This email is being sent to you from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.

This is an announce-only list, a resource to distribute information about the HIPAA Privacy and Security Rules. For additional information on a wide range of topics about the the Privacy and Security Rules, please visit the OCR Privacy website at http://www.hhs.gov/ocr/privacy/index.html. You can also call the OCR Privacy toll-free phone line at (866) 627-7748. Information about OCR's civil rights authorities and responsibilities can be found on the OCR home page at http://www.hhs.gov/ocr/office/index.html.

If you believe that a person or organization covered by the Privacy and Security Rules (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy or Security Rules, you may file a complaint with OCR. For additional information about how to file a complaint, visit OCR's web page at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.

To subscribe to or unsubscribe from the list serv, please go to: http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1

The first of potentially several reduced price arrangements for health
care providers to obtain X12's Version 005010 HIPAA-adopted Type 3
Technical Reports (TR3s) is now in effect.

Through an agreement between X12 and the American Hospital
Association, AHA members who are not X12 members may purchase X12's
Version 005010 HIPAA TR3s at a discount from the listed price.  X12
members already receive an even greater price-break on these TR3s.
Further details on obtaining the AHA discount, or becoming an X12
member, can be found at  http://store.x12.org/aha_discounts.htm .

In order to facilitate better provider understanding and use of X12's
Version 005010 HIPAA TR3s, X12 is also willing to discuss reduced price
arrangements with other provider associations that may be interested.
Representatives of provider associations interested in opening these
discussions should contact Karyn White, Co-Chair of X12's Provider
Caucus, at kmw1291@... for additional information.

                     Dave Feinberg
                     Rensis Corporation  [A Consulting Company]
                     206-617-1717
                     DAFeinberg@...
                     Author of  "Understanding HIPAA Communications"

----- Original Message #1 -----
   From: CMS CMSProviderResource
   Sent: Thursday, July 30, 2009
   Subject: National Plan and Provider Enumeration System (NPPES) -
                Secure, Maintain and Update Your information

   NPPES - Secure, Maintain and Update Your information

   This message is for health care providers, particularly physicians and
other practitioners, who have obtained National Provider Identifiers
(NPIs) and have records in the National Plan and Provider Enumeration
System (NPPES).  The Centers for Medicare & Medicaid Services (CMS)
recommends that each health care provider, including individual
physicians and non-physician practitioners:

   �         Secure and maintain their own NPPES account information
(i.e., User ID, Password, and Secret Question/Answer) for safety and
accessibility purposes.  Health care providers should maintain the
confidentiality of their User ID, password, and Secret Question/Answer
in order to protect their NPPES information from unauthorized access.

   �         Reset their NPPES passwords at least once a year.  See the
NPPES Application Help page at https://nppes.cms.hhs.gov/NPPES/Help.do
and select the 'Reset Password Page' for applicable rules.  Those rules
indicate the length, format, content and requirements of NPPES
passwords.

   �         Review their NPPES records in order to ensure that the
information reflects current and correct information.  Covered health
care providers are required to update their NPPES information within 30
days of the effective date of the change.


   Viewing NPPES Information

   Health care providers, including physicians and non-physician
practitioners, can view their NPPES information in one of two ways:

   (1) By accessing the NPPES record at
https://nppes.cms.hhs.gov/NPPES/Welcome.do and following the NPI
hyperlink and selecting Login.  The user will be prompted to enter the
User ID and password that he/she previously created. *

   * If the health care provider has forgotten the password, enter the
User ID and click the "Reset Forgotten Password" button to navigate to
the Reset Password Page.  If the health care provider enters an
incorrect User ID and Password combination three times, the User ID will
be disabled.  Please contact the NPI Enumerator at 1-800-465-3203 if the
account is disabled or if the health care provider has forgotten the
User ID.


   OR


   (2) By accessing the NPI Registry at
https://nppes.cms.hhs.gov/NPPES/NPIRegistryHome.do.  The NPI Registry
gives the health care provider an online view of Freedom of Information
Act (FOIA)-disclosable NPPES data.  The health care provider can search
for its information using the name or NPI as the criterion.
Information regarding NPPES data that are FOIA-disclosable can be found
at http://www.cms.hhs.gov/NationalProvIdentStand/ by selecting 'Data
Dissemination'.

