White Paper: The Tripwire HIPAA Solution: Meeting The Security Standards Set Forth In Section 164

On February 17, 2009, President Obama signed into law the American Recovery and Reinvestment Act of 2009. The law includes new rules that affect the health care industry and those entities that might handle, process or maintain personal health information. The new rules revolve around two primary areas:

• The mandated adoption of new electronic health record systems (and standards, controls and protections around that adoption)
• The expansion of breach notification rules concerning personal health records.

If is the Recovery Act raises any concerns, it is that these new rules outlined in the Act clearly must coexist with the 1996 HIPAA law. HIPAA security rules did not address the security of Protected Health Information (PHI) by all entities that might handle or process protected health information; specifically, it did not address the electronic health records, aggregators, personal health record (PHR) vendors and processors that are addressed by the Recovery Act. While the Recovery Act tries to recognize and address the boundaries between the Recovery Act and HIPAA, some in the industry express concern that the next steps are unclear and have doubts that the Recovery Act will be flexible enough to address the business structures that it will create. However, few doubt that many technical and procedural concerns will have to be ironed out by the Department of Health and Human Services (HHS) or the legal system.

The Tripwire Technology and HIPAA
The Tripwire solution for HIPAA incorporates best practices for high integrity systems management. A CE using Tripwire to meet the requirements of HIPAA creates a system that reduces the time spent fighting fires caused by poor network and data security practices, and enhances the data security of ePHI. While complying with HIPAA is rarely a simple task, it can be straightforward and largely automated using a core feature of the Tripwire Enterprise product called Enhanced File Integrity Monitoring.