This document discusses HIPAA compliance and the HITRUST framework. It provides an overview of HIPAA requirements including the Privacy Rule, Security Rule, and Breach Notification Rule. It outlines fines and penalties for non-compliance. It then discusses the mission and objectives of HITRUST, which provides a certifiable framework to demonstrate HIPAA compliance. Key components of HITRUST's CSF Assurance Program include standardized tools and processes to assess risk and compliance through a HITRUST report. Challenges in demonstrating HIPAA compliance and the case for using HITRUST are also reviewed.

1. HealthCare Compliance - HIPAA
and HITRUST
Kishor Vaswani, CEO – ControlCase

2. Agenda
• About HIPAA
• HIPAA, HITECH and the Omni-bus Rule
• Fines and Penalties
• HIPAA Requirements
• HITRUST Mission and Objective
• Key Components of CSF Assurance Program
• Demonstrating compliance to HIPAA through
HITRUST
• Key takeaways
• Q&A
2/ 18

3. What is HIPAA today?
Health Insurance Portability & Accountability Act of 1996
& HIPAA Omnibus Rule:
• Establishes administrative, physical and technical
security and privacy standards
• Applies to both healthcare providers and business
associates (3rd parties)
• Attributes responsibility for monitoring HIPAA
compliance of business associates to healthcare
providers
• Assessment of compliance of business associates due
09/23/13
3/ 18

4. HIPAA, HITECH and the Omni-bus Rule
4 / 18
HITECH
• Specificallyextends security, privacy
and breach notificationrequirements
to Business Associates (BA)
• Establishesmandatory penalties for
‘willful neglect’
• Imposes databreach notification
requirementsfor unauthorizeduses
and disclosures of "unsecured PHI.“
• Institutesthird party management
and monitoring as ‘due diligences
and ‘due care’ provisions
• Establishesthe right for patientsto
obtaintheir PHI in an electronic
format (i.e. ePHI)
Omni-bus Rule
• Finalizationof interim rules outlined
in the HITECH Act
• Formalizes enforcement provisions
for breaches
• Expands definitionof BA to include
subcontractorsof BA (BA of BA)
• Clarifies that HHS will determine the
actual maximum for penalties
• Covered Entities (CE) and BA are
liablefor the acts of BA and their
subcontractors
• Requires a on-going monitoring
process for the organization’s
security programs and processes.

5. Fines/Penalties
HIPAA Violation Minimum Penalty Maximum Penalty
Individualdid not know (and by
exercising reasonablediligence
would not have known) thathe/she
violated HIPAA
$100 per violation, with an annual
maximum of $25,000 for repeat
violations (Note: maximum that can
be imposed by State Attorneys
General regardless of the type of
violation)
$50,000 per violation, with an
annual maximum of $1.5 million
HIPAA violation due to reasonable
causeand not due to willful neglect
$1,000 per violation, with an annual
maximum of $100,000 for repeat
violations
$50,000 per violation, with an
annual maximum of $1.5 million
HIPAA violation due to willful neglect
but violation is corrected within the
required time period
$10,000 per violation, with an
annual maximum of $250,000 for
repeat violations
$50,000 per violation, with an
annual maximum of $1.5 million
HIPAA violation is due to willful
neglect and is not corrected
$50,000 per violation, with an
annual maximum of $1.5 million
$50,000 per violation, with an
annual maximum of $1.5 million
5 / 18
Source: http://www.ama-assn.org//ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-
accountability-act/hipaa-violations-enforcement.page

6. HIPAA Requirements – Privacy Rule
Privacy Rule Main Points:
• Requires appropriate safeguards to protect the privacy of personal health
information
• Sets limits and conditions on the uses and disclosures that maybe made of
such information without patient authorization
• Gives patients rights over their health information, including rights to
examine and obtain a copy of their health records, and to request
corrections
• Requires compliance with the Security Rule
For BAs
• Requires breach notification to the Covered Entity
• Requires either the individual or the Covered Entity access to PHI
• Requires reporting the disclosure of PHI to the Secretary of HHS
• Provide an accounting of disclosures.
Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html
6/ 18

