Background

The HITECH Act's interim final breach notification rule, published in the fall of 2009, spelled out when major breaches affecting 500 or more individuals must be reported to federal authorities as well as those affected. But the rule contained a significant "safe harbor" provision, exempting the reporting of breaches of data that was encrypted in compliance with specific NIST guidelines.

The HITECH Act, as well as HIPAA and other federal rules, all stop short of mandating encryption. But because a majority of the major breaches reported to federal authorities so far have involved the theft or loss of unencrypted computer devices and media, many organizations are considering making widespread use of encryption.

Approaching breach prevention through encryption alone, however, is not the right approach. Such a strategy is costly and can have an adverse effect on system performance and create a false sense of security.

In this exclusive session, healthcare organizations of all sizes will learn how to:

• Analyze their environment to understand breach risks by taking a life cycle approach to mapping protected health information in the enterprise;
• Follow a systematic approach to evaluating enterprise security controls as well as encryption needs;
• Address technology, process and people requirements in developing a broader, well-balanced, integrated approach to security, resulting in a "safe harbor" breach prevention strategy;
• Plan for and understand why the use of encryption needs to change over time as the IT environment changes.