By: Health Insurance
Submitted: 2009-11-30 14:22:24 | Word Count: 431
The Health Information Partnership for Tennessee (HIP TN) has adopted an industry-led framework designed to make it easier for healthcare providers to meet the many laws, regulations and standards associated with secure health information sharing.
HIP TN, a public-private group set up to drive the state’s health information exchange planning, said it would use security assurance guidelines developed by the Health Information Trust Alliance (HITRUST) to help state providers reduce the costs of meeting various federal and state health information security requirements.
[ advertisement ]
“A single, comprehensive assessment approach would ensure we aren’t adding complexity and cost to the healthcare system, while at the same time enabling the protection of health information,” said HIP TN chairman Bob Gordon in a Nov. 16 announcement by HITRUST.
The group’s Common Security Framework, or CSF, encompasses a number of tools designed to help healthcare providers meet the requirements of the Health Insurance Portability and Privacy Act, the National Institute of Standards and Technology and other government regs.
The tools include configuration checklists, security and privacy training, and guidelines for security professionals and vendors as well as security classifications for clinical systems.
Pursuing this information independently would be very costly to health care organizations, according to HITRUST.
An average organization “would incur $24,000 to $50,000 to do this independently and would additionally incur a minimum of $6,000 per year to maintain their policies,” according to HITRUST, which said it offers the tools for free.
The CSF is not a new set of standards, the group emphasized. Instead, it said it is “the only framework that is built to provide scalable security requirements based on the different risks and exposures of organizations in the industry.”
The framework will incorporate changes in health information security requirement that might result from the health IT “meaningful use” policies now being developed by the Office of the National Coordinator for Health IT, according to HITRUST.
The CSF was developed by 155 healthcare and information technology industry organizations that comprise HITRUST, the group said, including CVS Caremark, Cisco Systems, Himark Inc., and the Hospital Corporation of America, according to HITRUST.
Tennessee’s Gordon said the security assurance program is voluntary, but it should “provide the needed mechanisms to ensure trust in the healthcare organizations that connect to the state’s health information exchanges.”
