2013-094 Health - State of NC Department of Health for Maintaining and Promoting the Advancement of Public Health in NC

Browse Search

Consolidated Agreement FY14 Page 22 of 23 containing personal information along with the confidential process or key shall constitute a security breach. Good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose is not a security breach,provided that the personal information' not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure. d. "Unsecured protected health information"means protected health information(PHI)that is not rendered unusable,unreadable,or indecipherable to unauthorized individuals through the use of technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Pub.L.111-5. The following PHI shall not be regarded as Unsecured PHI: • Electronic PHI has been encrypted as specified in the HIPAA Security rule by the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without the use of a confidential process or key and such confidential process or key that might enable decryption has not been breached. To avoid a breach of the confidential process or key,these decryption tools should be stored on a device or at a location separate from the data they are used to encrypt or decrypt. The following encryption processes meet this standard: — Valid encryption processes for data at rest(i.e.data that resides in databases, file systems and other structured storage systems) are consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. Valid encryption processes for data in motion(i.e. data that is moving through a network,including wireless transmission) are those that comply, as appropriate,,with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security(TLS)Implementations; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, and may include others which are Federal Information Processing Standards FIPS 140-2 validated. • The media on which the PHI is stored or recorded has been destroyed in the following ways: — Paper,film, or other hard copy media have been shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction. — Electronic media have been cleared,purged, or destroyed consistent with NIST Special Publications 800-88,Guidelines for Media Sanitization, such that the PHI cannot be retrieved.