Sunday, November 26, 2017

Attacking Session Management (remediation)

Securing the Session:
1) Secure token
- random (UUID)
- long
- token protection   
    - never in URL
    - cookie flags
        - httponly
        - secure

2) Secure Session Handling
- new token at login/logout
- old session detroyed
- client and server session ending

3) Timeout

Friday, November 17, 2017

How To Start & Operate Your Own Profitable - Import/Export Business At Home



What is a good way to build up a successful business from nothing and have fun doing it? 
The import/export business may be your answer. Not only does it require little financial investment to start, but it offers the prestige of working with clients from  all over the world.
You don't need previous experience in the field, but you should have a good head for organizing. Fulfilling a successful import/export business requires constant attention to little. Do you know some local manufacturers looking for ways to increase their market for the goods they make? Or are you planning a trip abroad and want to make some contacts for setting up a business?
If you have the ability to sell, and an air of diplomacy, the import/export business might be right for you. All you need is the desire and determination to make it work.
As you progress in the business, many factors become obvious and easy to handle. For example, you'll need to find a person to handle shipments, called a freight forwarder. And you'll need to create solid contacts and strong relationships with reliable suppliers. But after a short time, you can be well on your way to making a sizeable income, with a very low overhead.
Do you like the idea of running your own business? How would you like a tax-deductible trip to foreign places a couple times a year? The advantage of an import/export business are great.
The biggest advantage is the money you'll make.. Once you get the business underway,, the commission for setting up sales is very  profitable. And after you establish and maintain a number of exclusive accounts, you'll find the time you spend is highly rewarded with money.
Take a look into the import/export business. Consider the risks, and consider the advantages. Talk to people in the business. Is it for you?

HOW IT WORKS
Of all the manufacturers in the United States, only a small percentage distribute goods outside of North America. The goods that do find foreign markets are exports. On the other hand, that is manufactured outside the country and brought in for sale is imported.
Although it seems obvious that all manufacturers would want a worldwide market, it is not easy for a company that is limited in its scope and abilities. That's where you come in.
An import/export agent is a matchmaker. Manufacturers of domestic goods seek foreign distribution; foreign manufacturers want a United States market. You need to find them, make a solid connection, and establish a business relationship with these companies.
The agent's commission is generally about ten percent. Now, think of ten percent of $500,000 or ten percent of a million. Although that may seem like a large order, it wouldn't be, if you're talking about machinery, raw materials, or computers.
The market is unlimited and there are hundreds of manufacturers looking for foreign distribution. Sporting goods, clocks, electronic games, radios, housewares, garments, tools-anything can be readily imported or exported if there is a consumer demand and if you can get the products.
The United States Government encourages exports. Indeed, it is those sales that keep our balance of payments with the vast amounts of goods are imported. And you'll find government agencies helpful in establishing your business.

THE BASICS
You can start your import/export business at home with a telephone.. You'll need a file system, business cards, and a machine to answer the phone calls. Once you get going, you'll want a cable address or a telex hook-up.
And you'll need a classy letterhead. Until you establish personal contacts, it is your letterhead that represents you. Make it look professional, possibly embossed or two-color, or gold leafed. 
Have it printed on light-weight paper for airmail correspondence, but don't have airmail envelopes printed. You'll have a lot of domestic correspondence too.
More than office equipment, you need the determination to make 
it work. It will be slow at first, and you'll need to plan your moves, make contacts and SELL YOURSELF. But once you make a few sales and sign several exclusive contracts worth money, you'll know your dedication was worthwhile.

MAKING CONTACTS
The most important step in setting up your business is finding the contacts. You may have relatives in a foreign country;; you  may have frequently visited and established business  relationships in a country. Or, you might just have a feeling for what will sell where. A person who keeps well-informed in the business world can pick up and ride the crest of worldwide trends.
Foreign consulates located in the United States have commercial attaches who want to establish outlets in the U.S., and they're a good place to start.. Sometimes these consulates can help find indices of their own import/export enterprises.
The Unites States embassies abroad are another place to find contacts for commercial distribution. They can help you find out about a company's solvency and reputation.
Another way to establish contacts is through the Chambers of 
Commerce of every city you are aiming for.
Start small-don't tackle the world.. Where do you want to sell American goods you might have in mind? Which countries have the merchandise you want to import? Find out about the countries, what they have to offer, what is generally in demand.
Then prepare a massive mail campaign
The easiest way to mail hundreds of letters is to use a typing service that has the equipment to produce the same letter with a different address each time.. It's worth the money it will cost; you'd go crazy typing so many identical letters.
To every possible contact, write a letter introducing your company, requesting the names and address of appropriate firms to contact. Ask to have the notice published in the monthly bulletin or posted in an appropriate place.
From the names to get back, write another letter, again introducing yourself, and asking information about their company.
You can use a questionnaire, which is easy to fill out and invites
a response.
What goods do they want to import? What products are now imported and how are they distributed?? Does the company have a certain territory, does it have sales representatives, branches in other cities? What are the basic details of operation--history, assets and liabilities, plans for growth?
Request any information you need, to find out what they will buy and what they have to sell. If the company is a manufacturer, ask for samples or a catalog, the facts and figures of current  foreign distribution, and the product demand in their own  country.

