Download

414 Chapter 12 • Social EngineeringThe Transactions and Code Sets Rule specifies extensions to ANSI X12 (especially for thehealthcare industry) known as X12N.These transactions include eligibility inquiries, claims,and remittances.The Security Rule gives the “how” to go with the Privacy Rule’s “what.”The privacyrule uses established IT security methodology to specify three types of security controls:administrative, physical, and technical safeguards.The physical safeguards control physicalaccess to PHI and the equipment storing PHI.Administrative controls provide the following:■■■■■■■■Written privacy procedures and a Privacy Officer appointed to develop and implementpolicies and proceduresA management oversight policy for compliance with the security controlsDefined job functions that specify which types of PHI are handled by what jobfunctionSpecifies how access to PHI is authorized and terminatedEstablishes training for employees handling PHIEnsures PHI is disclosed only to vendors that comply with HIPAAA Disaster Recovery Plan (e.g., change control procedures, perform backups, andso forth)Perform internal audits for security control implementations and security violationsPhysical safeguards include:■■■■How equipment is added to, or removed from (including disposal), the data networkPhysical access to equipment with PHI must be not only controlled but alsomonitoredFacility security plans, visitor logs, escortsWorkstations must not be kept in high traffic areas, and monitors must not beviewable by the publicTechnical safeguards provide logical access control to systems storing PHI, and protectcommunications of PHI over data networks.They include:■■■Intrusion protection, including encryption for communications over open networksEnsuring that data changes are authorizedEnsuring data integrity with checksums, digital signatures, and so on