   Please note:  Business Mailing Address and Business Practice location
information (full address and corresponding telephone numbers) are key
data elements that are FOIA-disclosable.  Health care providers should
not report their residential address unless it is their Business Mailing
Address or Business Practice location.  The NPPES data appearing on the
NPI Registry cannot be deleted; however, it can be updated or changed.


   Updating NPPES Information

   Health care providers, including physicians and non-physician
practitioners, can correct, add, or delete information in their NPPES
records by accessing their NPPES records at
https://nppes.cms.hhs.gov/NPPES/Welcome.do and following the NPI
hyperlink and selecting Login. The user will be prompted to enter the
User ID and password that he/she previously created.

   Please note: Required information cannot be deleted from an NPPES
record; however, required information can be changed/updated to ensure
that NPPES captures the correct information.  Certain information is
inaccessible via the web, thus requiring the change/update to be made
via paper application.  The paper NPI Application/Update Form
(CMS-10114) can be downloaded and printed at
http://www.cms.hhs.gov/cmsforms/downloads/CMS10114.pdf.


   Deactivating the NPI

   Health care providers, including physicians and non-physician
practitioners, can deactivate their NPIs if the NPIs are no longer
required or needed.  Reasons for deactivation include retirement,
business dissolved, or death of the health care provider.  A request for
deactivation must be submitted via paper application.  The paper NPI
Application/Update Form (CMS-10114) can be downloaded and printed at
http://www.cms.hhs.gov/cmsforms/downloads/CMS10114.pdf.  Health care
providers should review the instructions located on the application
regarding deactivations in order to properly complete the deactivation
request.  The Power of Attorney or Executor of the Will may complete the
application for deactivation due to death of the health care provider.




     ----- Original Message #2-----
     From: CMS CMSProviderResource
     Sent: Monday, August 03, 2009
     Subject: National Plan and Provider Enumeration System (NPPES)
                  Update Announcement for Physicians

     PHYSICIANS!

     Did an academic medical institution or university obtain your NPI
for you?
     If so, is your NPPES record up to date?

     Health care providers, including physicians, began applying for
National Provider Identifiers (NPIs) on May 23, 2005.  Since then, the
National Plan and Provider Enumeration System (NPPES) has assigned
nearly 3 million NPIs.  More than 700,000 NPIs have been assigned to
physicians.

     Many physicians were assigned their NPIs upon their graduation from
medical school.  Often, the administrative staff at the physicians'
academic medical centers or universities applied for the physicians'
NPIs.  The administrative staff handled similar actions for their new
physicians and had, in their records, all the information that needed to
be furnished on the application for an NPI.  Some of these NPIs may have
been assigned as long as 4 years ago.

     The Centers for Medicare & Medicaid Services (CMS) is required by
regulation to make available to the public certain information about
health care providers that is contained in their NPPES records.  This
information includes the name, provider type (e.g., physician), business
practice location address, business mailing address, and business
practice location telephone number.  Publicly available NPPES
information can be found in the NPI Registry, a query-only database
which anyone can access on the Internet
(https://nppes.cms.hhs.gov/NPPES/NPIRegistryHome.do), and in a monthly
downloadable file that individuals with the necessary technical
expertise can download from the Internet
(http://nppesdata.cms.hhs.gov/CMS_NPI_files.html).  Health plans, health
care clearinghouses, health care providers, and others with a need to
know can easily use the NPI Registry to view data for a particular
health care provider simply by entering the health care provider's name
or NPI.  The downloadable file is used primarily by health plans and
other large health industry organizations that need information for all
or most of the health care providers who have NPIs and who may need to
sort or otherwise manipulate the data in the file to suit their business
needs.

     Now, months or years later, many of the physicians whose academic
medical centers or universities obtain their NPIs for them have moved on
in their careers to new locations.  Many have not updated their NPPES
information to show new business practice location addresses, business
mailing addresses, or business practice location telephone numbers.  As
a result, the information in the NPI Registry and in the downloadable
file is out of date.  Academic medical centers and universities whose
addresses and telephone numbers were entered into NPPES as the business
practice locations, business mailing addresses, and business practice
location telephone numbers for the physicians who they formerly employed
are now being burdened with the receipt of mail and telephone calls for
physicians who are no longer there.

