Protecting Patient Information: A Decision-Maker's Guide to Risk, Prevention, and Damage Control PDF
Preview Protecting Patient Information: A Decision-Maker's Guide to Risk, Prevention, and Damage Control
Protecting Patient Information Page left intentionally blank Protecting Patient Information A Decision-Maker’s Guide to Risk, Prevention, and Damage Control Paul Cerrato Jason Andress, Technical Editor AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Syngress is an imprint of Elsevier 50 Hampshire Street, 5th Floor, Cambridge, MA 02139, USA Copyright © 2016 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our ar- rangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and expe- rience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described here- in. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or edi- tors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library Library of Congress Cataloging-in-Publication Data A catalog record for this book is available from the Library of Congress ISBN: 978-0-12-804392-9 For information on all Syngress publications visit our website at https://www.elsevier.com/ Publisher: Todd Green Acquisition Editor: Brian Romer Editorial Project Manager: Anna Valutkevich Project Manager: Priya Kumaraguruparan Designer: Mark Rogers Typeset by Thomson Digital Disclaimer The information in this book should not be regarded as legal advice but as educational content only. Readers should consult their legal or other profes- sional advisors before deciding how to apply this information in the work place. Similarly, any mention of commercial entities should not be regarded as endorsements by the author but is provided for educational purposes only. Page left intentionally blank This book is dedicated to Kathy, Dan, and Jessi, my fortress in an insecure world. Page left intentionally blank Contents ABOUT THE AUTHOR ....................................................................................xiii PREFACE ........................................................................................................xv CHAPTER 1 Dissecting a book title ............................................................1 CHAPTER 2 H ow well protected is your protected health information? Perception versus reality ..................................3 The cost of insecurity is steep ..........................................................5 A closer look at data breach fines ....................................................6 Do not ignore individual states in breach investigations ................10 Fines are only part of the problem ..................................................11 Factoring in the meaningful use program ......................................13 Calculating the cost of security .......................................................14 References .......................................................................................16 CHAPTER 3 Regulations governing protected health information .........19 Defining the crown jewels ...............................................................19 HIPAA privacy versus security rules: related but different ...........................................................................................22 Technology is only part of the equation ..........................................24 Enforcing HIPAA regulations ...........................................................25 A closer look at the HIPAA Security Rule ........................................26 The HIPAA Breach Notification Rule ...............................................27 The role of the Federal Trade Commission .....................................28 Do not forget State Laws .................................................................30 References .......................................................................................31 CHAPTER 4 Risk analysis .........................................................................33 Learning the jargon .........................................................................33 Compliance versus management ...................................................34 The ONC approach to risk analysis and security management ...................................................................................36 Finding the right analysis tools .......................................................40 ix
The list of books you might like
