Solvingthe HIPPA email Encryption Problem.ppt

Solving the HIPPA email Encryption Problem Bill PankeyTunitas Groupbpankey@ Agenda Is there a problem? What are the business requirements? Critical evaluation of solution alternatives Rethinking s/MIME and PKI HIPAA’s Encryption Requirement Standard ~ “Transmission Security: Implement technical security measures to guard against unauthorized access to PHI that is being transmitted over an electronic communications network”45 CFR 164.312 (e)(1) Addressable Implementation Feature ~ “implement a mechanism to encrypt electronic protected health information whenever deemed appropriate” 45 CFR 164.312 (e)(2)(ii) Clearly, email containing PHI subject to this provision Addressable Implementation Addressable implementation features are not optional, they must be addressed; HCO must either: implement the feature or document why its is not “reasonable and appropriate” to implement feature, and implement an equivalent alternative measure when “reasonable and appropriate” “Addressing” Encryption No real ‘equivalent alternative’ to encryption encryption is the confidentiality control for public network (Internet) communication confidentiality threat might be reduced thru use of steganography (hiding messages in host files) but such methods not widely deployed “No encrypt” response then dependent on the argument that encryption is NOT “reasonable and appropriate” for email communication can’t argue on cost basis, encryption is ‘free’ software bundled with all commercial email software only significant cost is management related on what basis then? “Reasonable and Appropriate” Not terms of art for security profession, so absent guidance must rely upon ordinary dictionary meaning reasonable ~ “not extreme or excessive” appropriate ~ “suitable [to some purpose]” Test would seem to be whether or not email encryption protects against a “reasonably anticipated” threat failing encryption, the HCO should argue that risks are so inconsequential as to not warrant efforts to r