National Provider Call:  Medicare FFS Implementation of HIPAA Version 5010 and D.0 Transactions – Register Now

Wed Sep 14; 2-3:30pm ET

CMS will host its nineteenth National Education Call regarding Medicare FFS’s implementation of HIPAA Version 5010 and D.0 transaction standards.

Target Audience:  Vendors, clearinghouses, and providers who need to make Medicare FFS-specific changes in compliance with HIPAA Version 5010 requirements.

Agenda (there will be no slide presentation for this call):

• HIPAA Version 5010 Status Update
• Question & Answer Session

If you would like to submit a question related to this topic in advance of, during, or following the call, please email your inquiry to the 5010 FFS Information resource mailbox at 5010FFSinfo@....  Note that this resource will only accept emails the day before, the day of, and the day after this call; your emailed questions will be answered as soon as possible, and may not be answered during the call.

Registration Information:  In order to receive the call-in information, you must register for the call.  Registration will close at 2pm on Tue Sep 13 or when available space has been filled; no exceptions will be made, so please register early.  For more details, including instructions on registering for the call, please visit http://www.eventsvc.com/PalmettoGBA/091411.

###

From: OCR HIPAA Privacy Rule information distribution [mailto:OCR-PRIVACY-LIST@...] On Behalf Of OS OCR PrivacyList, OCR (HHS/OS)
Sent: Tuesday, September 13, 2011 4:15 PM
To: OCR-PRIVACY-LIST@...
Subject: Secretary Sebelius announces appointment of Leon Rodriguez as Director of the HHS Office for Civil Rights

September 13, 2011

HHS Secretary Kathleen Sebelius announced today that Leon Rodriguez has been appointed as Director, Office for Civil Rights (OCR).  Rodriguez most recently served as Chief of Staff and Deputy Assistant Attorney General for the Department of Justice Civil Rights Division.

From May 2007 to January 2010, Rodriguez served as the County Attorney for Montgomery County, Maryland, where he led efforts to provide legal advice and services to County departments, agencies, boards, and commissions, as well as the County Council.

From May 2001 to May 2007, he was a shareholder in the Health Law department of Ober, Kaler, Grimes & Shriver.  In 2004, Rodriguez was named “Outstanding Health Care Litigator” by Nightingale Health Care News.  While in private practice, he served on the board of the Montgomery County Primary Care Coalition, an organization that developed and implemented health care programs for uninsured County residents.

For thirteen years prior to entering private practice, Rodriguez was a federal and state prosecutor in various jurisdictions.  From 1997 to 2001, he was an Assistant U.S. Attorney in Pittsburgh, Pennsylvania assigned to the prosecution of health care fraud cases.  Leon served as the First Assistant U.S. Attorney from 1999-2001, and as the Chief of the White Collar Crimes Section from 1998-1999.  From 1994 – 1997, he served as a trial attorney in the Criminal Section of the U.S. Department of Justice, Civil Rights Division.  Prior to his first DOJ stint, he was an Assistant District Attorney in Brooklyn, NY for six years.

Leon Rodriguez is a graduate of Brown University and Boston College Law School and is fluent in Spanish and French.

Read the HHS Press Release.

September 19, 2011:

NIST Computer Security Division is proud to announce the release of:
Initial Public Draft (IPD) of Special Publication 800-30, Revision 1, Guide for Conducting Risk Assessments

Here are 2 links to where you can read the full announcement of this draft publication release along with a link to the PDF file on the CSRC website:

Draft Publications Page: http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-30-Rev.%201

CSRC News Page: http://csrc.nist.gov/news_events/index.html#sept19

From: NIST Computer Security Resource Center [mailto:csrc.nist@...]
Sent: Monday, October 03, 2011 1:28 PM
To: barbaramcgowin@...
Subject: NIST Released 2 Draft Special Publications: 800-153, Guidelines for Securing Wireless Local Area Networks and 800-121 Rev. 1 Guide to Bluetooth Security

NIST Computer Security Division is proud to announce the release of 2 Draft Special Publications (SP).  See below for the titles of the 2 Draft SPs along with URLs to view the full announcement and also to download/view the document (PDF):

DRAFT SP #1:
Draft Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs)

