which information systems and the facility or facilities in which they are housed, while ensuring that properly authorized they are housed, while ensuring that properly authorized access is allowed.access is allowed.

Facility security plan Facility security plan (Addressable). Implement policies and (Addressable). Implement policies and procedures to safeguard the facility and the equipment procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and therein from unauthorized physical access, tampering, and theft.theft.

Information Technology SecurityInformation Technology SecurityPhysical Facilities and HIPAAPhysical Facilities and HIPAA

§ 164.310 Physical safeguards.§ 164.310 Physical safeguards.A covered entity must, in accordance with § 164.306:A covered entity must, in accordance with § 164.306:

Access control and validation procedures Access control and validation procedures (Addressable). Implement (Addressable). Implement procedures to control and validate a person’s access to facilities procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and based on their role or function, including visitor control, and control of access to software programs for testing and revision.control of access to software programs for testing and revision.

Maintenance records Maintenance records (Addressable). Implement policies and (Addressable). Implement policies and procedures to document repairs and modifications to the procedures to document repairs and modifications to the physical components of a facility which are related to security physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).(for example, hardware, walls, doors, and locks).

HIPAA Security StandardsHIPAA Security StandardsPhysical – File ServersPhysical – File Servers

• File Servers and other mass storage devices must File Servers and other mass storage devices must be installed in access-controlled areas to prevent be installed in access-controlled areas to prevent damage, theft, and access to unauthorized damage, theft, and access to unauthorized personnel.personnel.

• This area must provide appropriate levels of This area must provide appropriate levels of protection against fire, water, and other protection against fire, water, and other environmental hazards such as extreme environmental hazards such as extreme temperatures and power outages/surges.temperatures and power outages/surges.

HIPAA Security StandardsHIPAA Security StandardsPhysical – WorkstationsPhysical – Workstations

• Position workstations so as to avoid viewing by Position workstations so as to avoid viewing by unauthorized personnel.unauthorized personnel.

• Use privacy screens where applicable.Use privacy screens where applicable.

• Use automatic password protected screen savers.Use automatic password protected screen savers.

• Lock, logoff or shut down workstations when Lock, logoff or shut down workstations when not attended.not attended.

• Workstation access should be controlled based Workstation access should be controlled based on job requirements.on job requirements.

HIPAA Security StandardsHIPAA Security StandardsPhysical – NetworkPhysical – Network

• Additions to or alterations of the USCSOM network is Additions to or alterations of the USCSOM network is strictly prohibited. This includes:strictly prohibited. This includes:

– Physical connections via wired or fiber optic meansPhysical connections via wired or fiber optic means

– Wireless connectionsWireless connections

– Configuration changesConfiguration changes

• All wireless network communications require proper All wireless network communications require proper security protocols and encryption technology managed security protocols and encryption technology managed by the USCSOM Office of Information Technology.by the USCSOM Office of Information Technology.

HIPAA Security StandardsHIPAA Security StandardsPhysical – Information DisposalPhysical – Information Disposal

• Disposal of electronic data must be done in such a fashion as to Disposal of electronic data must be done in such a fashion as to ensure continued protection of ePHI.ensure continued protection of ePHI.

• Magnetic media must be erased with a degaussing device or Magnetic media must be erased with a degaussing device or approved software designed to overwrite each sector of the disk. approved software designed to overwrite each sector of the disk. This must be done prior to disposal or reuse.This must be done prior to disposal or reuse.

• All media containing ePHI must be disposed of in compliance All media containing ePHI must be disposed of in compliance with the SOM Electronic Data Disposal Policy.with the SOM Electronic Data Disposal Policy.

• CDs and DVDs must be broken, shredded, or otherwise defaced CDs and DVDs must be broken, shredded, or otherwise defaced prior to being discarded.prior to being discarded.

HIPAA Security StandardsHIPAA Security StandardsPhysical – Information TransferPhysical – Information Transfer

• Hard drives sent to vendors outside the Hard drives sent to vendors outside the USCSOM for data recovery or for warranty USCSOM for data recovery or for warranty repairs require a Business Associate Agreement repairs require a Business Associate Agreement between USC Specialty Clinics and the specified between USC Specialty Clinics and the specified vendor. vendor.

HIPAA Security StandardsHIPAA Security StandardsTechnicalTechnical

• Technical Safeguards – “the technology and the policy and Technical Safeguards – “the technology and the policy and procedures for its use that protect electronic protected health procedures for its use that protect electronic protected health information and control access to it.”information and control access to it.”


– Technological solutions are required to protect ePHI where Technological solutions are required to protect ePHI where applicable. applicable.

– Examples include data encryption and secure data transfer Examples include data encryption and secure data transfer over the network.over the network.

HIPAA Security StandardsHIPAA Security StandardsTechnical – NetworkTechnical – Network

• All wireless network communications require All wireless network communications require proper security protocols and encryption proper security protocols and encryption technology.technology.

• Wireless networking must be configured and Wireless networking must be configured and managed by the USCSOM Office of Information managed by the USCSOM Office of Information Technology.Technology.

• All electronic transmission of ePHI must be All electronic transmission of ePHI must be appropriately encrypted.appropriately encrypted.

HIPAA Security StandardsHIPAA Security StandardsTechnical – NetworkTechnical – Network

• Private Health Information residing on any form Private Health Information residing on any form of electronic media or computing device must be of electronic media or computing device must be encrypted if stored or taken off-site e.g. Backup encrypted if stored or taken off-site e.g. Backup CDs, DVDs, external Hard Drives, etc.CDs, DVDs, external Hard Drives, etc.

• Encryption must be achieved through software Encryption must be achieved through software approved by the SOM IT Department Security approved by the SOM IT Department Security Officer or designee, e.g. Officer or designee, e.g. TrueCryptTrueCrypt®®

• Change is painful but necessaryChange is painful but necessary

• Paradigm shift in IT philosophy for USCSOMParadigm shift in IT philosophy for USCSOM

• Provide a re-designed IT infrastructure that will enable Provide a re-designed IT infrastructure that will enable us to embrace future technological developmentus to embrace future technological development

• Provide for the security of the USCSOM’s valued Provide for the security of the USCSOM’s valued electronic assetselectronic assets

• Provide a tremendous opportunity to enhance patient Provide a tremendous opportunity to enhance patient care, collaborative research, and teachingcare, collaborative research, and teaching

Information Technology UpdateInformation Technology UpdateSummarySummary

Questions?Questions?

Information Technology UpdateInformation Technology Update