The News – 07/23/02

Why You Need to Get Hip to HIPAA

The Health Information Portability and Accountability Act of 1996 (HIPAA) is a broad-based piece of legislation that addresses many aspects of health care and health insurance. It is tempting for companies not directly involved in health care to dismiss HIPAA as not being relevant to their businesses. This could be a significant mistake. There are two areas that HIPAA will affect all businesses.

The first involves the fact that HIPAA, along with another piece of legislation, the Gramm-Leach-Bliley Act (GLB), will set a practical and, more importantly, a legal standard for best-demonstrated security practices. The second impact of HIPAA will be in creating new software and standards for the secure exchange of information. First, let’s take a look at HIPAA’s effect on best-demonstrated practices. We’ll look at the second effect in the next SNS.

Because it codifies in law a set of security, privacy, and confidentiality standards, HIPAA will create de facto standards for all organizations. Until the advent of HIPAA (and GLB in banking), when a network intrusion case went before a judge and jury, there wasn’t a single body of law to refer to in assessing whether a company’s security practice was consistent with industry standards.

Prosecutors who were trying hackers often had to assert that a company provided adequate defense against a hack attack by calling expert witnesses who gave their opinions. Obviously this left the matter open to interpretation, to the point that even the inclusion of the word “Welcome” on a logon screen became a defense against an intrusion – after all, you welcomed people into your network!

Now there’s a standard, in black and white legislation, for best-demonstrated security practices, and Matthew Yarbrough, who heads the cyberlaw practice in Fish & Richardson’s Dallas office, thinks any savvy defense attorney will leverage this fact.

All the attorney needs to do is to take a company’s chief security officer through a checklist of HIPAA requirements, asking, “Did your company do this? How about this?” HIPAA becomes a blueprint to attack the idea that a plaintiff company provided a sufficient defense against intrusion. If the company didn’t pass the HIPAA checklist test, it could easily lose the case because its security practices weren’t adequate.

And let's not even think of the possibility of shareholder lawsuits!

Of course, HIPAA deals with privacy and confidentiality as well, and companies would be additionally vulnerable in those areas. “For proof of that,” Yarbrough says, “you can turn to the case of Kaiser Permanente. In August of 2000, the mammoth health insurer accidentally sent 19 of its members e-mails meant for other patients. Included in the snafu were routine matters and one member’s question about a sexually transmitted disease. A year later, it was Eli Lilly’s turn. The pharmaceutical giant sent an e-mail to about 600 users of its medications for depression, bulimia and obsessive compulsive disorder. The problem? The e-mail listed all the recipients in the ‘Cc:’ line, allowing everyone to see a list including everyone else’s name.”

The Federal Trade Commission settled the Lilly case in January without penalties because the disclosure was inadvertent. However, in a post-HIPAA world, such email gaffes may be punishable crimes.

So, yes, you need to worry about HIPAA, even if you don’t directly deal with the health care industry. Yarbrough says, “If your business does business with a doctor, hospital or other health care organization, HIPAA may apply to you. If your business administers its own health plan, the law applies to you too. In fact, because courts may look upon it as a benchmark for computer privacy and security, it may apply to everyone.”

We’ll take a look at the second general effect of HIPAA, the availability of new software and standards for the secure exchange of information, in the next SNS.

Briefly Noted

• Shameless Self-Promotion Dept.: Finally I’ve put up the Nanotechnology Resources directory I promised last November.
  
  Also, check out the article I wrote for the Taylor Harkins newsletter entitled, Do you hate your customers? It continues the theme from my earlier article, analyzing the media industry’s response to file sharing.
  
  Finally, and at long last, the CTOMentor wireless white paper, You Can Take It with You: Business Applications of Personal Wireless Devices, is available at ITPapers.
  
  
• Love the Name: No, it’s not a hairstyle supervisory shop. Chicago-area firm Gray Hair Management provides a two to four-member advisory board selected from more than 500 senior executives to help companies with their business problems. No reason for the plug; I just love the name.
  Gray Hair Management
  
  
• The Threat of Spyware: Spyware started out as a way for file sharing systems like Kazaa to track ad viewings within their software. Without informing its users, software containing spyware reported back to the company information on what ads the user saw, and possibly more, such as information used to access password-protected sites. The spyware also was able to download executable programs (one called EXPLORER.EXE, the same name as a Windows system component) and install them without the user knowing. Nowadays, pretty much all of the popular music file sharing services use spyware. Thus, spyware constitutes a security breach on business networks.
  
  Business owners should make sure they have a company policy against the installation of these file-sharing programs. It’s also a very good idea to install a firewall, such as ZoneAlarm, on each PC that will notify the user if any new programs try to access the Internet. Another good solution is to use programs such as PestPatrol and LeakTest that can help identify and eliminate spyware programs.
  InformIT

• VoWLAN Apparently Patented: From the apparently-never-ending Stupid Patent Department comes an item from Symbol, a maker of mobile data transaction systems. The company has been granted a patent for handling voice over wireless LANs (WLANs) using Internet Protocol. Never mind the patent that Motorola just received for VoIP (Voice over Internet Protocol). I’m not a wireless tech, but Symbol’s patent looks like fairly obvious technology.  
  Symbol