     It is not the responsibility of the academic medical centers or the
universities to continue to update the NPPES records of physicians who
are no longer working for them.  In most cases, the academic medical
centers and universities do not have the updated information and,
therefore, are unable to contact the physicians to ask that they update
their NPPES information.

     Unless physicians have agreements in place for others to keep their
NPPES information up to date, the physicians themselves are responsible
for ensuring that their NPPES records contain accurate and current
information.

     Some of these physicians may have enrolled in health plans and may
be sending claims electronically to health plans or conducting other
electronic health transactions with health plans.  These physicians are
"covered entities" under the Health Insurance Portability and
Accountability Act (HIPAA).  As covered entities, they are required by
regulation to update their NPPES records within 30 days of any change.
Those who have NPIs but who do not conduct electronic health
transactions with health plans, and, thus, are not covered entities, are
encouraged to keep their NPPES information up to date.

     We remind all health care providers who have NPIs, not just the
physicians specially noted above, to view their NPPES records and, if
corrections are necessary, to furnish the updates.  Health care
providers who established User IDs and passwords in NPPES can easily
access their NPPES records to make updates.  Those who did not establish
User IDs and passwords may do so at any time.  For assistance in setting
up User IDs and passwords, or in situations where the User ID or
password has been forgotten, health care providers should contact the
NPI Enumerator at 1-800-465-3203.  If they prefer, health care providers
may furnish their updates by filling out the paper NPI application (Form
CMS-10114) and mailing the completed form to the NPI Enumerator.  The
instructions are on the form, along with the mailing address of the NPI
Enumerator.  The form may be downloaded from the CMS forms web page
(www.cms.hhs.gov/cmsforms) or one may be obtained by contacting the NPI
Enumerator at the number above.

###

This email is being sent to you from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.

This is an announce-only list, a resource to distribute information about the HIPAA Privacy Rule. For additional information on a wide range of topics about the the Privacy Rule, please visit the OCR Privacy website at www.hhs.gov/ocr/hipaa/. You can also call the OCR Privacy toll-free phone line at (866) 627-7748. Information about OCR's civil rights authorities and responsibilities can be found on the OCR home page at www.hhs.gov/ocr

If you believe that a person or organization covered by the Privacy Rule (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy Rule, you may file a complaint with OCR. For additional information about how to file a complaint, see the Fact Sheet "How to File a Health Information Privacy Complaint," available at http://www.hhs.gov/ocr/privacyhowtofile.htm .

To subscribe to or unsubscribe from the list serv, please go to: http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1

The following X12N version 005010 draft Implementation Guides are
presently available for free download, review, and public comment:
    005010X291     Health Care Predetermination:  Professional
    005010X292     Health Care Predetermination:  Institutional.
Public comment on these Implementation Guides is a key step in their X12
Type 3 Technical Report (TR3) publication process.

The public comment period for these guides begins on 23 July 2009 and
will close on Saturday, 22 August 2009, at 5:00 p.m. Eastern time.

The Health Care Predetermination Implementation Guides describe the use
of the ANSI ASC X12 Health Care Claim (837) transaction set for the
submission and transfer of predeterminations to health care payers and
clearinghouses.

The authors especially solicit comments on what is needed to support
predetermination or estimate requests for property and casualty
(including worker's comp) and ambulance and other transport-related
services.

This is X12's only unconstrained public comment period.  The authors of
these guides will consider all comments during and following the public
comment period.  For a complete understanding of changes being suggested
and/or made to these guides, reviewers should monitor the on-line
conferences during the public comment period and consider all author
responses prior to the Informational Forums.  Official authoring work
group responses will be posted to the on-line conferences at least 15
days prior to the Informational Forums.

An announcement of the Informational Forums will be made later.  The
Informational Forums, held during an X12 Trimester Meeting, are the
final X12 opportunity to comment:  but generally only on modifications
based on the received public comments.  After that, the guides are
finalized for movement through the Insurance Subcommittee (X12N) and X12
publication approval processes.

The two draft implementation guides are available for free download at:
http://store.x12.org/x291 and  http://store.x12.org/x292 . Comments on
the drafts may be submitted by anybody -- X12 member or not -- via the
on-line conferences at:
http://www.wpc-edi.com/conferences/tg2/implementationguides .

