Preparing for HIPAA compliance

O.k. we only have a few things to cover in this new regulation... Everything!

Faxing
Anyone know how to secure a fax page? J2 communications claims they can do it. (be prepaired to pay .05 to .10 per page if you use them) If I fax client privilaged information to the wrong phone number, they are going to catch it right? :-) Requiring the person on the other end of the fax to hold my faxed document up to the mirror to read it, isn't going to cut it and using A=1, B=2 would probably just take too much time to figure out. So, who is going to make the first encrypted fax machine? If you make it, at least give me some recognition. :-)
(open for discussion)

Email
O.k. this one most of us already know basically. Encrypt all email, done. Right? Actually it's not, if you think about it. Your email server is probably hosted with your current web site hosting company. Why is this a problem? The problem is, you have no control over most of the security levels, hardware and software. Your email server is sitting in a building literally full of other email servers running on the same network. That opens another whole ball of wax. Sure, your hosting company may have some security upgrades you may be able to do to become HIPPA compliant, but do you want to pay them to do it or do you want to have FULL CONTROL? (or increase security above and beyond the HIPPA regulations) Why not secure the heck out of your email anyway? Do you write letters to your loved one on a large post card so everyone can read it as their delivering it? Why should your email be any different? Put your email in the secure envelope of your likeing & sleep well knowing that even steam on your envelope can't even show the private comments you made to your loved one. What I'm trying to say is, it's your email, stop being lazy and put it in the envelope, it's really not that much work... How about moving the email server onsite and locking it down? How about using encryption on that server as well as VPN? That sounds more like it...

Patient Forms
I think this should be a pretty easy one, encryption.

Client Information
This obviously covers a wide range of types but I think once again, encryption should cover most of the data related issues with it. As far as client information in the physical form, obviously the old lock and key method works pretty good and should already have been in place.

Magnutech Inc

We too are running into some of the same problems with clients that have these "bad habbits" in place. The easiest solution we have found to this habbit problem is to simply enforce regular password changes (sometimes at random) to keep people from telling others in the office what their passwords are. This obviously increases the amount of tech calls at first but soon fades away with time. This transformation is obviously one that is going to take some time.

Another problem we have found is, a few clients have helped themselves to some nice fancy WiFi access points and have installed it themselves. The obvious problem with that is, they just keep clicking next! No encryption and broadcasting their SSID. You might as well, leave all your doors unlocked when you leave the office from now on and expect some nice fines from the gov. Could you imagine, some freak out in the parking lot downloading child porn on their network? How long do you think that business is going to keep their license if that freak happens to hit a gov fake porn site? Hhhmmmm...I'd say they'd be knocking on their door pretty quick & more than likely be on the 5:00 news. Nice....

"You can lead a horse to water, but you can't make him drink."
Another problem, is getting them to spend the money needed to be HIPPA compliant. If they don't spend the money now, they risk it all don't they? I think the gov should step in and offer a nice tax benefit to those who do become HIPPA compliant. Otherwise, we just may end up with just a few companies that can actually afford to keep their doors open & not just in the medical field.

So what now? Who is going to go around to every office and make sure they are HIPPA compliant? Me? If you are like me, then you are like most tech's in America, you simply don't have time. The amount of work put on us "techs" by this new law alone has made it virtually impossible to do anything but enforce the new regulations to our existing workplace or clients.

So, what do we need? More hardware, more software, more time and more techs in some cases. Now businesses must fork out more money to meet this new compliance. Either we loose our jobs because they cannot afford it or we become part of the problem along with the company. I don't know about you, but being associated with a company that failed many of the compliance regulations is not something I would like to have on a resume.

God help us!

Yes, it is possible to accomplish that task, chances are you are going to need to outsource that type of project. This is what our company does, we would be happy to talk to you about it.

Check out our website for more information: www.magnutech.com

I have to do the same thing here in So. CA.. I have a central corp. office and multiple remote site connected via DSL. After talking with a couple of fellow consultants, here is the current plan:

1. Obtain and install a enterprise certificate (Thawt or Versign) for server/workstation/laptop id verification.

2. Install w2k certificate server and issue user certs. Cert. request can be automated both in cert server and in active directory group policies.

3. impliment SSL required for email.

4. configure outlook/OWA services for SSL requirements or pgp encryption.

I hope this shed some light on the direction you should look to resolve your issue.

of course, any other ideas are more than welcom.

Jerry Black
System Administrator/Desktop Support
Exceptional Children's Foundation
8740 Washington Bl.
Culver City CA 90232
310-845-8064
jblack@ecf.net
j.black@recordsafe.com