7. HIPAA Requirements – Security Rule
Administrative Safeguards:
Security Management Process (Risk Analysis(required), Risk Management (required), SanctionPolicy (required),
InformationSystems Activity Reviews (required), Assigned Security Responsibility - Officers (required), Workforce
Security - Employee Oversight (addressable), Information Access Management - Multiple Organizations(required)
and ePHI Access (addressable); Security Awarenessand Training - Security Reminders(addressable), Protection
Against Malware (addressable), LoginMonitoring (addressable); PasswordManagement (addressable), Security
IncidentProcedures - Response andReporting (required),Contingency Plans (required); Evaluations (required);
Business Associate Agreements (required)
Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html
Technical Safeguards:
Access Control- Unique User Identification(required), Emergency AccessProcedure (required), Automatic Logoff
(addressable), EncryptionandDecryption (addressable); Audit Controls (required); Integrity - Mechanismto
Authenticate ePHI (addressable); Authentication (required); Transmission Security - Integrity Controls
(addressable), Encryption (addressable)
Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf
Physical Safeguards:
Facility Access Controls - Contingency Operations (addressable), Facility Security Plan (addressable), Access
Control and ValidationProcedures (addressable), MaintenanceRecords (addressable), WorkstationSecurity
(required), Deviceand Media Controls - Disposal (required), MediaRe-Use (required), DataBackupandStorage
(addressable)
Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/physsafeguards.pdf
7/ 18

8. HIPAA Requirements – Breach Notification
8/ 18
Definitionof Breach
A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the
security or privacy of the protected health information.
Unsecure PHI
Transition and Storage: NIST Special Publication 800-111, NIST Special Publications 800-52, 800-77 or
Federal Information Processing Standards (FIPS) 140-2 validated
Destruction: Specifies physical and electronic PHI, for electronic, NIST Special Publication 800-88
Breach Notification
Methods: By email or first class mail, to the media, posting the notice on the home page of its web site
for at least 90 days, If BA, to the CE, within 60 days of determination
NotificationThresholds
> 500 records: notify HHS, to individuals and media, within 60 days
< 500 records: notify HHS, annually consolidated listing
Burden of Proof
CEs/BAs required to prove that they have notified the affected parties within the time periods specified
or face penalties

9. HIPAA Requirements – BAs and subcontractors
• Comply directly with the HIPAA Regulation
• Business associates must identify, assess and monitor their
supporting business associates (BAs of BAs) and provide
regular updates to the respective CE
• BAs must establish and define (contractually) security
requirements, right to audit, incident reporting clauses with
their service providers
• BAs must implement an effective monitoring/assessment
process based on the nature of the data exchanged with
service providers
• Be able to show due diligence/due care with respect to
monitoring their supplier’s security compliance
9/ 18

10. HITRUST Mission and Objectives
Founded in 2007, HITRUST Alliance is a not-for-profit organization whose mission is to champion
programs that safeguard sensitive information and manage information risk for organizations
across all industries and throughout the third-party supply chain.
Key focus:
• Increase the protection ofprotected health and other sensitive information
• Mitigate and aid in the management ofrisk associated with health information
• Contain and manage costs associated with appropriatelyprotectingsensitiveinformation
• Increase consumer and governments’confidence in the industry's abilityto safeguard health
information
• Address increasingconcerns associated with business associate and 3rd partyprivacy,securityand
compliance
• Work with federal and state governments and agencies and other oversight bodies to collaborate
with industryon informationprotection
• Facilitate sharingand collaborationrelatingto informationprotection amongstand between
healthcare organizations ofvaryingtypes and sizes
• Enhance and mature the knowledge and competency of health informationprotection professionals
10 / 18