The two Health Care Predetermination Implementation Guides, 005010X291
and 005010X292, are not counterparts of any that have been adopted
under HIPAA, and no official discussions regarding any such adoption are
presently contemplated.  At this juncture, only voluntary use of these
TR3s is anticipated.

Participation in X12's public comment period for the two Health Care
Predetermination Implementation Guides is open to all who may be
interested; whether or not members of Accredited Standards Committee
X12.  Please participate -- this is the highest leverage opportunity for
anybody outside of the authors to impact this document.

                     Dave Feinberg
                     Rensis Corporation  [A Consulting Company]
                     206-617-1717
                     DAFeinberg@...
                     Author of  "Understanding HIPAA Communications"

For your near term planning, be advised that X12N is currently putting
the final touches on drafts of two new version 005010 Type 3 Technical
Reports (TR3s):
    005010X291     Health Care Predetermination:  Professional
    005010X292     Health Care Predetermination:  Institutional.
These TR3s describe "the use of the ANSI ASC X12 Health Care Claim (837)
transaction set for the submission and transfer of  ...
predeterminations to health care payers and clearinghouses."

In accordance with X12N's TR3 creation procedures, both of these new
TR3s will be made available for at least thirty days of public comment.
As of the moment, these public comment periods are targeted to begin
sometime during the latter half of this month:  July, 2009.

Thought you might want to know about this as you make your summer
reading lists.

                     Dave Feinberg
                     Rensis Corporation  [A Consulting Company]
                     206-617-1717
                     DAFeinberg@...
                     Author of  "Understanding HIPAA Communications"

----- Somewhat Edited Original Message -----
From: Nancy Spector
Sent: Thursday, May 21, 2009 2:01 PM
Subject: Survey: Timeframe to rollout possible revised 1500 claim form

The National Uniform Claim Committee (NUCC) is researching the needs for
a possible revised 1500 claim form.  No decision has been made yet about
whether or not we will revise the form, but we need to know if we do
revise it, when would be the best time to roll it out, with the 5010 and
ICD-10 work going on.

We want to make sure that we get the provider perspective on when would
be the best time to roll out a revised form.

The following is a link to a survey asking about the best timeframe to
rollout a revised form.

http://www.surveymonkey.com/s.aspx?sm=E6dM98zYy8EsJp4v_2fqC6hg_3d_3d

Please distribute this link to your constituents and encourage them to
complete the survey.  The deadline for completing the survey is close of
business Wednesday June 10th.

Thanks,

Nancy

Nancy Spector, RN MSC
Director, Electronic Medical Systems
American Medical Association
515 N. State St
Chicago, IL 60654
Phone: 312-464-4059

This email is being sent to you from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.

This is an announce-only list, a resource to distribute information about the HIPAA Privacy Rule. For additional information on a wide range of topics about the the Privacy Rule, please visit the OCR Privacy website at www.hhs.gov/ocr/hipaa/. You can also call the OCR Privacy toll-free phone line at (866) 627-7748. Information about OCR's civil rights authorities and responsibilities can be found on the OCR home page at www.hhs.gov/ocr

If you believe that a person or organization covered by the Privacy Rule (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy Rule, you may file a complaint with OCR. For additional information about how to file a complaint, see the Fact Sheet "How to File a Health Information Privacy Complaint," available at http://www.hhs.gov/ocr/privacyhowtofile.htm .

To subscribe to or unsubscribe from the list serv, please go to: http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1

In the Final Rule adopting X12 version 005010 Type 3 Technical Reports
for HIPAA {Federal Register, Vol. 74, No. 11, 16 January 2009, page
3298, middle of second column and top of third column}, CMS wrote,

     "After publication of the final rule, all of the technical comments
      reviewed by the X12 workgroup, with the dispositions, will be
      posted on the CMS Web site ... as well as on the X12 portal [sic]
      ... ."

