requirements to maintain health information

Home

Products

HP Systems

HP 9000 Servers

HP 9000 Workstations

Intel Systems

HP 3000 Servers

IBM Systems

IBM P Series

IBM I Series

IBM X Series

Sun Microsystems

Sun Microsystems Desktops

Sun Microsystems Servers

Storage Solutions

Tape Drives

SGI Systems

SGI Servers

SGI Storage Solutions

Traffic Management and Load Balancing Solutions

jetNEXUS

jetNEXUS ALB-X

jetNEXUS Enterprise Traffic Manager

Zeus Technologies

Storage Solutions

Hitachi Storage

LSI Storage

Nexsan Storage

HP Storage

IBM TotalStorage Storage

IBM XIV Storage

Sun Storage

SGI Storage Solutions

PAC Storage

PivotStor

LeftHand Networks Storage

Quantum Storage

Glossary of Storage Terms

Computer Peripherals

Memory

Disk & Tape Drives

Monitors & Terminals

Printers

Test and Measurement Equipment

Digital Multi-Meter

Oscilloscopes

Signal Generators

Spectrum Analyzers

Network Analyzers

Logic Analyzers

Available Products

Solutions

Virtualization

Server and Storage Virtualization

Virtualize Everything

VMware Virtualization Products

Virtualization Assessment

Desktop Virtualization

Computing Infrastructure

Desktop to Datacenter Computing

Data Deduplication

Networking

Storage

Data Life Cycle Management

Content Addressable Storage

Compliance

Encryption

Secure Shredding

BakBone Backup and Recovery

NetVault Overview

BakBone Encryption Module

BakBone VMWare Plug-in Module

BakBone VaultDR Plug-in Module

BakBone VaultShare Plug-In Module For ACSLS

BakBone Open File Manager Plug-In Module

Virtual Tape Library (VTL) - Shared Virtual Tape Library
 (SVTL)

BakBone Virtual Tape Library VTL

BakBone Shared Virtual Tape Library SVTL

BakBone Open Systems SnapVault OSSV

Network Attached Storage

BakBone NDMP Plug-In Module

BakBone SnapMirror To Tape Plug-In Module

BakBone Snapshot Manager Plug-In Module

BakBone SnapVault Manager Plug-In Module

NetVault: Backup SmartClients

BakBone NetVault Backup SmartClients

NetVault: Report Manager Pro

BakBone NetVault Report Manager Pro For Backup

BakBone NetVault Report Manager Pro For Disk Space

BakBone NetVault Report Manager Pro For Exchange

Application Data Protection

NetVault: Backup Application Plug-In Modules (APMs)

BakBone NetVault Backup APM For Oracle

BakBone NetVault Backup APM For SQL Server

BakBone NetVault Backup APM For SharePoint

BakBone NetVault Backup APM For Exchange

BakBone NetVault Backup APM For MySQL

BakBone NetVault Backup APM For Informix

Real Time Protection

BakBone NetVault Replicator

BakBone NetVault TrueCDP

Business Continuance

Disaster Preparedness

Remote Data Replication

Hot Sites

HIPAA and EPHI Healthcare Compliance

Maintain Accountability for Electronic Media

Maintain Accountability for Hardware and Electronic Media

Manage health care professionals who have access to
 sensitive data

Implement a Mechanism to Authenticate EPHI

Asset Protection, Recovery and Disposition

Trade In - Trade Up - Upgrade

Rent or Lease

Buy Back

Professional Services

On-site Support Services

Technical Consulting

Hardware & Software Rentals

Asset Recovery and Disposal Services

Request for Quote

About Us

Contact Us

Recent News

Directions To Our Headquarters

Some Examples of our Certifications...

Sun Microsystems Sales/Service

Hewlett Packard Certified Technical Professionals

VMware Certified Professionals

IBM Server Consolidation

IBM pSeries AIX System Support

LSI Metastor

Oracle DBMS

BakBone Netvault Backup Certified Administrators

Windows MCSE

Red Hat Linux

Quantum iSeries and DXi-Series Experts

Assureon DLM

StoreAge Split Site Mirroring

Sun Microsystems/STK Installation Provider

Authorized GSA Advantage

HIPAA - Maintain Accountability for Electronic Media
====================================================

Maintain Accountability for Electronic Media

Electronic media – which is just a fancy way of saying tape for the
most part. Although there are other somewhat riskier technologies out
there like thumb drives and memory sticks that do present challenges,
we will focus on magnetic tape.

 

Patient data is stored on electronic media today and that data needs
to be backed up or replicated as part of a sound disaster recovery
plan. Even though replication is an excellent way of keeping the data
in house, it is still a rather expensive solution as compared to the
cost of tape.

