For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
HIPAA Compliance In 30 Days or Less
or
Other Security Stories
|
|
|
|
April 11, 2005 (Computerworld) -- HIPAA. We are all sick of the acronym by now, and the April 20 compliance deadline for the Health Insurance Portability and Accountability Act is looming.
At the state agency where I work, the information security officer (ISO), who is responsible for HIPAA security rule compliance, has spent the past seven months or so writing policies and procedures. He divided them into two groups: "required" (stuff we have to do) and "addressable" (stuff we'd better be thinking about doing).
When I came aboard, only one of the policies had been approved by the agency chiefs. Everything is done by consensus here -- if one chief doesn't like a single sentence, the policy is rejected, edited and then resubmitted. I was starting to panic about the approaching deadline. If we can't get the policies approved, we certainly can't implement them.
I did what any respectable security professional would do under the circumstances. First, I asked each chief to support the policy-approval process. Next, wanting to find a template that would be widely accepted but not wanting to reinvent the wheel, I went to the Web site of the National Institute of Standards and Technology (NIST) and downloaded every available document related to security and compliance with the HIPAA security rule.
Special Publication 800-66, titled "An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule," was just what our ISO needed: a step-by-step guide to compliance. A table on page 13 of this handy document defines each standard of the rule, identifies its section number and outlines implementation specifications, noting which ones are required and which are addressable. Even better, pages 16 through 54 describe various "key activities" and provide sample questions. This was the perfect project outline to give to a HIPAA newbie.
I went one step further and took the NIST outline and plunked it into Microsoft Project, defined major milestones, allocated resources and hung the Gantt chart on my wall. I also printed all of the related NIST documents and put them in a big binder.
I wanted to show my ISO how to formulate a project plan. I wanted him to understand what he was going to be held accountable for and how short the time frame for implementation was.
When I showed the plan to my boss, I felt the need to apologize for my micromanagement. "I don't usually go to this length with a direct report, but I need to get through to this guy that this is the quality of work we expect from him. He needs to execute this plan. If he can't, then he shouldn't be the ISO." My boss agreed.
In the Same Boat
I discovered that many state agencies are in the same boat. HIPAA requires them to appoint ISOs. But most agencies don't have much security expertise, and many agency administrators view the ISO role as more of an administrative function than a technical one.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
