New Health Information Privacy Regulations Discussed

(Wilmington, DE): This afternoon, about 75 information technology managers, Deputy Attorneys General who provide legal representation to state agencies, and administrators from private businesses and state agencies, learned about their new responsibilities regarding the health information security rule under the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Attorney General Jane Brady opened the seminar by stressing the importance of compliance with HIPAA rules, “This issue is important to the State and its citizens. I hope the information we provide through this seminar will help assure compliance with the statute and regulations.”

The HIPAA legislation has four primary objectives: 1) to assure health insurance portability; 2) to reduce healthcare fraud and abuse; 3) to enforce standards for health information; and 4) to guarantee security and privacy for health information. The compliance date for the health information privacy rule was April 14, 2003, while compliance with the security rule will be on April 21, 2005.

State and private agencies which provide healthcare and mental health services are

impacted by this act as are law enforcement agencies who seek medical information in connection with investigations and prosecutions of crimes.

Bill Schooler, an Information Technology Specialist from the U.S. Department of Health and Human Services, Centers for Medicare and Medicaid Services, discussed the HIPAA security regulations from the federal perspective. According to Mr. Schooler, “The security rule was designed to be consistent with the existing privacy rule in order to minimize the learning curve for covered entities. Confidentiality requirements in the security rule directly support the use and disclosure guidance found in the privacy rule.”

The other key speakers of the afternoon included Suzanne Joyce, President and Johnny Flores, Director of Operations with TechGuard Security, LLC, a private information security firm. They discussed the technological compliance issues with HIPAA Security Regulations. Joyce noted, “HIPAA security regulations reinforce the implementation of network security best practices and good cybercitizenship. But with or without a government mandate such as HIPAA, using good network security reduces liability and downtime while increasing customer and business partner confidence. It just makes good business sense.”

Special Agent Lauren F. Schuler of the FBI Baltimore office also discussed the public/private security organization, InfraGard. InfraGard is a cooperative undertaking between the U.S. Government, led by the FBI, and an association of businesses, academic institutions, and law enforcement agencies dedicated to increasing the security of critical infrastructures. InfraGard partners with the Small Business Administration, the National Institute of Standards and Technology, the National Center for Manufacturing Sciences and the Computer Security Resource Center. All FBI field offices support at least one InfraGard chapter. The Baltimore Field Office supports chapters in both Delaware and Maryland. Several InfraGard members from these chapters were in attendance at today’s training.

Shuler encouraged participation in the InfraGard network, “The benefits to joining InfraGard include participation in regular meetings and training seminars focusing on a variety of security topics; exchanging information and networking with other security professionals, receiving threat advisories and Daily Reports from the Department of Homeland Security and developing a relationship with the local FBI office – all free of cost!”

Brady encouraged those in attendance at the informational seminar to become better informed and to cooperate with each other in ensuring the best integrity of medical information systems.

###