About the Author |
|
xiii | |
Preface |
|
xv | |
|
Chapter 1 Dissecting a book title |
|
|
1 | (2) |
|
Chapter 2 How well protected is your protected health information? Perception versus reality |
|
|
3 | (16) |
|
The cost of insecurity is steep |
|
|
5 | (1) |
|
A closer look at data breach fines |
|
|
6 | (4) |
|
Do not ignore individual states in breach investigations |
|
|
10 | (1) |
|
Fines are only part of the problem |
|
|
11 | (2) |
|
Factoring in the meaningful use program |
|
|
13 | (1) |
|
Calculating the cost of security |
|
|
14 | (2) |
|
|
16 | (3) |
|
Chapter 3 Regulations governing protected health information |
|
|
19 | (14) |
|
Defining the crown jewels |
|
|
19 | (3) |
|
HIPAA privacy versus security rules: related but different |
|
|
22 | (2) |
|
Technology is only part of the equation |
|
|
24 | (1) |
|
Enforcing HIPAA regulations |
|
|
25 | (1) |
|
A closer look at the HIPAA Security Rule |
|
|
26 | (1) |
|
The HIPAA Breach Notification Rule |
|
|
27 | (1) |
|
The role of the Federal Trade Commission |
|
|
28 | (2) |
|
|
30 | (1) |
|
|
31 | (2) |
|
|
33 | (18) |
|
|
33 | (1) |
|
Compliance versus management |
|
|
34 | (2) |
|
The ONC approach to risk analysis and security management |
|
|
36 | (4) |
|
Finding the right analysis tools |
|
|
40 | (3) |
|
Tapping the HHS resources |
|
|
43 | (2) |
|
Beware the "required" versus "addressable" confusion |
|
|
45 | (2) |
|
Moving beyond a checklist of security questions |
|
|
47 | (2) |
|
|
49 | (2) |
|
Chapter 5 Reducing the risk of a data breach |
|
|
51 | (24) |
|
Seeing the larger picture |
|
|
52 | (1) |
|
The best mindset: guilty until proven innocent |
|
|
52 | (1) |
|
Passwords, policies, and procedures |
|
|
53 | (3) |
|
Establishing effective governance |
|
|
56 | (1) |
|
|
56 | (11) |
|
Establishing physical safeguards |
|
|
67 | (1) |
|
|
68 | (2) |
|
Testing your network security |
|
|
70 | (2) |
|
|
72 | (1) |
|
|
72 | (3) |
|
Chapter 6 Mobile device security |
|
|
75 | (14) |
|
|
75 | (1) |
|
|
76 | (3) |
|
BYOD: bring your own disaster? |
|
|
79 | (1) |
|
Mobile device management software |
|
|
80 | (3) |
|
The virtues of virtual private networks |
|
|
83 | (2) |
|
Appreciating the difference between http and https |
|
|
85 | (2) |
|
|
87 | (2) |
|
Chapter 7 Medical device security |
|
|
89 | (14) |
|
|
90 | (1) |
|
Taking a closer look at the "pathology" behind medjacking |
|
|
90 | (1) |
|
|
91 | (4) |
|
Dealing with existing medical device vulnerabilities |
|
|
95 | (1) |
|
How are medical device companies coping? |
|
|
96 | (1) |
|
|
97 | (1) |
|
Are medical device manufacturers HIPAA accountable? |
|
|
98 | (1) |
|
Weighing your security options |
|
|
99 | (1) |
|
|
100 | (3) |
|
Chapter 8 Educating medical and administrative staff |
|
|
103 | (10) |
|
|
103 | (2) |
|
Seeing the bigger picture |
|
|
105 | (2) |
|
Understanding the psychology of change |
|
|
107 | (2) |
|
Managing the training process |
|
|
109 | (1) |
|
What should the training consist of? |
|
|
109 | (2) |
|
|
111 | (2) |
|
Chapter 9 HIPAA, HITECH, and the business associate |
|
|
113 | (12) |
|
|
114 | (2) |
|
Are you a business associate? |
|
|
116 | (2) |
|
Formal agreements are a must |
|
|
118 | (1) |
|
More exceptions to the rule |
|
|
119 | (2) |
|
What should a business associate agreement look like? |
|
|
121 | (1) |
|
|
122 | (3) |
|
Chapter 10 Preparing for and coping with a data breach |
|
|
125 | (7) |
|
How bad is the situation? |
|
|
125 | (1) |
|
|
126 | (1) |
|
Managing security incidents and data breaches |
|
|
127 | (1) |
|
Creating a comprehensive response plan |
|
|
128 | (3) |
|
Decision making, accountability, and trust |
|
|
131 | (1) |
References |
|
132 | (1) |
Appendix |
|
133 | (6) |
Subject Index |
|
139 | |