Revised Heart-Healthy Insurance Information Security Policy, Essay Example

New Users

New Users will be assigned access based upon the reason for and content of the information that is requested. All requests must be compliant with the Health Insurance Portability and Accountability Act (HIPAA) in which releasing demographic data will be permissible, provided that the information distributed cannot result in the identification of the patient. Additionally, data acquisition must be in compliance with Health Information Technology for Economic and Clinical Health Act (HITECH) and be publicly available on the national electronic health record (EHR) system. To determine whether the user will be able to gain access to the system, they must provide documentation that details their reason for acquiring the information in addition to the level of detail that is needed. If the information requested is compliant with HIPAA and approved by a manager, access will be granted. By signing a contract with the company, it is expected that only you will be using your login credentials; violations of this will end the user agreement.

Password Requirements

To ensure safety of your account, it is required that your password be at least six alphanumeric characters long. There must be at least one capital letter, one number, and one symbolic character. The password may not be similar to the users email address or username. As explained in the new user agreement, shared passwords are not permitted. When resetting a password, users cannot reuse any previous passwords. Entering an incorrect password more than three times in a one hour period will result in a lockout. To gain access to your account, you must either wait three hours or call the company to verify your identify, which will include questioning of personal information that you indicated when registering for your account, in addition to safety questions that you set at the time the account was set up.

Justification of Requirements

The above requirements are justified because they ensure that the company is compliant with HIPAA. The new user policy states that new users must have reasonable requests to access patient data and that this information should not be able to be used to identify an individual. Furthermore, HIPAA requires insurance that the information is only accessed by those with permission. As a consequence, the company cannot allow that passwords be shared, and precautions must be taken to ensure these accounts cannot be hacked. Therefore, it is essential that the passwords generated for these accounts be complex and cannot be guessed. This system also prevents against hackers by requiring the user to call the company if there are too many login attempts on their account.

Ensuring that data retrieved is in compliance with Health Information Technology for Economic and Clinical Health Act (HITECH) also ensure HIPAA compliance and patient safety. The information stored on this database is comprehensive, but lacks many of the patient identifiers that criminals need to steal private information from these individuals. Furthermore, information on these patients should prove more useful to the client because they have long term data on the same individual, which may help them learn more about the health needs and medication trends of these people.

References

Blumenthal, D. (2010). “Launching HITECH”. New England Journal of Medicine 362 (5): 382–385.

Blumenthal, D.; Tavenner, M. (2010). The “Meaningful Use” Regulation for Electronic Health Records. New England Journal of Medicine 363 (6): 501–504.

HIPPA. Health Information Privacy. Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/