X12N's original of this report -- 239 pages -- is now posted at
http://www.x12.org/x12org/subcommittees/X12N/N0221_X12Responses_to_Tech.pdf

                     Dave Feinberg
                     Rensis Corporation  [A Consulting Company]
                     206-617-1717
                     DAFeinberg@...
                     Author of  "Understanding HIPAA Communications"

-----Original Message-----
From: compsecpubs@... [mailto:compsecpubs@...] On Behalf Of
Patrick O'Reilly
Sent: Friday, March 20, 2009 4:55 PM
To: Multiple recipients of list
Subject: NIST Announces the Release of Draft Special Publication 800-16
Revision 1


NIST announces the release of the Initial Public Draft (IPD) of
Special Publication 800-16, Revision 1, Information Security Training
Requirements: A Role- and Performance-Based Model. This publication
is now available for public comment.

The comprehensive training methodology provided in this publication
is intended to be used by federal information security professionals
and instructional design specialists to design (1) role-based
training courses or modules for personnel who have been identified as
having significant responsibilities for information security, and (2)
a basics and literacy course for all users of information systems.

We encourage readers to pay special attention to the Notes to
Reviewers section, as we are looking for feedback on the many changes
we have made to this document.

Comments will be accepted until June 26, 2009. Comments should be
forwarded via email to 800-16comments@....

URL to Draft SP 800-16 Rev. 1:
http://csrc.nist.gov/publications/PubsDrafts.html#800-16-rev1


Quick update - in the email sent to list on March 3, the NIST IR 7536
2008 Computer Security Division Annual Report was released.  We have
updated the PDF file for this document.  We now have a final layout
version available which includes charts, graphics, etc.  The text
inside this report did not change.  For those interested in viewing
the final printed version can find the updated PDF file here:

It is a PDF file and depending on your Internet speed, it may take a
couple extra seconds to load - PDF file is about 3.9 MB.
http://csrc.nist.gov/publications/nistir/ir7536/NISTIR-7536_2008-CSD-Annual-
Report.pdf

The official updated HIPAA transactions and code sets regulations
including X12 Version 005010,  ICD-10-CM,  ICD-10-PCS,  and various
NCPDP standards are now in effect as of 3/17/2009.  The online Code of
Federal Regulations (CFR) was updated last night, 3/18/2009, to
incorporate the modifications published in the Federal Register on
1/16/2009.  These most recent complete regulations may be viewed at
http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title45/45c\
fr162_main_02.tpl
starting at Subpart I -- General Provisions for Transactions.


Copies of X12's Type 3 Technical Reports (TR3s) incorporated by
reference into the updated regulations may be obtained via the
following link:
         http://store.X12.org .

As CMS is no longer subsidizing X12 for these documents, it will cost
you directly to have them downloaded or shipped.  Note, though, that
there is a single price for a package of all nine of the adopted version
005010 TR3s, and significant discounts are available to X12 members.

The first page of an online X12 membership application, including a dues
schedule, is located at
https://www.disa.org/apps/memberservices/x12/X12MembershipSection1.cfm


A summary of the changes between the current X12 version 004010 and
004010A1 Implementation Guides and the newly adopted version 005010 TR3s
is available at
http://www.x12.org/x12org/subcommittees/X12N/N0221_WEDI-X12-V5010_file.pdf.
Additionally, playbacks of webinars about the adopted X12 version 005010
TR3s can be arranged via
         http://www.x12.org/webinars/5010.cfm.
Topics covered in these webinars include:
   + the business justification for solutions included in version 005010
   + examples of how the implementation of version 005010 transactions
      addresses industry-requested requirements
   + specific answers to some of the questions from public comments to
      the Notice of Proposed Rule Making (NPRM)
   + details of changes across all affected transactions, including the
      explanatory, technical and structural modifications
   + details of how version 005010 is improved compared to version
      004010 and 004010A1
   + insight from original subject matter experts.
Again note that X12 members receive a discount on webinar fees.


Researched questions regarding the contents of any of X12's version
005010 TR3s for health care, as well as the current HIPAA-adopted 004010
and 004010A1 Implementation Guides, may be submitted to X12's Insurance
Subcommittee Interpretations Portal at www.x12n.org/portal .  Responses
to prior questions -- approximately 575 to date -- are easily located
via the Portal's search feature, and links to other useful sites are
also provided.  The Portal is open to all, and there is no charge for
using it.


