Realtime Community | IT Compliance

HIPAA And Surveillance In Hospitals

Thu, 05 Nov 2009 20:29:30 -0500

Over the years there have been many...too many...instances where doctors have performed the wrong types of surgeries on patients, and even the wrong surgeries on completely wrong patients...

CEs and BAs: Be HIPAA/HITECH Compliant Or Pay A Hefty Penalty

Thu, 29 Oct 2009 20:05:48 -0500

The HHS released HITECH Act Enforcement Interim Final Rule today...

Smart Grid Privacy: Laws and Implications

Wed, 21 Oct 2009 12:07:10 -0500

I was recently asked several questions about my work with the NIST Smart Grid privacy group and associated issues. Here are a couple of those questions, and my answers to them...

6 Critical Factors for Effective Information Security & Privacy Policies

Wed, 14 Oct 2009 09:49:45 -0500

I've been feeling bad about not posting to my blog as often as I have historically...

Who Are Your Business Associates?

Thu, 08 Oct 2009 20:33:00 -0500

Since just before HIPAA went actively into effect I've done a lot of HIPAA compliance work for covered entities (CEs). In the past few years I've done around 200 business associate (BA) information security and program reviews for just one CE, and these don't even scratch the surface for how many BAs each CE has...

HIPAA/HITECH Etc. Retention: Does Your Reality = Your Requirements?

Tue, 06 Oct 2009 20:14:16 -0500

Last month I had the great pleasure of being a guest on Scott Draughon and Anyck Turgeon's MyTechnologyLawyer.com radio show for a segment entitled, "Is encryption enough to achieve privacy?" I was pleasantly surprised to see a large number of great follow-up questions following the show! I covered one of them in my post, "Don't Throw Your Privacy Out The Window; Know How Your PII Is Used" Here are a couple more of those many questions I want to answer in this post...

Proposed HIPAA Privacy Rule Change Explicitly Makes Genetic Info PHI

Fri, 02 Oct 2009 16:00:39 -0500

An important element of data protection compliance is knowing, identifying and inventorying the applicable information...

Privacy For The Deceased

Wed, 30 Sep 2009 14:43:02 -0500

Late last month I posted, "HIPAA/HITECH Breach Notice Rule: Applies To PHI of Deceased Individuals + Training A Key Element" and since then I've had around half a dozen or so folks ask me to write about privacy for the deceased...

10 Smart Grid Consumer-to-Utility Privacy Concerns; Are There More?

Fri, 25 Sep 2009 10:55:54 -0500

I have had the great opportunity to participate in the NIST Smart Grid privacy standards group since July...

Don't Throw Your Privacy Out The Window; Know How Your PII Is Used

Wed, 23 Sep 2009 09:38:53 -0500

A couple of week's ago I had the great opportunity and pleasure to speak with the both equally delightful and brilliant Anyck Turgeon and Scott Draughon on MyTechnologyLawyer.com about "Is encryption enough to achieve privacy?" The feedback and followup to that show was spectacular! I got a ton of questions as a result. I will answer some of them here in the coming days. Here is the first...

How To Do Privacy Impact Assessments

Mon, 21 Sep 2009 19:22:27 -0500

Last week I was very fortunate to be able to speak at the IAPP Privacy Academy in Boston...

What Happens To Privacy During Pandemics?

Mon, 14 Sep 2009 19:45:11 -0500

I am talking to increasing numbers of privacy and information security pros who are concerned about not only getting their pandemic plans in place, but also wanting to know what kinds of privacy issues need to be addressed within the plans.

Is Encryption Enough to Achieve Privacy?

Thu, 10 Sep 2009 08:58:58 -0500

Of course the answer is no. But there are many reasons! Tune in this afternoon at 4:00pm Pacific time to hear Anyck Turgeon, Scott Draughon and me discuss this topic and talk about encryption laws and the impacts to privacy. Here is the information about the event...

HITECH Impacts Over 734,178 "Small Business" HIPAA Covered Entities

Wed, 09 Sep 2009 11:00:08 -0500

The Department of Health and Human Services (HHS) 45 CFR Parts 160 and 164: "Breach Notification for Unsecured Protected Health Information; Interim Final Rule" (Breach Notice Rule) has been written about a lot. But much of what is written overlooks some of the very interesting prologue within that document that is very important to consider to frame the context within which the regulation was written...

HITECH Act Virtual ToC

Fri, 04 Sep 2009 20:31:01 -0500

This was another very busy week, and I didn't have a chance to post as much as I would have liked. Part of what kept me busy was an unusually increased amount of email...