URL Drafts page:
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-153

DRAFT SP #2:
Draft Special Publication 800-121 Revision 1, Guide to Bluetooth Security

URL Drafts page:
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-121-Rev.%201

You can also review the same announcement to the above 2 Draft SPs from the CSRC News/Announcement page:
http://csrc.nist.gov/news_events/index.html#sept29

Please note - we have received several emails in the past from folks unable to view the PDF file through the web browser.  We have advised folks to place the mouse cursor over the link, then RIGHT click with the mouse.  A menu bar will appear and choose this option "Save Target As" or "Save File As", save the PDF file to your system (make sure you know the directory path that you saved the PDF file to).  Then open the PDF from your system.

NIST Computer Security Division is proud to announce the release of 2 Special Publications (approved final).  See below for details --

Note:  If you are having trouble opening the PDF to any of these 2 SPs, try placing your mouse cursor over the link to the PDF file, then right click with your mouse and choose "Save Target As" or "Save File As".  Save/Download the PDF file to your system.  Remember what directory you saved the PDF file to so you can open it once it is downloaded to your system.

Publication #1:
Special Publication 800-126 Revision 2, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2

To view the announcement of release on CSRC News page:
http://csrc.nist.gov/news_events/index.html#sept30

PDF link to document:
http://csrc.nist.gov/publications/nistpubs/800-126-rev2/SP800-126r2.pdf

Location of document on the Special Publications page:
http://csrc.nist.gov/publications/PubsSPs.html#800-126-rev2

Publication #2:
Special Publication 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

CSRC News page
http://csrc.nist.gov/news_events/index.html#sept30a
(2nd announcement from top)

PDF link to document:
http://csrc.nist.gov/publications/nistpubs/800-137/SP800-137-Final.pdf

Location of document on the Special Publications page:
http://csrc.nist.gov/publications/PubsSPs.html#800-137

Please note - we have received several emails in the past from folks unable to view the PDF file through the web browser.  We have advised folks to place the mouse cursor over the link, then RIGHT click with the mouse.  A menu bar will appear and choose this option "Save Target As" or "Save File As", save the PDF file to your system (make sure you know the directory path that you saved the PDF file to).  Then open the PDF from your system.

National Provider Call:  Time is running out: Medicare FFS Implementation of HIPAA Version 5010 and D.0 Transaction Standards – Register Now

Wed Nov 9; 1:30-3pm ET

CMS will host its twentieth National Education Call regarding Medicare Fee-For-Service (FFS) implementation of HIPAA Version 5010 and D.0 transaction standards.

Target Audience:  Vendors, clearinghouses, and providers who need to make Medicare FFS-specific changes in compliance with HIPAA Version 5010 requirements.

Agenda (there will be no slide presentation for this call):

• Medicare FFS would like to address:  What is preventing you or your customers from transitioning to HIPAA 5010 or D.0?
• Open Discussion

If you would like to submit a question related to this topic in advance of, during, or following the call, please email your inquiry to the 5010 FFS Information resource mailbox at 5010FFSinfo@....  Note that this resource will only accept emails the day before, the day of, and the day after this call; your emailed questions will be answered as soon as possible, and may not be answered during the call.

Registration Information:  In order to receive the call-in information, you must register for the call.  Registration will close at 12pm on the day of the call or when available space has been filled; no exceptions will be made, so please register early.  For more details, including instructions on registering for the call, please visit http://www.eventsvc.com/blhtechnologies.

###

The National Institute of Standards and Technology (NIST) is pleased to announce the release of Special Publication 800-56C. Recommendation for Key Derivation through Extraction-then-Expansion. This Recommendation specifies techniques for the derivation of keying material from a shared secret established during a key establishment scheme defined in NIST Special Publications 800-56A or 800-56B through an extraction-then-expansion procedure.

URL to SP 800-56C (PDF):
http://csrc.nist.gov/publications/nistpubs/800-56C/SP-800-56C.pdf

(note: it was approved as final Nov. 30, it wasn't posted until this week to CSRC website)

NIST announces the public comment release of Draft NIST Special Publication 800-155, BIOS Integrity Measurement Guidelines.

