HIPAA Compliance
The Health Insurance
Portability and Accountability Act (HIPAA) are a set of standards for the
privacy and protection of all electronic health information. It includes a Privacy Rule and a
Security Rule, which require healthcare organizations to increase the security
of their patient-related data.
HIPAA
Regulations
The Security
Rule featuring Technical Safeguards lists a number of technical requirements
healthcare organizations must follow to protect health information. The Access
Control Standard requires a covered entity to “Implement technical policies and
procedures for electronic information systems that maintain electronic protected
health information to access only to those persons or software programs that
have been granted access rights as specified in § 164.308(a)(4)[Information
Access Management].” Four
implementation specifications are associated with the Access Controls standard
one of which is
encryption and decryption.
Encryption
and Decryption §
164.312(a)(2)(IV).
Where this implementation specification is a reasonable
and appropriate safeguard for a covered entity, the covered entity must
"Implement a mechanism to encrypt and decrypt electronic protected health
information."
Penalties for non-compliance
with HIPAA requirements include:
- Civil penalties of $100 per
violation up to $25,000 per year for each violation or prohibition
violated
- Criminal penalties for
knowingly violating patient privacy of up to $250,000 and 10 years
imprisonment
Sarbanes-Oxley Compliance
The Sarbanes-Oxley Act is
legislation created in response to past financial scandals to protect
shareholders and the general public from fraudulent practices. Because this set of laws requires that
financial institutions store relevant business records "not less than 5 years"
this affects IT departments greatly.
Securing data-at-rest
becomes an even greater concern to those companies that are affected by the
SOX Act
Penalties for non-compliance
with Sarbanes-Oxley requirements include:
- Criminal penalties for
knowingly violating patient privacy of up to $15,000,000 and 10 years
imprisonment
California Senate Bill 1386
The California SB Act
requires organizations that own or have access to personal information of
California residents to notify them if the security of their information is
compromised.
California SB 1386
Requirements:
According to California,
personal information includes "an individual's first name or first initial and
last name in combination with one or more of the following": a Social Security
Number, Drivers License number or California Identification Card number, account
number, and/or credit or debit card information including numbers and passwords,
PINs and access codes. The bill
also limits coverage to personal data that is "un-encrypted."
According
to the Bill, each organization must follow certain disclosure obligations
following the discovery of a security breach that may have compromised customer
data. "Notice must be given to any
resident of California whose personal information is or is reasonably believed
to have been acquired by an unauthorized person. " Notice must be given in "most
expedient time possible" and "without unreasonable delay" subject to certain
provisions that define what reasonable is for your organization.
For
those companies that hold personal data on California residents, it become
essential for IT departments to review the security of consumers personal
information.
Gramm-Leach Bliley Act
The Gramm-Leach Bliley Act
includes laws that govern the collection and disclosure of customers’ personal
financial information by financial institutions and requires all financial
institutions to design, implement and maintain safeguards to protect customer
information.
The Financial Privacy Rule
requires financial institutions to provide each consumer with a privacy notice
at the time the consumer relationship is established and annually
thereafter. The privacy notice must
explain the information collected about the consumer, where that information is
shared, how that information is used, and how that information is
protected.
The Safeguards Rule requires
financial institutions to develop a written information security plan that
describes how the company is prepared for, and plans to continue to protect
clients’ nonpublic personal information.
The Gramm-Leach Bliley Act
requires IT attention because they need to account for the security procedures
in place regarding protecting consumer data.
Penalties for non-compliance
with GLBA requirements include:
- Criminal penalties for
knowingly violating patient privacy of up to $1,000,000 and 10 years
imprisonment
PCI Data Security Standard
The Payment Card Industry
Data Security Standard is a set of comprehensive requirements for enhancing
payment account data security. The
PCI DSS includes requirements for security management, policies, procedures,
network architecture, software design and other critical protective measures.
This comprehensive standard is intended to help organizations proactively
protect customer account data.
Requirement
3: Protect stored cardholder data
Encryption is a critical component of cardholder
data protection. If an intruder
circumvents other network security controls and gains access to encrypted data,
without the proper cryptographic keys, the data is unreadable and unusable to
that person. Other effective
methods of protecting stored data should be considered as potential risk
mitigation opportunities. For
example, methods for minimizing risk include not storing cardholder data unless
absolutely necessary, truncating cardholder data if full PAN is not needed, and
not sending PAN in unencrypted e-mails.
Stated in this set of standards, encryption is a critical component to
protecting customer data.
BOSaNOVA's Q3 Storage
Encryption Solution assists in your compliance with the PCI Standard by
protecting your customer's data with encryption. The Q3 Storage Security Appliance
encrypts data-at-rest without affecting your current backup procedures.
Installation is quick and key management is strong yet simple.