1 Protecting Privacy in an Era of Electronic Health Records Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario Barrie and Community Family Health Team Royal Victoria Hospital Georgian College November 22, 2012
2 Outline of Presentation 1. Importance of Protecting Privacy in the Electronic Age 2. The Promise and Peril of Electronic Heath Records 3. Consequences of Inadequate Attention to Privacy 4. Three Major Risks: Privacy Risks During Transition Unauthorized Access to Electronic Records Mobile and Portable Devices 5. Privacy by Design: The Gold Standard 6. Building Privacy into the Design of Electronic Records 7. Conclusions
3 Importance of Protecting Personal Health Information
4 Unique Characteristics of Personal Health Information Highly sensitive and personal in nature in need of strong protection; But must be shared immediately among a range of health care providers, for the benefit of the patient; Also used and disclosed for secondary purposes seen to be in the public interest (e.g., research, health system planning and evaluation, quality assurance); This dual nature of personal health information is reflected in PHIPA.
5 Why Protecting Personal Health Information is So Critical Extreme sensitivity of personal health information; Massive growth in online connectivity; Increasing number of persons involved in the delivery of health care; Emphasis on information technology, including electronic medical records and electronic health records; Health information forms the basis of invaluable research, seen to be in the public interest, but which could be jeopardized if the public s trust is eroded.
6 The Promise and Peril of Electronic Health Records
7 Electronic Health Record: Definitions An electronic record that integrates information about the care and treatment provided to a patient by multiple health care providers; Electronic Medical Record: An electronic record used by a health care provider that only includes information about the care and treatment provided to a patient by that one health care provider; Personal Health Record: An application that allows patients to create, review, annotate or maintain a record in respect of their own care and treatment.
8 The Promise of Electronic Health Records Can facilitate the provision of more efficient and effective health care and improve the quality of care provided; Easier to read and locate than paper records; Require less space and fewer administrative resources to maintain; Can be designed to enhance privacy through access controls, audit logs, strong encryption and authentication; EHRs may be more complete and readily accessible by all health care providers involved in the health care of a patient, regardless of location.
9 The Peril of Electronic Health Records If privacy is not embedded in the design of EHRs, unique risks to privacy and the security of personal health information arise; Allows for massive amounts of personal health information from diverse sources to be collected, used and disclosed; Unauthorized uses attracts hackers and others with malicious intent, including authorized health care providers who access the information for purposes other than providing health care; Easier to transfer personal health information to a portable device and remove the information from a secure location.
10 Consequences of Inadequate Attention to Privacy
11 Consequences if Inadequate Attention Paid to Privacy Individuals may be deterred from seeking testing or treatment, or may engage in multiple doctoring; Individuals may withhold or falsify information provided; Loss of trust or confidence in the health system; Damage to the reputation of the health care provider; Individuals may suffer discrimination, stigmatization and economic or psychological harm; Lost time and expenditure of resources needed to contain, investigate and remediate privacy breaches; Costs of legal liabilities and ensuing proceedings.
12 Three Major Privacy Risks: 1.Privacy Risks During Transition 2.Unauthorized Access to Electronic Records 3.Mobile and Portable Devices
13 Privacy Risks During Transition
14 Privacy Risks During the Transition to Electronic Records Personal health information may be most vulnerable when transitioning to electronic records why? Staff may not be fully trained on the new electronic system; The electronic system may not be fully functional; Privacy and security features may be turned off or set to minimal protection; Conversion of paper records to electronic format may require frequent access to the records by larger numbers of people; Records may be duplicated in paper and electronic format, thereby increasing the volume of records requiring protection.
