Default banner

HIPAA | HITECH Data Security Compliance

The Thales data security platform provides data access control and encryption solutions that help organizations comply with the HIPAA and HITECH requirements

HIPAA

Test

The HIPAA Security Rule requires healthcare organizations to use appropriate safeguards to ensure that electronic protected health information (ePHI) remains secure, and the HITECH Act, which expands the HIPAA encryption compliance requirement set, requires the timely disclosure of data breaches.

For many healthcare organizations, one of the most daunting provisions of complying with HIPAA and HITECH has been adhering to The Privacy Rule. Applying encryption solutions that protect patient data from all but a defined set of uses – and within the proscribed EDI sets – has proven to be a significant IT challenge. An effective implementation must not only be secure and adhere to these transaction standards but must also be manageable within the company’s IT framework.

Thales solutions help organizations meet these compliance challenges by implementing technical safeguards for ePHI through:

  • Encryption of data wherever it resides
  • Encryption and key management
  • Data access controls
  • Regulation
  • Compliance

The US Health Insurance Portability and Accountability Act (HIPAA)

The HIPAA Security Rule requires covered entities to implement technical safeguards to protect all electronic protected healthcare information (ePHI), making specific reference to encryption, access controls, encryption key management, risk management, auditing and monitoring of ePHI information. The HIPAA Security Rule enumerates examples of encryption methods that covered entities can employ, along with the factors to consider when implementing a HIPAA encryption strategy.

Health Information Technology for Economic and Clinical Health (HITECH) Act

Enacted as a part of the American Recovery and Reinvestment Act (ARRA) of 2009, the HITECH Act expands the HIPAA encryption compliance requirement set, requiring the disclosure of data breaches of “unprotected” (unencrypted) personal health records, including those by business associates, vendors and related entities.

HIPAA Omnibus Rule of 2013

The “HIPAA Omnibus Rule” of 2013 formally holds business associates liable for compliance with the HIPAA Security Rule.

Encryption of ePHI

Vormetric Transparent Encryption provides file and volume level data-at-rest encryption to protect ePHI from unauthorized access. Vormetric Application Encryption adds another layer of security and HIPAA/HITECH compliance capabilities, enabling organizations to easily build HIPAA/HITECH encryption capabilities into internal applications at the field and column level.

Strong Key Management

Vormetric Key Management provides the integrated, secure encryption key management that meets HIPAA encryption requirements to separate keys and encrypted data. This solution enables centralized management of encryption keys for other environments and devices including KMIP compatible hardware, Oracle and SQL Server TDE master keys and digital certificates.

Data Access Controls

Vormetric Data Security Platform access controls extend data breach protection by limiting data access to authorized personnel and programs. In addition, the Platform’s data access monitoring generates the security intelligence information required to identify accounts that represent a threat because of a malicious insider or malware-compromised account credentials.

  • Related Resources
  • その他の主要なデータ保護とセキュリティ規制

    GDPR

    規制
    アクティブ ナウ

    これまでで最も包括的なデータプライバシー基準とされるGDPRは、組織がどこの国にあろうとも、EU市民の個人データを保持する全ての組織に対応を求められます。

    PCI DSS

    必須
    アクティブ ナウ

    クレジットカード及びデビットカードの決済処理事業者は、アカウントデータの処理、保存および送信に関する厳格なPCIDSSコンプライアンス要件に準拠する必要があります。

    データ漏えい通知法

    規制
    アクティブ ナウ

    個人情報漏えいが発生した場合に、データ侵害報告義務の要件は、世界中の国々によって制定されています。それは管轄国で違いはありますが、ほぼ全てに「セーフハーバー」条項が含まれています。