As of April 2005, the Health Information Portability & Accountability Act (HIPAA) security standards mandate that all health care providers establish a contingency plan to respond to any type of computer disaster involving potential data loss. PCIC technology fulfills the requirements of HIPAA, including data integrity, authentication, contingency planning, access and audit controls as they relate to electronic Protected Health Information, including:

• User authentication

• Role based access

• Encryption of data (AES128 bit encryption)

• Offsite data storage outside of the organization

• Secure storage facility

• Transmission Reports

What is HIPAA and Why is it Important?

HIPAA provides national minimum standards to protect an individual’s health information.

HIPAA covers protected health information (PHI) which is any information regarding an individual’s physical or mental health, the provision of healthcare to them, or payment of related services. PHI also includes any personally identifiable information, including for example Employer Identification Number, social security number, name, address, phone number, medical condition when linked to a patient, and some types of billing information. In order to be compliant, organizations must design their systems and applications to meet HIPAA’s privacy and security standards and related administrative, technical, and physical safeguards.

 

Privacy & Security Rules

HIPAA’s Privacy Rule requires that individuals’ health information is properly protected by covered entities. Among other requirements, the privacy rule prohibits entities from transmitting PHI over open networks or downloading it to public or remote computers without encryption. The Security Rule requires covered entities to put in place detailed administrative, physical and technical safeguards to protect electronic PHI. To do this, covered entities are required to implement access controls, encrypt data, and set up back-up and audit controls for electronic PHI in a manner commensurate with the associated risk.

 

Privacy Controls: Encryption Both in Storage and in Transit

HIPAA’s Privacy regulations include standards regarding the encryption of all PHI in transmission (“in-flight”) and in storage (“at-rest”).

Encryption Both in Storage and in Transit : Your data is encrypted before it leaves its computer using the same 128-bit AES security. Data is transmited to PCIC severs using SSL (Secure Socket Layers) technology. So your data is encrypted twice. (to crack one encryption key will take 77,000,000,00,000,000,000,000,000 years!)

 

Data Center Compliance & HIPAA Rules

Customer files are stored, in encrypted form and can be accessed with an Encryption Key that the only customer has. Not even PCIC personnel can access your data. 

HIPAA Privacy Rule	PCIC Backup Solutions	Customer
Safeguards: §164.530 (c) (1)
* Administrative  §164.308	YES	Enabled
* Technical §164.312	YES	Enabled
* Physical §164.310	YES	Enabled
Access to PHI §164.524	NO - Client has the encryption key	YES
Amendment to PHI §164.526	NO - Client has the encryption key	YES
Encryption of PHI §164.312	YES	YES

HIPAA Security Standards Matrix	PCIC Backup Solutions	Customer
Assigned Security Officer §164.308(a)(2)	YES	...
Access Authorization §164.308(a)(4)	NO -Client has access to PHI	YES
Security Incident Reporting §164.308(a)(6)	YES	...
Contingency Plan: Data Back-up §164.308(a)(7)	YES	YES
Contingency Plan: Disaster Recovery §164.308(a)(7)	YES	YES
Business Associate Agreement §164.308(b)(1), 106.103	YES	...
Facility Access Controls §164.310(a)(1)	YES	...
Device & Media Controls §164.308(d)(1)	YES	YES
Access Control §164.312(a)(1)	YES	YES
Transmission Security §164.312(e)(1)	YES	YES