15 A Practical Tool for Physicians Transitioning to Electronic Records My office jointly published a toolkit with Dr. Peter Rossos, at the University Health Network, for managing privacy issues during the transition to electronic records. The toolkit addresses: - Education and training of staff; - Implementation of access controls; - Implementation of strong passwords; - Audits of access to electronic records; - Managing the retention, transfer and disposal of paper records; - Drafting or updating privacy and security policies and procedures. Papers/Discussion-Papers-Summary/?id=866
16 Unauthorized Access to Electronic Records
17 Your Medical Records May Not Be Private, ABC News Investigation, September 13, 2012, Your Medical Records May Not Be Private An ABC News investigation found medical records can be purchased online; With two clicks of a mouse, an IT specialist found someone willing to sell names, birthdates and insurance providers of patients with diabetes and someone willing to sell records of those who purchased health insurance in the last 3 to 12 months; Many of the breaches occur through theft or hacking, inadvertent loss and inside jobs identity thieves may approach medical staff and offer up to $500 a week for providing 20 insurance claim forms, medical records or health financing records; For example, in June, 2012, a technician at Howard University pleaded guilty to selling patient information, including names, birthdates and Medicare numbers, for $500 to $800 per transaction, for more than a year!
18 Orders HO-002 and HO-010 The IPC has issued two orders involving unauthorized access to electronic records of personal health information: Order HO-004 A girlfriend of the patient s estranged husband, who was a nurse at the hospital but who was not involved in the care of the patient, viewed the patient s electronic record on numerous occasions; Order HO-010 A former spouse of the patient s current spouse, who was a diagnostic imaging technologist at the hospital but who was not involved in the care of the patient, viewed the patient s electronic records on multiple occasions.
19 Examples of Unauthorized Access in Other Jurisdictions In 2011, a pharmacist in Alberta was fined $15,000 for accessing the information of 11 women who attended her church and posting prescription information on Facebook; In 2011, a physician in Alberta accessed the information of his partner s former spouse and the mother and girlfriend of the former spouse for a divorce and custody dispute; In 2012, a clerk at Western Health in Newfoundland is alleged to have accessed the information of over 1,000 individuals for unauthorized purposes; In 2012, Eastern Health in Newfoundland terminated five employees and suspended 6 others for unauthorized access.
20 Deterring and Preventing Unauthorized Access to Electronic Records Immediately terminate access to the records pending an investigation into the issue of unauthorized access; Implement appropriate access controls; Consider the use of VIP flags; Log and audit access to records; Implement a policy of zero tolerance and impose appropriate discipline for unauthorized access; Provide training and raise awareness related to appropriate access, including through confidentiality agreements and reminder notices displayed on log in to electronic records.
21 Mobile and Portable Devices
22 Risks of Retaining Electronic Records on Mobile and Portable Devices My office has issued three orders involving mobile and portable devices in the health sector: Order HO Theft of a laptop containing the unencrypted personal health information of 2,900 individuals Order HO Loss of a USB memory stick containing the unencrypted personal health information of 83,524 individuals Order HO Theft of a laptop containing the unencrypted personal health information of 20,000 individuals
23 Reducing the Risks Associated with Mobile and Portable Devices Do not transfer or store personal health information on mobile devices; Consider the alternatives, such as: - Retaining de-identified information on the device; - Retaining encoded information on the device and storing the code to unlock the identifying information separately on a secure computing device; or - Retaining personal health information on a secure server and accessing the information remotely through a secure connection or virtual private network.
24 Reducing the Risks Associated with Mobile and Portable Devices (Cont d) If you must retain personal health information on a mobile or portable device: - Strongly encrypt the personal health information; - Ensure the encryption keys are not stored with or on the device; - Ensure the use of strong password protection; - Only retain the minimal amount of information and for the minimal amount of time necessary; Develop a policy for secure retention on mobile devices: - Provide training on the policy and procedures; - Regularly audit compliance with the policy; - Regularly review the policy and procedures.
25 Cost of Privacy Breaches in Ontario Our experience indicates that breach management costs between $100 and $200 per individual, but this does not consider the cost to our reputation and the erosion of trust. Jacqueline Malonda, et al, Health Care Quarterly, Vol.12, No. 1, 2009.
