Citation Title Description Status/Comments HITECH § 13401(a) Application of 164.308, 164.310, 164.312, “Sections Security and 164.316 of title 45, Code of Federal Provisions and Regulations, shall apply to a business Penalties to associate of a covered entity in the same Business manner that such sections apply to the Associates covered entity.” HIPAA 45 C.F.R. § Administrative 164.308 Safeguards 45 C.F.R. § Security policies and procedures to “Implement 164.308(a)(1) Management prevent, detect, contain, and correct Process security violations.” HIPAA 45 C.F.R. § Risk Analysis an accurate and thorough “Conduct 164.308(a)(1)(ii)(A) (Required) assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI held by the covered entity.” This risk analysis should attempt to disclose "all relevant losses" that could be anticipated if security measures were not in place (Preamble, at 8,347), such as “losses caused by inappropriate uses and disclosures and the loss of data integrity that would occur absent the security measures.”
Citation Title Description Status/Comments HITECH § 13401(a) Application of Security Provisions and Penalties to Business Associates “Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity.” HIPAA 45 C.F.R. § 164.308 Administrative Safeguards 45 C.F.R. § 164.308(a)(1) Security Management Process “Implement policies and procedures to prevent, detect, contain, and correct security violations.” HIPAA 45 C.F.R. § 164.308(a)(1)(ii)(A) Risk Analysis (Required) “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI held by the covered entity.” This risk analysis should attempt to disclose "all relevant losses" that could be anticipated if security measures were not in place (Preamble, at 8,347), such as “losses caused by inappropriate uses and disclosures and the loss of data integrity that would occur absent the security measures.”
CITL-HITECH-HIPAA-Gap-Analysis.docx