IT Employment

Ask something
Discussion Locked

Secure enough for HIPPA

0 helpful
7 replies

by arrrom1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hi, My question concerns my Electronic medical claims billing business...I would like advice on the best{inexpensive} security measures I can use to assure privacy of Medical info and best medical security storage{I must keep all files for 7 years. We all back up our files after every transmission to our Clearinghouse..Any suggestions??? How do I protect info sent over internet, to my operators in other States??? Thanks, Anica

7 replies

by lordinfidel

For HIPPA requirements, every piece of data that is transmitted over the net must be protected either via SSL or TSL 128 bit encryption.

So if you are backing up over the net and you do not have a 128 bit point-to-point tunnel, you are violating HIPPA requirements.

by admin

We use a sonicwall vpn to keep our offices connected and restrict client data to our network.
The hardest thing about this is the inconvenience interfacing with other vendors, especially in the social work field where many agencies are saying they can't comply due to the cost, have no professional data support and old donated boxes etc. Obviously, we can't comply and transmit data to many of them, so we are back to paper to gain compliance. This is really frustrating to me, but that's another story :)

We do all back-ups of all offices centrally via VPN and

We are actually looking for a medicaid billing program that is reasonably priced and HIPPA compliant as the programmers on our current billing program are running out of time and we are nervous about their ability to complete it.

by lordinfidel

The major HIPPA requirement is when patient data is transmitted over the web.

If the info is not transferred over the net then by default you are in compliance.

If all you are doing though is setting up a site so they can access Info. Simply get a secure cert, and enable 128bit SSL. Enforce it's use by only allowing 128bit connections.

But if you are transmitting raw data from your DB to theirs. Then obviously they need a firewall vpn solution. I would then use IPSec and tunnel thedata.

by admin

Actually, our Medicaid billing all transmits via modem currently. doh! I can't believe I hadn't thought of that! It's off the web! The programmers are of course assuring us they are building something new, and they probably will sell us something that is stamped HIPPA compliant eventually.... heheehe do we even need it? Do you (or anyone) know if the central Medicaid billing system is continuing as basically a BBS with optional interfaces being written to it? I couldn't believe that is how itworks when I first saw it, but now I'm thinking this is a good thing... maybve we should all go back to BBSing to share data in this industry!!!! hehehe

Our other thing is sending over the net via e-mail. My understanding is that this needs to be encrypted and yet many of the agencies we share info with are barely capable of e-mailing via hotmail... sooooo, am I wrong here? We are pretty much curtailing the e-mail attachment of patient documents for the time being.

Maybe we should invite them to dial up our BBS and DL all the patient data they need! heheehehehee...........welllllllll

Sorry... I'm working WAAAYYYYY TOOOO much l8tly. :) I'm rendering myself into a big green syrupy puddle on a keyboard soon I bet......

by admin

We use sonicwall firewall\vpn to keep our offices connected and restrict client data to our network. Cisco and others have many fine products that do this same thing.

The hardest thing about this is the inconvenience interfacing with other vendors, especially in the social work field where many agencies are saying they can't comply due to the cost, have no professional data support and old donated boxes etc. Obviously, we can't comply and transmit data to many of them, so we are back to paper to gain compliance. This is really frustrating to me, but that's another story :)

We do all back-ups of all offices centrally via VPN and send data internally via folder systems that are easy for the end users to manage and build with OU's (we have many departments needing HIPPA billing and documentation services). basically, unless we really know what the people are doing on the other end and can encrypt it, we don't send anything related to client data unencrypted outside our network.
We are actually looking for a medicaid billing program that is reasonably priced and HIPPA compliant as the programmers on our current billing program are running out of time and we are nervous about their ability to complete it.

by lordinfidel

They can always make a direct dial-up connection into your network. This will be secure.

E-mail--- Yes...Unencrypted e-mail with patient data violates HIPPA.

But if they dial up to the net first then make a connection, then no, unless the connection is secured with TLS or SSL.

by admin

That works. I just don't want to in effect become the service provider for everyone else and take on their shoddy systems.....

Speaking of HIPPA, I had to drive to our storage unit today, and on the trip I fired up netstumbler and found 28 AP's of which 4 had some form of security and of the remainder without any encryption etc. 2 claimed to be dental offices right in their ID. What are people thinking?

Thanks for the reply :) Our state is asking for an extension for HIPPA and it's expected to go through, so I'm just trying to stay ahead of the game, although I think our clients deserve protection irregardless of the rules and regs.

Have a good weekend! :)

This discussion is closed to new replies.