Privacy

Added Information: NIST SP 800-66 Appendix H: Resources for Secure Remote Use and Access

The HIPAA Security Rule requires all covered entities to protect the EPHI that they use or disclose to business associates, trading partners, or other entities. New technologies, such as remote access and removable media technologies, have significantly simplified the way in which data is transmitted throughout the healthcare industry and created tremendous opportunities for improvements and greater efficiency in the healthcare space. However, these technologies have also increased the risk of loss and unauthorized use and disclosure of this sensitive information. Sensitive information that is accessed by, stored on, or transmitted to or from a remote device needs to be protected so that malicious parties cannot access or alter it. An unauthorized release of sensitive information could damage the trust in an organization, jeopardize its mission, or harm individuals if their personal information has been released. 

In December 2006, CMS issued HIPAA security guidance document, Remote Use of and Access to Electronic Protected Health Information, to reinforce some of the ways a covered entity may protect EPHI when it is accessed or used outside of the organization’s physical purview. It sets forth some strategies that may be reasonable and appropriate under the HIPAA Security Rule, for covered entities to follow (based upon their individual technological capabilities and operational needs), for the offsite use of, or access to, EPHI. This guidance also places significant emphasis on the importance of risk analysis and risk management strategies, policies and procedures, and security awareness and training on the policies and procedures for safeguarding EPHI during its remote access, storage, and transmission.

NIST publications on remote access, storage, and transmission security technologies can be valuable resources to support secure remote use solutions. These publications seek to assist organizations in understanding particular technologies and to provide security considerations and practical, real-world recommendations for implementing and securing these technologies within an organization.

Special Publication 800-114, User’s Guide to Securing External Devices for Telework and Remote Access, was developed to help teleworkers secure the external devices they use for telework, such as personally owned and third-party privately owned desktop and laptop computers and consumer devices (e.g., cell phones, personal digital assistants). The document focuses specifically on security for telework involving remote access to organizations’ nonpublic computing resources by providing:

• Recommendations for securing telework computers’ operating systems and applications, as well as home networks that the computers use;
• Basic recommendations for securing consumer devices used for telework; Advice on protecting the information stored on telework computers and removable media; and
• Advice on protecting the information stored on telework computers and removable media; and
• Tips on considering the security of a device owned by a third party before deciding whether it should be used for telework.