This Draft Special Publication is available on the CSRC Drafts page at:
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-155

You can also view the same announcement on the CSRC News / Announcement page as well:
http://csrc.nist.gov/news_events/index.html#dec8

NIST Computer Security Division is proud to announce the release of Special Publication 800-63-1, Electronic Authentication Guideline.

To view the NIST Press Release of this Special Publication, please visit the NIST webpage at:
http://www.nist.gov/itl/csd/sp80063-121311.cfm

URL to view / download the PDF document (CSRC website):
http://csrc.nist.gov/publications/nistpubs/800-63-1/SP-800-63-1.pdf

If you are interested in viewing other Special Publications that the NIST Computer Security Division has released, you can visit the CSRC Special Publications webpage:
http://csrc.nist.gov/publications/PubsSPs.html

NIST Computer Security Division announces the public comment release of Draft Special Publication (SP) 800-61 Revision 2, Computer Security Incident Handling Guide.  To learn more about this draft document and for the link to the PDF file, please visit the CSRC by either going to the CSRC Drafts page or the CSRC News page:

Note: This draft was ready for posting on January 30 but it wasn't posted to CSRC website until February 1.

Drafts page:
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-61-Rev.%202

News page:
http://csrc.nist.gov/news_events/index.html#feb1

NIST announces the final release of Special Publication (SP) 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs)

 To view the full CSRC Announcement, go to:
http://csrc.nist.gov/news_events/index.html#feb21 

 To view the final publication (SP 800-153), go to (PDF):
http://csrc.nist.gov/publications/nistpubs/800-153/sp800-153.pdf 

 This Special Publication can be located on the CSRC Special Publications page (target link):
http://csrc.nist.gov/publications/PubsSPs.html#800-153

If you have time to devote to the review of this important document, please be aware that the public comment period is February 28^th through April 6^th, 2012.  Send your comments to sec-cert@...

The major changes in Revision 4 include:

·         New security controls and control enhancements;

·         Clarification of security control requirements and specification language;

·         New tailoring guidance including the introduction of overlays;

·         Additional supplemental guidance for security controls and enhancements;

·         New privacy controls and implementation guidance;

·         Updated security control baselines;

·         New summary tables for security controls to facilitate ease-or-use; and,

·         Revised minimum assurance requirements and designated assurance controls.

Those that have evaluated your information systems, implemented security controls, and evaluated the effectiveness of those security controls have valuable information and your comments concerning Revision 4 are much needed.

Thank you for all you do,

Barbara McGowin

DRAFT Security and Privacy Controls for Federal Information Systems and Organizations (Initial Public Draft)

Please visit the CSRC Drafts page to learn more about this new Draft Special Publication.

URL to Drafts page:
http://csrc.nist.gov/publications/PubsDrafts.html

You can also view the same announcement on the CSRC News/Announcement page.

URL to CSRC News page:
http://csrc.nist.gov/news_events/index.html#feb28

Attached is an excel spreadsheet with a break down by state of how many people have benefitted from the Affordable Care Act.  It also tells how much money each state has received to fight unreasonable premium increases, build affordable insurance exchanges and received to improve public health due to the Affordable Care Act.

If you haven’t seen any measurable movement in your state implementing the Affordable Care Act you may want to ask your governor what they did with the money.

Barbara McGowin

843-614-9651

I have attached an internal linked pdf of ACA.  Just click any part of the act listed in pages 1-12 and it will take you to that part of the act in the 906 page document.  You may also go to gpo.gov and download the act, put it won’t have the internal links in it.

Here is the link: http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-111publ148.pdf

I have found that it is much easier using a digital document of a law with internal links applied when trying to get a handle on it and also when refuting false claims of what a law contains. 

Barbara McGowin

For the official online HITECH Act visit http://www.gpo.gov/fdsys/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf

The HITECH Act starts on page 226.  I have attached the HITECH Act.  The attached digital document has internal links applied for ease of reference.  Simply click on the desired section of the act to use the internal links.

The news release below provides information about the first enforcement action resulting from HITECH Act.