11. HITRUST Overview
• Exists to ensure that information security becomes a core pillar of, rather
than an obstacle to, the broad adoption of health information systems and
exchanges.
• Was born out of the belief that information security is critical to the broad
adoption, utilization and confidence in health information systems,
medical technologies and electronic exchanges of health information.
• Is collaborating with healthcare, business, technology and information
security leaders, all of whom are united by the belief that adopting a
higher level of standard security practices will build greater trust in the
electronic flow of information through the healthcare system.
• Has established a certifiable framework that any and all organizations in
the healthcare industry that create, access, store or exchange personal
health and financial information can implement and be certified against.
11 / 18

12. Strategic Objectives of HITRUST
Establisha fundamentaland holistic change in the way the healthcareindustry
manages informationsecurity risks:
• Rationalizeregulationsand standardsinto a single overarching framework tailored
for the industry
• Deliver a prescriptive, scalable and certifiable process
• Address inconsistentapproaches to certification,risk acceptance and adoptionof
compensating controlsto eliminateambiguityin the process
• Enableabilityto cost-effectively monitor compliance of organizational,business
partner and governmentalrequirements
• Provide support and facilitatesharing of ideas, feedback and experiences within
the industry
Establishtrust between organizationswithin the healthcareindustry that exchanged
information is protected
Develop an approach for the practical,efficient and consistent adoptionof security by
the healthcareindustry
12 / 18

13. Standardized tools and processes
• Questionnaire
› Focus assurance dollars to efficiently assess risk exposure
› Measured approach based on risk and compliance
› Ability to escalate assurance level based on risk
•Report
› Output that is consistently interpreted across the industry
Cost effective and rigorous assurance
• Multiple assurance options based on risk
• Quality control processes to ensure consistent quality and output across
HITRUST CSF Assessors
• Streamlined and measurable process within MyCSF tool
• End User support
13 / 18
Key Components of CSF Assurance Program

14. HITRUST Report
• Certified/validated report issued by HITRUST based on work of
independent third-party assessors
› Business/functional/organizational units that meet the
associated criteria
• Assessmentcontext and scope of systems included in
assessment
• Breakdown of CSF control areas with a comparison to industry
› Includes maturity scores
• Testing summary, corrective action plans, and completed
questionnaire
14 / 18

15. Challenges: Demonstrating Compliance to HIPAA and case for using HITRUST
15 / 18
• Risk Assessments
– Not performed/not updated or
documented
– Limited scope: facilities,
processing environment,
personnel, software, personnel
– Not aligned with controls or
monitoring
• Inventories (Asset Management)
– Out of date/not documented
hardware, software, interfaces,
dataflow diagrams/process
descriptions, removable media,
teleworkers (remote), BAs and
subcontractors
• No BA/Vendor Management
program
• Policies, procedures and
standards (Governance)
• Hardening and patch
management
– None or not implemented
– Not monitored/No follow-up
– End-of-life
• Vulnerability Management
– Inconsistent/incomplete
internal vulnerability and
penetration testing for
networks and applications
– Remediation gaps
– No Internet content restrictions

16. Contd…
16 / 18
• System Logging and
Monitoring
– Not implemented/inconsistent
– Not retainedor analyzed
– Lack of oversight and approval
• None or inconsistent
encryption of data in
transmission or storage
• Media management and
tracking gaps
• Untestedincident and
breach response processes
for PHI related disclosures
• User Provisioning
– Excessive privileges/accesses
– No formal documentationof
rationale
– Lack of oversight and approval
• Training and awareness
– Not HIPAA oriented
– No refresh
– Lack of evidence of attendance
• Inadequate business
continuity and disaster
recover
• Failure to monitor external
maintenance personnel

17. Why Choose ControlCase?
• Global Reach
› Serving more than 400 clients in 40 countries and rapidly growing
• Certified Resources
› HITRUST Assessor
› PCI DSS Qualified Security Assessor(QSA)
› SOC1. SOC2
› QSA for Point-to-Point Encryption (QSA P2PE)
› Certified ASV vendor
› ISO 27001 Assessor
› HIPAA Audits
17 / 18

18. To Learn More …
18/ 18
Visit www.controlcase.com
Email us at contact@controlcase.com

19. Q & A