26 Cost of Privacy Breaches in the U.S. A U.S. study found that between 2006/2007, over 1.5 million names were exposed during data breaches that occurred in hospitals HIMSS Analytics Report: Security of Patient Data, Kroll Fraud Solutions Another U.S. study found that the cost of a data breach was $202 per record; the average cost per operating company was more than $6.6 million per breach Annual Study: Cost of a Data Breach, Ponemon Institute A U.S. report found that the average time it takes to restore an organization s reputation following a data breach is one year and that the minimum brand damage is a 12% loss Survey, Ponemon Institute, February 2011
27 Costs of Legal Liabilities and Proceedings In December 2009, a public health nurse lost a USB key containing the unencrypted health information of 83,524 individuals attending an H1N1 immunization clinic; Following my Order in January 2010, a $40 million class action was initiated by individuals affected by the breach; A settlement was reached and approved by the Ontario Superior Court of Justice on July 12, 2012; Last year in the U.S., a number of fines were issued for violating the Health Insurance Portability and Accountability Act, including a fine of $4.3 million for failing to provide access and a fine of close to $1 million for improper access to an electronic medical record.
28 Minimizing the Risk of Privacy Breaches
30 Building Privacy into the Design of Electronic Records
31 Adoption of Privacy by Design as an International Standard Landmark Resolution Passed to Preserve the Future of Privacy By Anna Ohlden October 29th JERUSALEM, October 29, 2010 A landmark Resolution by Ontario's Information and Privacy Commissioner, Dr. Ann Cavoukian, was unanimously passed by International Data Protection and Privacy Commissioners in Jerusalem today at their annual conference. The resolution ensures that privacy is embedded into new technologies and business practices, right from the outset as an essential component of fundamental privacy protection. Full Article:
32 Privacy by Design: The Trilogy of Applications Information Technology Accountable Business Practices Physical Design & Networked Infrastructure
33 Privacy by Design: The 7 Foundational Principles 1. Proactive not Reactive: Preventative, not Remedial; 2. Privacy as the Default setting; 3. Privacy Embedded into Design; 4. Full Functionality: Positive-Sum, not Zero-Sum; 5. End-to-End Security: Full Lifecycle Protection; 6. Visibility and Transparency: Keep it Open; 7. Respect for User Privacy: Keep it User-Centric.
34 Build A Culture of Privacy Build a culture of privacy privacy must be built into the operational processes and practices of health care providers; The commitment to privacy must come from the top down; Think of privacy as a means of building trust rather than just a matter of regulatory compliance; Ensure those acting on your behalf know how to apply privacy policies and procedures in their day-to-day work; Provide on-going privacy and security training; Use multiple means to communicate privacy messages; Measure the effectiveness of your privacy program.
35 Data Minimization
36 Data Minimization Data minimization is an essential safeguard in protecting personal health information, including for purposes of health research and analysis; Health care providers must not collect, use or disclose personal health information if other types of information (i.e. de-identified or anonymized) will serve the purpose; Health care providers must also not collect, use or disclose any more personal health information than is reasonably necessary to meet the intended purpose.
37 Dispelling the Myths about De-Identification The claim that de-identification has no value in protecting privacy due to the ease of re-identification, is a myth; If proper de-identification techniques and re-identification risk management procedures are used, re-identification becomes a very difficult task; While there may be a residual risk of re-identification, in the vast majority of cases, de-identification will strongly protect the privacy of individuals when additional safeguards are in place.
38 Data De-Identification Tool Developed by Dr. Khaled El Emam, Canada Research Chair at the Electronic Health Information Research Institute; and a leading investigator at the Children s Hospital of Eastern Ont. Research Institute; De-identification tool that minimizes the risk of re-identification based on: - The low probability of re-identification; - Whether mitigation controls are in place; - Motives and capacity of the recipient; - The extent a breach invades privacy; Simultaneously maximizes privacy and data quality while minimizing distortion to the original database.
39 Evidence that the Tool Works Dr. El Emam was approached to create a longitudinal public use dataset using his de-identification tool for the purposes of a global data mining competition the Heritage Health Prize; Participants in the Heritage Health Prize competition were asked to predict, using de-identified claims data, the number of days patients would be hospitalized in a subsequent year; Before releasing the dataset created using Dr. El Emam s tool, the de-identified dataset was subjected to a strong re-identification attack by a highly skilled expert; The expert concluded the dataset could not be re-identified Dr. El Emam's de-identification tool was highly successful!
