Data Security

Laws and Regulations

Numerous federal and common laws affect the way data are secured by individuals and within systems. A few of the federal laws that affect healthcare are the Computer Fraud and Abuse Act, the Computer Security Act of 1987, the Electronic Communications Privacy Act of 1986, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Information Infrastructure Protection Act of 1996, and the Security and Freedom Through Encryption Act of 1999. In some instances where providers or hospitals offer financial plans, they are covered by the Sarbanes-Oxley Act of 2002. The main law that covers data security in the healthcare arena is HIPAA's Security Rule, Title 45 CFR (Code of Federal Regulations) Parts 160, 162, and 164, which had a compliance date of April 20, 2005.

The Security Rule applies only to covered entities—namely, healthcare providers, healthcare clearinghouses, and healthcare plans. The Security Rule requires that each covered entity institutes a security plan that meets or exceeds the security standards as set forth in the rule to protect the confidentiality, integrity, and availability of electronically protected health information and other information as set forth in the rule. The standards are divided into three categories: administrative, physical, and technical. Administrative safeguards require a risk analysis, contingency/disaster recovery plans, personnel security measures, sanctions, security policies and procedures, termination procedures, and training requirements. The physical safeguards cover media controls, physical access controls, workstation controls and procedures, and security awareness training. The technical safeguards pertain to system access controls, encryption, authorization controls, data authentication, and access authentication. These standards are either required or addressable. A required standard must be implemented. An addressable standard can be implemented as described in the rule, or the entity can justify why it chose another method to meet the standard.

The common laws that affect data security are numerous and usually are called into force through civil litigation when due diligence or due care is in question. Due diligence requires that an organization make and continue to make a valid effort to protect the confidentiality, integrity, and availability of the data. Due care requires the organization to act as any prudent and rational organization would when trying to protect the security of the data. One law that is not always enforced by court action is the law that grew from the norms, morals, and common laws of the land—ethics. Ethics [Page 282]guides professionals, especially in healthcare, to do no harm and to protect the confidentiality of the patient or client.

...