Happy implementing to all.  Contact me should you have any questions or
desire any additional information.  And keep in mind that work on the
next iteration, presently version 005050, of the nine HIPAA-adopted X12
TR3s is already in progress.

                     Dave Feinberg
                     Rensis Corporation  [A Consulting Company]
                     206-617-1717
                     DAFeinberg@...
                     Author of  "Understanding HIPAA Communications"

-----Original Message-----
From: compsecpubs@... [mailto:compsecpubs@...] On Behalf Of
Patrick O'Reilly
Sent: Friday, February 27, 2009 5:33 PM
To: Multiple recipients of list
Subject: NIST Releases 2 Draft Documents and Mark-up Copy of SP 800-53 Rev.
3


NIST Computer Security Division released 2 draft publications
(Special Publication & NIST Interagency Report) today and 1 Mark-up
Copy of Draft SP --

1. Mark-up copy of Draft Special Publication (SP) 800-53 Revision 3
2. Draft Special Publication 800-81 Revision 1
3. Draft NIST Interagency Report (IR) 7517

1. Draft SP 800-53 Rev. 3: Recommended Security Controls for Federal
Information Systems and Organizations
The following document provides a line-by-line (mark-up copy)
comparison between SP 800-53, Revision 2 and Draft SP 800-53,
Revision 3. It should also be noted that the section of the
publication addressing scoping considerations for scalability, was
inadvertently omitted from the public draft and will be reinstated in
the final publication.

URL: http://csrc.nist.gov/publications/PubsDrafts.html#800-53_Rev3

******

2. Draft SP 800-81 Rev. 1: Secure Domain Name System (DNS) Deployment Guide
NIST has drafted a new version of the document "Secure Domain Name
System (DNS) Deployment Guide (SP 800-81)". This document, after a
review and comment cycle will be published as NIST SP 800-81r1. There
will be two rounds of public comments and this is our posting for the
first one. Federal agencies and private organizations as well as
individuals are invited to review the draft Guidelines and submit
comments to NIST by sending them to SecureDNS@... before March
31, 2009. Comments will be reviewed and posted on the CSRC website.
All comments will be analyzed, consolidated, and used in revising the
draft Guidelines before final publication.

Reviewers of the draft revised Guidelines should note the following
differences and additions:
    (1) Updated Recommendations for all cryptographic operations
relating to digital signing of DNS records, verification of the
signatures, Zone Transfer, Dynamic Updates, key Management and
Authenticated Denial of Existence.
    (2) The additional IETF RFC documents that have formed the basis
for the updated recommendations include: DNNSEC Operational Practices
(RFC 4641), Automated Updates for DNS Security (DNSSEC) Trust Anchors
(RFC 5011), DNS Security (DNSSEC) Hashed Authenticated Denial of
Existence (RFC 5155) and HMAC SHA TSIG Algorithm Identifiers (RFC 4635).
    (3) The FIPS standards and NIST guidelines incorporated into the
updated recommendations include: The Keyed-Hash Message
Authentication Code (HMAC) (FIPS 198-1), Digital Signature Standard
(FIPS 186-3) and Recommendations for Key Management (SP 800-57P1 & SP
800-57P3).
    (4) Illustration of Secure configuration examples using DNS
Software offering NSD, in addition to BIND.

URL: http://csrc.nist.gov/publications/PubsDrafts.html#800-81-rev1

******

3: DRAFT The Common Misuse Scoring System (CMSS): Metrics for
Software Feature Misuse Vulnerabilities
Draft NIST Interagency Report (IR) 7517, The Common Misuse Scoring
System (CMSS), is now available for public comment. This report
proposes a specification for CMSS, a set of standardized measures for
the severity of software feature misuse vulnerabilities. NISTIR 7517
also provides examples of how CMSS measures and scores would be
determined. Once CMSS is finalized, CMSS data can assist
organizations in making security decisions based on standardized,
quantitative vulnerability data.

NIST requests comments on Draft NISTIR 7517 by April 3, 2009. Please
submit comments to IR7517comments@... with "Comments IR 7517" in
the subject line.

