HHS Issues Ransomware Guidance
HHS issued Ransomware guidance recently that clarified that a ransomware attack involving ePHI (electronic Protected Health Information) is a HIPAA breach unless the Covered Entity of Business Associate can demonstrate that there is a low probability that the PHI has been compromised. Ransomware is a […]
OCR Crosswalk Between NIST Cybersecurity Framework and the HIPAA Security Rule
Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity was issued by President Obama in 2013, and called for the development of a voluntary risk-based cybersecurity framework (CSF) that is “prioritized, flexible, repeatable, performance-based, and cost-effective.” In response, the National Institute of Standards […]
HITRUST – What it is, Benefits and Determining if it is for Your Company
Among other mandates, Title II of HIPAA defined policies and procedures and provided guidelines for maintaining the privacy and security of individually identifiable health information. Its Administrative Simplification (AS) rules directed the Department of Health and Human Services (HHS) to draft rules aimed at […]
Business Associate –What Are Your Obligations?
If your company creates, receives, maintains or transmits Personal Health Information (PHI) on behalf of a Covered Entity and is not a member of the Workforce of the Covered Entity, or is a company that provides accounting, legal, processing or administration, data analysis […]