Industry Solutions

In 2005, the Health Insurance Portability and Accountability Act (HIPAA) Security Rule became effective outlining administrative, technical and physical safeguards to protect electronic protected health information (EPHI). The objectives of the HIPAA Security Rule are to ensure the confidentiality, integrity and availability of EPHI; protect against any reasonably anticipated threats and hazards to the security or integrity of EPHI; and protect against any reasonably anticipated uses or disclosures of such information that are not permitted by the Privacy Rule.

IDC Partners can help your health care organization pending on your current level of need. Specifically, our team can provide education through a HIPAA Stewardship to a more comprehensive report by conducting a HIPAA Vulnerability Assessment.

Our HIPAA Stewardship is a two day engagement that looks at current HIPAA regulations and the compliancy of your organization. The first day of the Stewardship is on-site with the client consisting of a educational session followed by a mini assessment designed to provide a picture of your organization's current HIPAA Security Rule preparedness. The second day we generate a compliancy report card and recommended action items satisfying the HIPAA Security Rule regulations.

For a more in depth look, our HIPAA Vulnerability Assessment is a phased engagement with a discovery portion that includes a network vulnerability assessment, walk-through of your office space, interview of key personnel, and review of policy documentation along with third party contracts. The outcome of the Vulnerability Assessment will be mapped to the HIPAA Security Rule Standards and Implementation Specification. IDC Partners' employs a collaborative approach in the development of the HIPAA Vulnerability Assessment drawing on the broad experience of our consultant team.

Have you considered?

  • Do you have a risk management plan that includes security measures sufficient to reduce EPHI vulnerabilities to a reasonable and appropriate level?
  • Do you conduct periodic technical and non-technical evaluations asto whether evironmental or operational changes adversely affect the security of your EPHI?
  • Do you have written contingency plans or procedures governing your diaster recovery, including restoration of EPHI and applications in the event of a diasaster?
  • Do you have a facility security plan to protect hardware from unauthorized physical access, tampering and theft?
  • What policy do you follow for eliminating access to EPHI when a member of your workforce is terminated or no longer requires acess to EPHI?
  • How do you determine if the access of a workforce member to EPHI is appropriate?