ANALYZE THE MARKET
Keep informed. Read everything you can find about world trade. 
Look at trade publications, international newspapers, news magazines, and financial reports. Who is selling what to whom? 
Although the market for American-made airplanes is sewn up, there are thousands of medium to small sized manufacturers in every state of the union.
You can get goods to sell, buy you have to be sure to study where they are in demand and can get the price to make exportation viable. Your questionnaires will tell you what foreign importers want. Take it a step further and read the journals published by that country; many of them are available in English. Do these publication confirm the desire for certain products?
The American market for imported products fluctuates with the value of the dollar in comparison to the value of each other country's currency. And, importation prices reflect that directly. Can American consumers afford to pay the price of certain imported goods? Or will they?
Finding the right market is as important as the actual particulars of making deals and selling goods. What do you think will sell? If you do some careful studies and think about the trends, you'll be able to come up with hundreds of products to  import and export.
The import/export business is actually smaller than you might think.. There are only a few of these businesses; that's why there's plenty of room for more.

WHERE TO FIND HELP
Establish a good business relationship with a local bank that handles international business.. Your personal banker will follow through on the actual foreign transactions, and will help you keep your credit afloat, In fact, this is one of the best factors about an import/export business. Aside from office suppliers and correspondence, or possible business trips, you need a no personal cash outlay. All you need is a good credit and good reputation.
Your banker is your credit manager and will give you valuable advice and references when you deal with both American and foreign manufacturers and distributors.
The United States Government agencies are great places to find help... These agencies promote the import/export business, and publish many small booklets and pamphlets. They also distribute continually updated reports on foreign markets, commerce and financing.
Read these source of information and find out the particulars of exports, global surveys and ocean freight guidelines. Become familiar with the market share reports, current laws and regulations, and government promotional facilities. 

MAKING CONNECTIONS
As you continue your correspondence with foreign companies, build up a good rapport with their representative.. Pin down a few companies- perhaps in the same country or similar territory--to their exact needs.  What are the two or three products most in demand?
Consider their methods of distribution. You may be able to work directly with a wholesaler of an overseas importing company. Your commission will be lower, but you won't need to handle as many particulars , and they will take care of distribution.
Or, you may need to supply catalogs and samples, working with a network of small companies or sales representatives from a larger conglomerate.
The highest fees that you can collect are for raw materials taken from the source and delivered directly to a manufacturer. But you must be certain of a guaranteed quantity and the continued ability to deliver.
If you are importing goods, you'll need to find U.S. distributors that can handle the quantity of goods at a high enough price for you to profit by. A single retail outlet or two is not enough to make your time worthwhile. Look into how buyers work and make contacts in the larger retail chains if you have retail merchandise.
GETTING THE GOODS
There are hundreds of American manufacturers with limited distribution looking for an overseas market. Exporting their goods is the place to start your business.
You have many selling qualities for convincing the manufacturers to engage you as the sole export agent. You have foreign contacts and know the demand for specific goods.. You will handle the sale,, the paperwork, the money, all shipping, customs, and  foreign distribution.
The manufacturers in return provide firm price quotations, and you put your fees on top of that; you cost the manufacturer nothing.
The manufacturer have everything to gain--an increase in sales, a broader market, and more profit. And you have everything to gain--establishing your business, and a commission on the cost of the goods. That is the basis of firm business connections and a mutually profitable arrangement.
Contact local manufacturers first and then move into larger territories. You can make these contacts by phone, in person,, or by personal introduction from contacts you may already have.. Or, you can advertise in business publications and newspapers.
Before yo do get into a legal agreement, be sure to check the reputation of the company. How long has it been in business? 
Where are the products distributed domestically? What is the solvency and reliability of the company and its goods? When you make your sale, you'll want to be able to deliver.
MAKING AN AGREEMENT
Once you have agreed to represent the manufacturer as the export agent, you need to have a written and signed contract to bind this agreement. Your attorney should be the one to draw up this contract; later you can just use the same one, substituting names of other manufacturers.
Basically, the contract is between the manufacturer and you as the export representative. You are granted exclusive rights to distribute goods to all countries except those they already distribute in. The manufacturer will pay you the specific commission quoted to the distribution on top of the price of goods. The company will also provide catalogs and samples for your use in distribution.
You, the export representative, in turn will promise to do everything possible to make contacts and distribute manufacturer's goods in foreign territories..
The terms of the contract should then be stated: how many years the contract will be signed for, the terms of cancellation by either party voluntarily or because of no sales action over a certain period of time.