Barbara McGowin

___________________________________________________________________________________________

News Release

HHS settles HIPAA case with BCBST for $1.5 million

First enforcement action resulting from HITECH Breach Notification Rule

Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the U.S. Department of Health and Human Services (HHS) $1,500,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, Leon Rodriguez, Director of the HHS Office for Civil Rights (OCR), announced today. BCBST has also agreed to a corrective action plan to address gaps in its HIPAA compliance program. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.

The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.

“This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program,” said OCR Director Leon Rodriguez. “The HITECH Breach Notification Rule is an important enforcement tool and OCR will continue to vigorously protect patients’ right to private and secure health information.”

In addition to the $1,500,000 settlement, the agreement requires BCBST to review, revise, and maintain its Privacy and Security policies and procedures, to conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA, and to perform monitor reviews to ensure BCBST compliance with the corrective action plan.

HHS Office for Civil Rights enforces the HIPAA Privacy and Security Rules. The HIPAA Privacy Rule gives individuals rights over their protected health information and sets rules and limits on who can look at and receive that health information. The HIPAA Security Rule protects health information in electronic form by requiring entities covered by HIPAA to use physical, technical, and administrative safeguards to ensure that electronic protected health information remains private and secure.

The HITECH Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to HHS and the media. Smaller breaches affecting less than 500 individuals must be reported to the secretary on an annual basis.

Individuals who believe that a covered entity has violated their (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy or Security Rule may file a complaint with OCR at: http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.

The HHS Resolution Agreement can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/
resolution_agreement_and_cap.pdf.

Additional information about OCR’s enforcement activities can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.

###

Note: All HHS press releases, fact sheets and other press materials are available at http://www.hhs.gov/news.

Last revised: March 13, 2012

http://www.boisestate.edu/research/recovery/HITECHlegislation.pdf

Second Public Draft, Special Publication 800-130, A Framework for Designing Cryptographic Key Management Systems
 
Public Comment Period: April 13, 2012 through July 30, 2012.
 
Email Comments to: ckmsdesignframework@...Second Public Draft Details:

 
NIST requests comments on SP 800-130, A Framework for Designing Cryptographic Key Management Systems. This is a revision of the document that was provided for public comment in June 2010. Comments are requested by July 30, 2012 and should be sent to ckmsdesignframework@..., with "Comments on SP 800-130" in the subject line. Another document, SP 800-152, which provides a basic profile of this framework document for the Federal government, will be available for initial comment later this year.
 
Links:
Draft SP 800-130 (PDF) on CSRC website:
http://csrc.nist.gov/publications/drafts/800-130/second-draft_sp-800-130_april-2012.pdf
 
Location of Draft on the CSRC Drafts page:
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-130

Phoenix Cardiac Surgery, P.C., of Phoenix and Prescott, Arizona, has agreed to pay the U.S. Department of Health and Human Services (HHS) a $100,000 settlement and take corrective action to implement policies and procedures to safeguard to protected health information of its patients. 

The settlement with the physician practice follows an extensive investigation by the HHS Office for Civil Rights (OCR) for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.

The incident giving rise to OCR’s investigation was a report that the physician practice was posting clinical and surgical appointments for their patients on an Internet-based calendar that was publicly accessible.   On further investigation, OCR found that Phoenix Cardiac Surgery had implemented few policies and procedures to comply with the HIPAA Privacy and Security Rules, and had limited safeguards in place to protect patients’ electronic protected health information (ePHI). 

Among other issues, OCR’s investigation revealed the following issues:

·         Phoenix Cardiac Surgery failed to implement adequate policies and procedures to appropriately safeguard patient information; 

·         Phoenix Cardiac Surgery failed to document that it trained any employees on its policies and procedures on the Privacy and Security Rules;

·         Phoenix Cardiac Surgery failed to identify a security official and conduct a risk analysis; and

·         Phoenix Cardiac Surgery failed to obtain business associate agreements with Internet-based email and calendar services where the provision of the service included storage of and access to its ePHI.

Under the HHS resolution agreement, Phoenix Cardiac Surgery has agreed to pay a $100,000 settlement amount and a corrective action plan that includes a review of recently developed policies and other actions taken to come into full compliance with the Privacy and Security Rules.

•Read the Resolution Agreement and CAP

•For Information on OCR’s Enforcement Activities

•Read the HHS Press Release

.