URL: http://csrc.nist.gov/publications/PubsDrafts.html#nistir-7517

-----Original Message-----
From: compsecpubs@... [mailto:compsecpubs@...] On Behalf Of
Patrick O'Reilly
Sent: Tuesday, February 17, 2009 1:15 PM
To: Multiple recipients of list
Subject: NIST Releases 2 Draft Special Publications


You may already have seen these 2 new drafts from Feb. 5-6 on CSRC website.
If not, please review the announcement below --

Document #1:  Draft Special Publication 800-85A-1 "PIV Card
Application and Middleware Interface Test Guidelines (SP800-73-2
compliance)"

NIST has a revised version of NIST Special Publication SP 800-85A
"PIV Card Application and Middleware Interface Test Guidelines
(SP800-73 compliance)". The revised document is titled Draft SP
800-85A-1 "PIV Card Application and Middleware Interface Test
Guidelines (SP800-73-2 compliance)" and is posted on the Computer
Security Resource Center Web site (www.csrc.nist.gov). The revisions
include the additional tests necessary to test some of the optional
features added to the PIV Data Model and Card Interface as well as
the PIV Middleware through specifications SP 800-73-2 Parts 1, 2 and
3. A short summary of the changes is available here. This document,
after a review and comment period, will be published as NIST SP
800-85A-1. Federal agencies and private organizations including test
laboratories as well as individuals are invited to review the draft
Guidelines and submit comments to NIST by sending them to
PIVtesting@... with "Comments on Public Draft SP 800-85A-1" in
the subject line. Comments should be submitted using the comment
template (Excel spreadsheet). The comment period closes at 5:00 EST
(US and Canada) on February 28, 2009. All comments will be analyzed,
consolidated, and used in revising the draft Guidelines before final
publication..

URL to this Draft document:
http://csrc.nist.gov/publications/PubsDrafts.html

--------------

Document #2: Draft Special Publication 800-53 Rev. 3 Recommended
Security Controls for Federal Information Systems and Organizations

NIST announces the release of the Initial Public Draft (IPD) of
Special Publication 800-53, Revision 3, Recommended Security Controls
for Federal Information Systems and Organizations. This is the first
major update of Special Publication 800-53 since its initial
publication in December 2005. We have received excellent feedback
from our customers during the past three years and have taken this
opportunity to provide significant improvements to the security
control catalog. In addition, the changing threat environment and
growing sophistication of cyber attacks necessitated specific changes
to the allocation of security controls and control enhancements in
the low-impact, moderate-impact, and high-impact baselines. We also
continue to work closely with the Department of Defense and the
Office of the Director of National Intelligence under the auspices of
the Committee on National Security Systems on the harmonization of
security control specifications across the federal government. And
lastly, we have added new security controls to address
organization-wide security programs and introduced the concept of a
security program plan to capture security program management
requirements for organizations. The privacy-related material,
originally scheduled to be included in Special Publication 800-53,
Revision 3, will undergo a separate public review process in the near
future and be incorporated into this publication, when completed.
Comments will be accepted until March 27, 2009. Comments should be
forwarded via email to sec-cert@....

URL to Draft SP 800-53 Rev. 3
http://csrc.nist.gov/publications/PubsDrafts.html

This email is being sent to you from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.

This is an announce-only list, a resource to distribute information about the HIPAA Privacy Rule. For additional information on a wide range of topics about the the Privacy Rule, please visit the OCR Privacy website at www.hhs.gov/ocr/hipaa/. You can also call the OCR Privacy toll-free phone line at (866) 627-7748. Information about OCR's civil rights authorities and responsibilities can be found on the OCR home page at www.hhs.gov/ocr

If you believe that a person or organization covered by the Privacy Rule (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy Rule, you may file a complaint with OCR. For additional information about how to file a complaint, see the Fact Sheet "How to File a Health Information Privacy Complaint," available at http://www.hhs.gov/ocr/privacyhowtofile.htm .

To subscribe to or unsubscribe from the list serv, please go to: http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1

Hello,

iTech Workshop (iTech), a Data Integration for Healthcare company announces the availability of expEDIum Claim Browser (eCB) tool that supports electronic EDI 837P claim file browsing as a free download. This utility is aimed at the healthcare market participants that use HIPAA EDI. This tool is available at http://www.itechws.com/downloads.shtml

Loken Singh

Inside Sales - Support Executive

www.itechws.com