8:00 am
Registration Opens
Continental Breakfast and Networking
GENERAL SESSIONS: The Foundations for a Sustainable Information Security Strategy
9:00 am
Opening Remarks
Remarks from the Conference Chair; including the state of the HIT industry; how HITECH compliance can be viewed in a comprehensive, sustained strategy for data security.”
Mike Ahmadi, HIPAA HITECH Security Specialist, GraniteKey (Conference Chairman)
9:15 am
ROUNDTABLE: Partner, Security Vendors and Software Solutions -- Choosing and Implementing the Right Security Solution
For most information security problems, there is no single product or process that healthcare companies can implement to take care of their new security obligations. As a result, the market for EHR security vendors and software suppliers is growing in anticipating of the demand for their products, services and support. This session offers a primer on the community of information security and software, and how to navigate the organizations to identify the solutions that are most appropriate for your need.
Michael (Mac) McMillian, Chair, HIMSS Privacy & Security Steering Committee; CEO, CynergisTek Inc.
10:00 am
Meeting the Privacy and Security Meaningful Use Requirements to Achieve Fully Functioning EHRs and HIEs
This presentation provides a foundation to discuss implementation issues with providers, insurers and other covered entities, as well as what expectations of vendors, outsourcing partners.
David Reitzel, Health Sciences Practice Leader, Deloitte
10:30 am
Networking Break
10:45 am
Health Information Security Contracting Issues:
This session examines what information technology and security companies need to know when entering into business relations with health care entities. In any transaction involving technology or intellectual property, there are often three or four agreements that give parties rights and obligations related to PHI and IIHI. Most often these agreements conflict with each other and are often inconsistent with HIPAA, HITECH Act, and State patient privacy laws. The problem is exacerbated when the agreements are enterprise-wide and cover various States with different patient privacy laws. This presentation examines methods of resolving conflicts of these laws in the area of information security.
- Common contract language that is problematic;
- Appropriate language to include in contracts to help solve the problem;
- Operational issues (policies and procedure and employee training)
Tallien Perry, Esq., Health Law Practice11:15 am
Transmission Security Guidelines & SolutionsTransmission security is a key component of the technical safeguards. This session explores solutions for CEs to implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.
11:45 am
CASE STUDY: Good Security Practices in Use TodayHITECH mandates that good security practices are used by hospitals, doctors’ offices, insurance companies, billing companies, and the myriad other groups that touch sensitive medical data. This session offers a review the practices employed by a leading healthcare firm, including security solutions, HIT infrastructure, processes and more.
Greg Porter, Information Security Consultant - Allegheny Digital, Adjunct Professor, Health Care Information Security and Privacy, Carnegie Mellon University12:15 pm
Managing Security with Outsourcing PartnersImplement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information (EPHI) and to prevent those workforce members who do not have access from obtaining access to electronic protected health information.
Peter Hesse, President, Gemini Security Solutions12:45 pm
Lunch Break1:00 pm
Securing Remote AccessHow far does the medical practice extend? To the home, cabin, airport or cyber-café? Are some technologies more useful, supportable, secure or manageable than others for providing remote access? What are some methods for centralizing and automating administrative processes? How can Network Access Control make remote access services more secure? The panel will explore these questions and offer practical advice and strategies to managing remote access risks in AMCs that know no boundaries. Attendees will hear perspectives on remote access risk management and see examples of risk mitigation.
1:30 pm
Mobile computing and removable storage device securityBig data losses, including the loss that kicked off the VA security policy changes, have been high profile events and have led to a new level of attention to securing laptops. In this session we’ll explore practical approaches and security solutions to securing laptops, convergent technology devices and media. We’ll also discuss the appropriateness of technical controls vs. “soft” controls, e.g., policy, education & awareness training. We’ll include suggested outlines of business considerations for an enterprise laptop encryption solution with an eye toward contracts & licensing, centralized management & reporting, key escrow, user considerations rollout and integration with other
2:00 pm
Measuring the success of your security programs: Information security metricsStandards-driven security programs require metrics to evaluate controls effectiveness. Measures across the business lines of medicine, research, education and administration (includes finance, for-profit entities, insurance companies, etc.) and mapped against risk are needed to provide the data necessary to manage programs. The challenge with security metrics is measuring what’s prevented and doesn’t occur. This session will outline good metrics characteristics and include examples that meaningfully measure controls effectiveness
2:30 pm
CONFERENCE CONCLUDES