Orange County NC Website
Browse       Search
Policy 31: Policy on Encryption of a-PHI <br /> North State Medical Transport <br /> Policy on Encryption of a-PHI <br /> Purpose <br /> The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") requires <br /> North State Medical Transport to consider encryption as a method for securing our electronic <br /> protected health information ("e-PHI") and to implement a mechanism to encrypt and decrypt <br /> e-PHI if North State Medical Transport determines that doing so is reasonable and appropriate. <br /> Further, encrypting e-PHI consistent with the Department of Health and Human Services' <br /> ("HHS") "Guidance Specifying the Technologies and Methodologies That Render Protected <br /> Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals" will <br /> create the equivalent of a "safe harbor"for North State Medical Transport in the event that <br /> there is a breach of North State Medical Transport's PHI. It is the policy of North State Medical <br /> Transport to use encryption consistent with HHS's Guidance wherever possible, as outlined in <br /> this policy. <br /> Scope <br /> This policy applies to all North State Medical Transport staff members who are <br /> responsible for the manner in which e-PHI is created, received, maintained or transmitted by <br /> North State Medical Transport. The HIPAA Compliance Officer, in conjunction with appropriate <br /> technology professionals,shall be responsible for implementing appropriate <br /> mechanisms to encrypt e-PHI consistent with this policy. <br /> Procedure <br /> 1. The HIPAA Compliance Officer shall, on a periodic basis, meet with appropriate parties, i. <br /> such as management, information technology professionals, software vendors, and <br /> others, to discuss the steps necessary to encrypt all e-PHI that North State Medical <br /> Transport creates, receives, maintains or transmits consistent with HHS's Guidance at: '' <br /> http://www.hhs.gov/ocr/privacy. <br /> a. The HIPAA Compliance Officer shall review or refer appropriate parties to the <br /> National Institute of Standards and Technology("NIST") Special Publications <br /> referenced in this policy(available at www.nist.gov) so that North State Medical <br /> Transport implements appropriate technologies and methodologies to secure e-PHI <br /> as prescribed in the Publications. <br /> b. The HIPAA Compliance Officer shall also annually review HHS's updated Guidance <br /> (available at http://www.hhs.gov/ocr/privacy)for any additional resources <br />