40 Evidence that Re-Identification is Extremely Difficult A literature search by Dr. El Emam et al. identified 14 published accounts of re-identification attacks on de-identified data; A review of these attacks revealed that one quarter of all records and roughly one-third of health records were re-identified; However, Dr. El Emam found that only 2 out of the 14 attacks were made on records that had been properly de-identified using existing standards; Further, only 1 of the 2 attacks had been made on health data, resulting in a very low re-identification rate of 0.013%.
41 Protocol for Data Linkages Without the Disclosure of any Identifying Information Dr. El Emam has also developed a protocol for securely linking databases without sharing any identifying information; The protocol is described in an article with Dr. Craig Earle entitled Secure Probabilistic De-Duplication of Databases; The protocol uses an encryption system to identify and locate records relating to an individual that may exist in multiple datasets; It involves encrypting personal identifiers in each dataset and comparing the encrypted identifiers using mathematical operations, resulting in a complete list of matched records, without revealing any personal identifiers: All computations are performed on encrypted values; The protocol promotes compliance with existing prohibitions on the disclosure of identifying information in PHIPA by allowing for linkages to take place without the disclosure of any identifying information a win/win, positive-sum solution.
43 Implement a Privacy Breach Protocol Conduct a Privacy Impact Assessment Summary/?id=433 Practices-and-Professional-Guidelines-Summary/?id=574
44 Stop. Think. Protect. Protect Personal Health Information on Mobile and Portable Devices
45 Deter and Prevent Unauthorized Access Immediately terminate access to records pending an investigation into the issue of unauthorized access; Implement appropriate access controls; Consider the use of VIP flags; Log and audit access to records; Implement a policy of zero tolerance; Impose appropriate discipline for unauthorized access; Provide ongoing training using multiple means of raising awareness on appropriate access such as: Confidentiality agreements; Reminder notices displayed upon log-in to electronic records.
46 Conclusions Make privacy a priority ensure that privacy is embedded into the delivery of health care services; It is far easier and more cost-effective to build in privacy up-front, rather than after-the-fact; Privacy risks may best be managed by proactively embedding the principles of Privacy by Design; Beware of unintended consequences; Get smart lead with Privacy by Design, not privacy by chance or, worse, privacy by Disaster!
47 PRIVACY by DISASTER
48 How to Contact Us Ann Cavoukian, Ph.D. Information & Privacy Commissioner of Ontario 2 Bloor Street East, Suite 1400 Toronto, Ontario, Canada M4W 1A8 Phone: (416) / Web: For more information on Privacy by Design, please visit:
EMBEDDING PRIVACY INTO ELECTRONIC HEALTH RECORDS Manuela Di Re Associate Director of Legal Services Information and Privacy Commissioner of Ontario Presentation Outline 1. Definitions 2. Need to Protect
Preventing Privacy Breaches and Building Confidence in Electronic Health Records Brian Beamish Commissioner (Acting) Ontario Information and Privacy Commission Cyber Risk National Conference February 9,
School Psychologists: What You Should Know about the Personal Health Information Protection Act Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario Psychological Services Northeast Toronto
What to do When Faced With a Privacy Breach: Guidelines for the Health Sector ANN CAVOUKIAN, PH.D. COMMISSIONER INFORMATION AND PRIVACY COMMISSIONER/ONTARIO Table of Contents What is a privacy breach?...1
What s New in Access, Privacy and Health Care Brian Beamish Commissioner Ontario Connections May 21, 2015 The Three Acts The IPC ensures compliance with: o Freedom of Information and Protection of Privacy
September, 2015 HOT!! Privacy Issues: Handle with care................... Micheal Harding Legislative & Policy Analyst Legislative Unit Manitoba Health, Healthy Living and Seniors By the end of 2016, the
Foundation Working Group Proposed Recommendations on De-identifying Information for Disclosure to Third Parties The Foundation Working Group (FWG) engaged in discussions around protecting privacy while
Privacy by Design Setting a new standard for privacy certification Privacy by Design is a framework based on proactively embedding privacy into the design and operation of IT systems, networked infrastructure,