As the responsible IT person or CIO/CTO, one of your jobs is to make
sure the data gets backed up and stored in a secure location where it
can be used to bring your organization back to life in case of a
catastrophic failure at the production site. Unfortunately, this
process puts the user data at risk. Once it leaves the building it has
the potential for being lost or stolen. If it does – bad things happen
and they happen to you.

Here are a few examples where bad things happen to good people –

A backup tape containing the dates of birth, medical records and
Social Security numbers of more than 16,000 held by the Department of
Veterans Affairs Regional Counsel Office in Indianapolis. The VA might
offer credit monitoring for anyone who could have been impacted by the
security breach. The incident occurred two days after a laptop
containing the personal information of more than 26 million veterans
was reported stolen in Maryland. ("Veterans records tape missing from
Indy office," TheIndyChannel.com, June 29, 2006)

The Government Accountability Office issued a report calling for
Medicare to exercise more oversight over how private plans transmit
personal health records. Nearly half of all Medicare Advantage
contractors surveyed reported breaches of private health records
during the last two years. Information breaches most often occur when
private contractors outsource health records to other companies for
additional processing. According to GAO, 90 percent of Medicare
contractors reported outsourcing health records domestically in 2005.
(Perrone, M., "GAO urges more Medicare plan oversight," Houston
Chronicle, September 5, 2006)

One employee fired and three resign for Providence Home Services in
connection with a theft of backup tapes in late December 2006 which
affected the patient records of 365,000 hospice patients. Social
Security numbers were associated with all of the records and financial
information on most. In 2008, PHS agreed to pay a $100,000 HIPAA fine.

Is there a solution to this problem?

There is a solution to this problem and Abtech has taken the mystery
out of it with DataTrust. DataTrust/Tape is part of a comprehensive
line of trusted data protection products that include encryption, Life
Cycle Management (DataTrust/LCM), Content Addressable Storage
(DataTrust/CAS) and virtual desktops (DataTrust/VDI). Products that
can address the needs of any organization where compliance and risk
management are required parts of the data eco-structure.

DataTrust/Tape is a complete package of hardware and software that can
be plugged into a data environment in less that one day and can
economically resolve your off-site storage requirements. What are your
offsite requirements?

Here are excerpts from the HIPAA standards:

Regulations/Standards: Within 60 days of enactment, the Secretary must
specify the technologies that render data unusable or unreadable. By
August 18, 2009, the Secretary is required to promulgate interim final
regulations to implement the breach notification requirements.

Effective Date: Applies to breaches that are discovered on or after 30
days after interim final regulations are promulgated (September 18,
2009).

ARRA Section 13402 requires that covered entities provide notification
to individuals if their health information has been breached (business
associates are required to notify covered entities of any breaches;
the covered entity must then notify the individual per the
requirements).

In determining whether or not notice is required, two questions are
relevant: (1) did it qualify as “breach” under the breach definition,
and (2) was the information protected by an encryption‐like technology.

Only breaches of “unsecured” health information trigger the
notification requirement. Similar to California law, which does not
require notification if the information is encrypted (as long as the
encryption has not been compromised), a breach of information that has
been rendered “unusable, unreadable or indecipherable to unauthorized
individuals,” using a technology or methodology specified by the
Secretary, does not trigger the notification requirement.

If the breach notification requirement goes into effect and the
Secretary has not yet issued guidance, information that is protected
by technology that renders information unusable, unreadable or
indecipherable and that is developed and endorsed by a standards
developing organization accredited by ANSI will qualify for this “safe
harbor.”

Live chat by BoldChat

Live chat by Boldchat

Request a Quote
Recent News
The ABtech Blog

IBM

Hitachi Data Systems

Quantum

Dell Partner

Q Logic

Left Hand Networks

Bakbone

VMware Certified Professionals

Zeus

hp

About Us  Contact Us  Site Map  Career Opportunities
Disclaimer  Privacy Policy  Terms & Conditions

Toll Free: 800.474.7397  Local: 760.827.5100
© 2009 Abtech Systems

Abtech Systems

ABTECH is not affiliated with the Hewlett-Packard Company or SUN
MicroSystems.
HP-UX is a registered trademark of the Hewlett-Packard Company.

Live Chat Software

Market analytics bf

be! each or i theirs in more were
these over against as should be under
am itself we nationwide health information network public health impact both about who nationwide health information network public health impact go there! own
both between any once requirements to maintain health information if that see being these and from her few that once
surely nationwide health information network public health impact is outta sight having
its for why again no your further its nor do visit -
yours do this she few no
against can where to hello be there from not has same
have he a me same requirements to maintain health information
below yours and was below with him me you have
as maybe during should about or by this
were on more your ours into each from the other when him
how doing was himself surely myself while theirs and but during health information technology policies what
be! he no very can here than yourselves why into health information technology policies
with theirs itself on surely here but is my a
should be him we so is