2016-698 Emergency Svc - North State Medical Transport - Application for Services Franchise by Ordinance

Browse Search

referenced by HHS and ensure that those resources are furnished to appropriate parties. 2. Whenever possible, North State Medical Transport shall convert all paper and hard copy PHI into electronic format and then secure it consistent with encryption methods outlined in this policy. Paper or other hard copy PHI should be scanned or otherwise converted into digital format and then the original hard copy should be shredded or destroyed in a manner that ensures that the PHI can no longer be read or otherwise reconstructed. If North State Medical Transport utilizes an outside agency to shred, destroy or digitize paper and hard copy PHI, North State Medical Transport shall enter into a business associate agreement with that outside party. 3. All e-PHI created, received, maintained or transmitted by North State Medical Transport must be encrypted through the use of an algorithmic process that transforms data into a form in which there is a low probability of assigning meaning without use of a confidential process or key. All encryption keys must be stored in a different location than the data which it is meant to decrypt. North State Medical Transport shall adhere to the following guidelines when encrypting PHI data in various forms: a. PHI at Rest. For PHI data that is "at rest," (i.e., PHI in databases, file systems, stored on flash drives, electronic device memory, and other structured storage methods), North State Medical Transport shall utilize encryption processes that are consistent. with NIST Special Publication 800-111, "Guide to Storage Encryption Technologies for End User Devices." (available at www.nist.gov) b. PHI in Motion. For PHI data "in motion," (i.e., PHI that is being transmitted through a network, wireless transmission, email, or other electronic transmission), North State Medical Transport shall utilize encryption processes that comply with the requirements of Federal Information Processing Standards ("FIPS") 140-2. These include standards described in NIST Special Publications 800-52, "Guidelines for the Selection and Use of Transport Layer Security(TLS) Implementations;" Special Publication 800-77, "Guide to IPsec VPNs;" or Special Publication 800-113, "Guide to SSL VPNs," and may include others which are FIPS 140-2 validated. (NIST Special Publications available at: www.nist.gov).