Maximize the Value of Your Data and the Ability to Protect Privacy, by Design Ann Cavoukian, Ph.D. Executive Director Privacy and Big Data Institute Ryerson University Ontario University Registrar s Association
BEFORE THE DEPARTMENT OF COMMERCE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Request for Comments Docket # 120214135-2135-01 Multistakeholder Process to Develop Consumer Privacy Codes of Conduct COMMENTS
& Privacy Breach Protocol Guidelines for Government Organizations www.ipc.on.ca Table of Contents What is a privacy breach? 1 Guidelines on what government organizations should do 2 What happens when the
Privacy by Design The 7 Foundational Principles Implementation and Mapping of Fair Information Practices Ann Cavoukian, Ph.D. Information & Privacy Commissioner Ontario, Canada Purpose: This document provides
Embedding Privacy into the Design of EHRs to Enable Multiple Functionalities Win/Win March 2, 2012 Information and Privacy Commissioner, Ontario, Canada Ann Cavoukian, Ph.D. Information & Privacy Commissioner
Leveraging Privacy by Design to Achieve your Business Needs through Big Data, without Compromising Privacy Big Data & Analytics Summit Canada Old Mill, Toronto February 10, 2015 Let s Dispel Some Myths
Data, Data Everywhere The Need for BIG Privacy in a World of Big Data Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario, Canada Future of Consumer Intelligence Universal City, California
Safeguarding Personal Health Information When Using Mobile Devices for Research Purposes Information & Privacy Commissioner, Ontario, Canada Children s Hospital of Eastern Ontario September 13, 2011 The
Information and Privacy Commissioner / Ontario How to Avoid Abandoned Records: Guidelines on the Treatment of Personal Health Information, in the Event of a Change in Practice Ann Cavoukian, Ph.D. Commissioner
Privacy Update Recent Updates in Privacy Law Kathryn Frelick DISCLAIMER This Coffee Talk presentation is provided as an information service and is not meant to be taken as legal opinion or advice. Please
pic pic CIHI Submission: 2011 Prescribed Entity Review October 2011 Who We Are Established in 1994, CIHI is an independent, not-for-profit corporation that provides essential information on Canada s health
SAFEGUARDING PRIVACY IN A MOBILE WORKPLACE Checklist for taking personally identifiable information (PII) out of the workplace: q Does your organization s policy permit the removal of PII from the office?
Cyber Risk in Healthcare AOHC, 3 June 2015 Kopiha Nathan, Senior Healthcare Risk Management and Data Specialist James Penafiel, Underwriting Supervisor, Insurance Operations CFPC Conflict of Interest -
Ann Cavoukian, Ph.D. Information and Privacy Commissioner/Ontario Number 12 May 2007 Encrypting Personal Health Information on Mobile Devices Section 12 (1) of the Personal Health Information Protection
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
Privacy Guidelines for RFID Information Systems (RFID Privacy Guidelines) Information and Privacy Ann Cavoukian, Ph.D. Commissioner June 2006 Commissioner Ann Cavoukian gratefully acknowledges the work
The Ontario Health Study s Assessment Centres: A Case Study for Privacy by Design Ann Cavoukian, Ph.D. Information & Privacy Commissioner Ontario, Canada and Pamela C. Spencer Cancer Care Ontario VP Corporate
Cloud Computing: Legal Risks and Best Practices A Bennett Jones Presentation Toronto, Ontario Lisa Abe-Oldenburg, Partner Bennett Jones LLP November 7, 2012 Introduction Security and Data Privacy Recent
An Executive Overview of GAPP Generally Accepted Privacy Principles Current Environment One of today s key business imperatives is maintaining the privacy of your customers personal information. As business
CANADIAN PRIVACY AND DATA RESIDENCY REQUIREMENTS White Paper Table of Contents Addressing compliance with privacy laws for cloud-based services through persistent encryption and key ownership... Section
Annual Continuing Education (ACE) (Print version) Information Privacy and I.T. Security and Compliance Information Privacy and IT Security & Compliance The information in this module in addition to the
INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER 3 APPLIES TO: ALL STAFF 4 COMMITTEE & DATE APPROVED: AUDIT COMMITTEE
Dispelling the Myths Surrounding De-identification: Anonymization Remains a Strong Tool for Protecting Privacy Ann Cavoukian, Ph.D. Information & Privacy Commissioner, Ontario, Canada Khaled El Emam, Ph.D.
