HIPAA Compliance with Privacy and Security Rules

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 allow the federal government to mandate the ways in which health care organizations store and transmit individuals’ personal health information.

Your Information technology (IT) partner should understand how The Privacy Rule and The Security Rule effect implemented systems and software.

The Privacy Rule

The Privacy Rule establishes minimum Federal standards for safeguarding the privacy of individually identifiable health information.

Health plans, health care clearing houses, and certain health care providers my comply with this Rule.

Individuals are given certain rights by the Privacy Rule including access to health information records and when certain types of health information is shared with other people and organizations.

The Security Rule

Companies who are covered by HIPPA are also required to take specific steps to protect Electronic PHI (ePHI).

All security requirements can be defined as one of three basic safeguards:

• administrative
• physical
• technical

Basic requirements include

• Adopting policies and procedures to protect ePHI
• Adopting policies and procedures to protect the security of patient information, including a policy on workstation use
• Developing and implementing data access control procedures
• Implement technical mechanisms to prevent unauthorized access
• Establish a reporting and response system for confidentiality violations

The HIPAA Privacy and Security Rule requirements are designed to be technology neutral and scalable from the smallest to the largest companies and organizations. It is typically a custom combination of software and process which allows companies to be in compliance with the requirements of the Privacy and Security Rules.

I'll follow-up with another article describing more

2009 Annual Report on Computer Security

PandaLabs, part of Panda Security, a leading provider of computer security solutions, has released their 2009 Annual Report on computer security.

Bottom line: It is pretty scary reading. 2009 was, without a doubt, a record-setting year for the creation of new threats and security issues. Cyber-criminals have become much better at making money from their malware and avoiding detection.

To read the report makes you feel that there is no way to be a user of computers safely these days. That isn't true (yet) but new solutions and security approaches are required as new threats are created. The amount of money made from malware in 2009 was more than any previous year so it is safe to safe that we will be seeing more of the same in 2010 and beyond.

Here are some highlights of the report:

• 25 million new strains of malware were identified in just one year, compared to a combined total of 15 million throughout the rest of Panda Security’s 20-year history.
  
• Banker Trojans and fake antivirus programs topped the threat ranking
• Social networks (Facebook, Twitter, YouTube or Digg) and SEO attacks were favored by cybercriminals for spreading malicious code
• Politically motivated cyber-attacks significantly increased throughout 2009

Stayed tuned for my analysis as I read through the report but if you want to read it yourself you can find the pdf file here: 2009 Annual Report from PandaLabs.

Using Backup Assist with rSync.net servers

I have been a fan of rsync.net services for a few years now and have always been looking for ways to improve automating backups to their servers. Backup Assist recently added Rsync protocol support in their v5 product and I've been eager to get it to work.

rsync.net's servers do not allow open access via the shell so I had to use the following steps to manual create and move the .ssh keys to the server:

1. Move any existing files out of the default location where Backup Assist stores the SSH keys.

• Windows XP: “C:\Documents and Settings\All Users\Application Data\BackupAssist v5\.ssh”
• Windows Vista/7: “C:\Programdata\Backupassist v5\.ssh.
  

2. In Backup Assist, configure the rSync server credentials and click on “Register with server” and ignore any errors.

3. Verify that three new files have been created in the local Backup Assist .SSH directory listed above. The files are:

• Ba_id_dsa
• Ba_id_dsa.pub
• known_hosts

4. Rename the file “Ba_id_dsa.pub” to “authorized_keys”

5. Use WinSCP to connect to the rsync.net account you are configuring

6. Copy the local “authorized_keys” file in to the remote .ssh folder

7. Click on “Test connection…” in Backup Assist to confirm this worked.

8. If the test fails, restart at step 1 and verify that file time stamps on the local machine are current.

9. Disable the media usage report in the "rsync options" settings tab. The restrictions on the rsync.net server mean that the media usage report won't work either, but rsync.net provide other methods for getting server disk usage information.

Hope this information helps someone else!

Facebook Scam Artists Snag the F.C.C. Chairman

This article in the New York Times is a good reminder of how easy it is for Facebook users to be tricked into compromising the safety and security of their Facebook accounts. Read about the Chairman of the F.C.C.'s travails here.

Facebook Privacy Changes Go Live; Understand the 'Everyone' settings

Facebook has made important changes to their privacy options and every Facebook user should be aware of them.

The changes give users much better control of who sees your information, including being able to restrict viewing to an individual if you desire.

Settings include "only friends" and "friends of friends." A "customize" option allows users to show or hide a post from specific individuals or user-created lists. The options are available by clicking on a new "lock" icon that appears next to the "share" button when a Facebook user updates their status. Any setting may be chosen as a default and the default option may be changed as desired.

Especially important is the new "everyone" setting that determines whether a Facebook post will be seen on other services, such as in Google search results. Here is a description of the "Everyone" setting:

"Information set to 'everyone' is publicly available information, may be accessed by everyone on the Internet (including people not logged into Facebook), is subject to indexing by third party search engines, may be associated with you outside of Facebook (such as when you visit other sites on the internet), and may be imported and exported by us and others without privacy limitations.

The default privacy setting for certain types of information you post on Facebook is set to 'everyone.' You can review and change the default settings in your privacy settings. If you delete 'everyone' content that you posted on Facebook, we will remove it from your Facebook profile, but have no control over its use outside of Facebook."

Read this post from Facebook to learn more.

New Security Alerts for Adobe Flash

Adobe has released a new security bulletin titled: "APSB09-19 - Security updates available for Adobe Flash Player" which warns of "Critical vulnerabilities that have been identified in Adobe Flash Player version 10.0.32.18 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system."

Adobe recommends users of Adobe Flash Player 10.0.32.18 and earlier versions update to Adobe Flash Player 10.0.42.34 by downloading it from the Flash Player Download Center or by using the auto-update mechanism within the product when prompted.

Be careful at the Adobe Flash Player Download Center page as they will ask if you want to download and install a McAfee security scan program at the same time. If you have a working anti-virus solution, which is up to date with definitions, you should uncheck the option to download the McAfee program.

On-line safety - Firefox and NoScript

If you've been a client of Cavu Networks then you have been told that running Firefox as your primary Internet browser is preferred. There is a terrific Firefox Extension called NoScript that makes it even safer and is highly, highly recommended.

The NoScript Firefox extension provides extra protection for Firefox. This free, open source add-on stops potentially dangerous scripts and applets (JavaScript, Java, Flash and other plugins) from being run. NoScript also provides the most powerful Anti-Cross Site Scripting (XSS) protection available in a browser.

You can download and install NoScript here: http://noscript.net/. You can enable JavaScript, Java and plugin execution for sites you trust with a simple left-click on the NoScript status bar icon. There is also a good video called "Using NoScript" on YouTube which describes how to use NoScript which was contributed by John Wilkerson.