PURPOSE Records and information are important strategic assets of an organization and, like other organizational assets (people, capital and technology), must be managed to maximize their value. Information
Hosting for Healthcare: ADDRESSING THE UNIQUE ISSUES OF HEALTH IT & ACHIEVING END-TO-END COMPLIANCE [ Hosting for Healthcare: Addressing the Unique Issues of Health IT & Achieving End-to-End Compliance
How Does a HIPAA Violation Become a Privacy Breach? Karen Voiles, MBA, CHC, CHPC, CHRC Senior Managing Consultant, Compliance Agenda Differentiating between HIPAA violation and reportable breach Best practices
The secure exchange of protected health information. 2 Table of contents 3 Executive summary 3 The high cost of protected health information being at risk 4 The compliance officer s dilemma: keeping PHI
HIPAA Security Rule Compliance Caryn Reiker MAXIS360 HIPAA Security Rule Compliance what is it and why you should be concerned about it Table of Contents About HIPAA... 2 Who Must Comply... 2 The HIPAA
Privacy by Design Certification Program: Assessment Control Framework Appendix A Privacy by Design Assessment Control Framework Principle 1 Proactive not reactive; preventative not remedial Principle 1
Privacy by Design: What s Been Happening? Ken Anderson Assistant Commissioner (Privacy) Ontario Hong Kong June 13, 2012 Key Definitions Information privacy refers to the right or ability of individuals
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES The implications for privacy and security in the emergence of HIEs The emergence of health information exchanges (HIE) is widely
Page 1 of 11 Date of Issue February 2, 2010 Original Date of Issue Subject References February 2, 2010 PRIVACY BREACH PROTOCOL Policy 2197 Management of Personal Information APM 1450 Management of Personal
Applying the legislation GUIDELINE Information Privacy Act 2009 Privacy breach management and notification A privacy breach occurs when there is a failure to comply with one or more of the privacy principles
Data Breach and Senior Living Communities May 29, 2015 Todays Objectives: 1. Discuss Current Data Breach Trends & Issues 2. Understanding Why The Senior Living Industry May Be A Target 3. Data Breach Costs
Helpful Tips Privacy Breach Guidelines September 2010 Office of the Saskatchewan Information and Privacy Commissioner 503 1801 Hamilton Street Regina, Saskatchewan S4P 4B4 Office of the Saskatchewan Information
Information and Privacy Commissioner Ontario / Submission to the Standing Committee on Industry Bill C-54, Personal Information Protection and Electronic Documents Act Ann Cavoukian, Ph.D. Commissioner
Issue No. 2 THREAT LANDSCAPE Technological developments do not only enhance capabilities for legitimate business they are also tools that may be utilized by those with malicious intent. Cyber-criminals
1 HIPAA: Understanding The Omnibus Rule and Keeping Your Business Compliant Introduction U.S. healthcare laws intended to protect patient information (Protected Health Information or PHI) and the myriad
The Ministry of Information & Communication Technology MICT Document Reference: ISGSN2012-10-01-Ver 1.0 Published Date: March 2014 1 P a g e Table of Contents Table of Contents... 2 Definitions... 3 1.
For ONC S&I DS4P Dennis Giokas Chief Technology Officer Canada Health Infoway Inc. January 25, 2012 1 Outline EHR Business Architecture EHR Solution Blueprint EHR Privacy and Security Summary & Conclusion
OPA Communications and Member Services Committee February 2015 Table of Contents Preamble... 3 General Information... 3 Risks of Using Email... 4 Use of Smartphones and Other Mobile Devices... 5 Guidelines...
The OCR Auditors are coming - Are you next? What to Expect and How to Prepare On June 10, 2011, the U.S. Department of Health and Human Services Office for Civil Rights ( OCR ) awarded KPMG a $9.2 million
Privacy & Big Data: Enable Big Data Analytics with Privacy by Design Datenschutz-Vereinigung von Luxemburg Ronald Koorn DRAFT VERSION 8 March 2014 Agenda? What is 'Big Data'? Privacy Implications Privacy
ERM Symposium April 2009 RI4-Implementing a Comprehensive Privacy Program John Kelly Joseph Nocera Moderator Nancy Bennett Data & Identity Theft: Keeping sensitive data out of the wrong hands Presented
Health Information Privacy Refresher Training March 2013 1 Disclosure There are no significant or relevant financial relationships to disclose. 2 Topics for Today State health information privacy law Federal
Northwestern Memorial Hospital DEPARTMENTAL POLICY Subject: DEPARTMENTAL ADMINISTRATION Title: 1 of 11 Revision of: NEW Effective Date: 01/09/03 I. PURPOSE: This policy defines general behavioral guidelines
Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP A Note discussing written information security programs (WISPs)
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
Whitefish School District R PERSONNEL 5510 page 1 of 5 HIPAA Note: (1) Any school district offering a group health care plan for its employees is affected by HIPAA. School districts offering health plans
Policy Brief: Protecting Privacy in Cloud-Based Genomic Research Version 1.0 July 21 st, 2015 Suggested Citation: Adrian Thorogood, Howard Simkevitz, Mark Phillips, Edward S Dove & Yann Joly, Policy Brief:
RSA SECURE WEB ACCESS FOR HEALTHCARE ENVIRONMENTS Security solutions for patient and provider access AT A GLANCE Healthcare organizations of all sizes are responding to the demands of patients, physicians,
Enforcement of Health Information Privacy & Security Standards Federal Enforcement Through Recent Cases and Tools to Measure Regulatory Compliance Iliana Peters, JD, LLM, HHS Office for Civil Rights Kevin
Data Protection Policy Responsible Officer Author Date effective from July 2009 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date last amended December 2012 Review
CA Technologies Healthcare security solutions: Protecting your organization, patients, and information agility made possible Healthcare industry imperatives Security, Privacy, and Compliance HITECH/HIPAA
Information and Privacy Commissioner/ Ontario Moving Information: Privacy & Security Guidelines Ann Cavoukian, Ph.D. Commissioner July 1997 Information and Privacy Commissioner/Ontario 2 Bloor Street East
Cyber Security: Emerging Risks and Trends (and what you can do about it) UVU Business and Economic Forum May 19, 2016 Presented by: Daniel D. Hill, Esq. Christopher Droubay, Esq. Risks and Trends Widely
HIPAA/HITECH WHAT S YOUR COMPLIANCE STATUS? Daniel B. Mills Pretzel & Stouffer, Chartered WHAT IS HIPAA? 1 DEFINITIONS HIPAA Health Insurance Portability and Accountability Act of 1996 Primarily designed
PREP Course #25: Hot Topics in Cyber Security and Database Security Presented by: Joe Baskin Manager, Information Security, OCIO JBaskin@nshs.edu Objectives Discuss hot topics in cyber security and database
View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP
HIPAA Compliance Guide Important Terms Covered Entities (CAs) The HIPAA Privacy Rule refers to three specific groups as covered entities, including health plans, healthcare clearinghouses, and health care
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES: Privacy Responsibilities and Considerations Cloud computing is the delivery of computing services over the Internet, and it offers many potential
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES HIPAA COMPLIANCE Achieving HIPAA Compliance with Security Professional Services The Health Insurance
Privacy Impact Assessment Guidelines for the Ontario Personal Health Information Protection Act Ann Cavoukian, Ph.D. Commissioner October 2005 Information and Privacy Commissioner/Ontario Privacy Impact
The Impact of Wireless LAN Technology on to the PCI Data Security Standard 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs and PCI Retailers today use computers
HIPAA Update Focus on Breach Prevention Objectives By the end of this program, participants should be able to: Identify top reasons why breaches occur Review the breach definition and notification process
Lessons Learned from Recent HIPAA and Big Data Breaches Briar Andresen Katie Ilten Ann Ladd Recent health care breaches Breach reports to OCR as of February 2015 1,144 breaches involving 500 or more individual
Art Gross President & CEO HIPAA Secure Now! How to Prepare for the 2015 HIPAA Audits and Avoid Data Breaches Speakers Phillip Long CEO at Business Information Solutions Art Gross President & CEO of HIPAA
Ten Questions Your Board Should be asking about Cyber Security Eric M. Wright, Shareholder Eric Wright, CPA, CITP Started my career with Schneider Downs in 1983. Responsible for all IT audit and system