THE SALE
You've made your contacts with foreign distributors who will buy the merchandise. You have a signed contract with an American manufacturer that will deliver the goods.. Perhaps one of the distributors now asks for a firm quotations on the price of a certain amount of goods.
You go to the manufacturer and get a price quotation on the quantity of goods. It should be valid for a certain stated period... The manufacturer may agree to deliver the goods to the ship,, handling the freight to that point, or you may need to make arrangements from the factory.
You ass on the commission you want to the price of the goods. 
Then you add on all the extra costs of getting the merchandise from the factory to the warehouse of the distributor.
If you've made an agreement with a foreign import/export company, their representatives may take over the shipping, paying you the price of the goods and your commission. That;s the easiest, but your commission will have to be reasonably lower.
If your sale is to a company that will distribute the goods wholesale or retail from its premises, you have to arrange all the transportation.

TERMS OF SHIPPING
You will become more familiar with the terms of shipping used in quoting prices and delivering goods as you gain experience. Your responsibilities vary with the terms of the agreements and orders. Check with your freight forwarder to be clear about your responsibilities.
A bill of lading is a receipt for goods shipped. It is signed by the agent of a ship or common carrier and assures the buyer that the goods were unloaded in the same condition as they were accepted. These are the documents you'll need to produce for your banker to release the letter of credit.
FOB means free on board. The seller delivers the goods to a certain destination with no additional charges. The seller insures and takes the responsibility until that point. The buyer takes the responsibility and pays the charges after that. For example, FOB New York means the seller's price quotation includes full responsibility and shipping to New York. FAS means free alongside. The seller delivers the goods to the ship that will carry the merchandise. The buyer pays to load onto the ship and takes responsibility from there. FAS New York, for example, means that the seller will deliver and store the goods until they are ready for loading onto the ship.
C & F means cost and freight. The seller pays the freight charges. The buyer insures the merchandise and takes full responsibility after the destination.
CIF means cost, insurance, freight. The seller is responsible for the value and condition of the goods, and pays both insurance and freight charges to a certain point.. The buyer is responsible from there.

THE FREIGHT FORWARDER
A freight forwarder is a person who takes care of the important steps of shipping the merchandise. This person quotes shipping rates, provides routing information, and books cargo space.
Freight forwarders prepare documentation, contract shipping insurance, route cargo with the lowest customs charges, and arrange storage. They are valuable to you as an import/export agent, and they are important in handling the steps from factory to final destination.
They can be found by looking in the yellow pages or by personal referrals. Find someone who can do a good job for you. You'll need someone you can work with, since this may become a long term business relationship.
You'll need the help of a freight forwarder when you make up the total price quotation to the distributor.  Not only do you include the manufacturer's price and your commission-usually added together, but you need to include dock and cartage fees, the forwarders fees, ocean freight costs, marine insurance, duty charges, and any consular invoice fees, packing charges, or other hidden costs.
Be especially careful when you prepare this quotation It certainly isn't professional to come back to the distributor with a higher quote including fees you forgot... You might go over the price quotation with your freight forwarder to be sure nothing is overlooked.
Usually the quotation is itemized into three main categories of cost of goods, which includes your commission, freight charges from destination to destination, and insurance fees.
Give a date the quotation is valid to, which should be the same 
as the date given on your quotes. You may also include information about the products, including any new sales literature.
A formal letter that accompanies the price quotation should push for the sale. You can inform the distributor of the shipping date as soon as the order is received and confirmed by a letter of credit. Send the letter and price quotation by registered mail to be certain of its delivery.

THE LETTER OF CREDIT
A letter of credit eliminates financial risks for you, the manufacturer, and the distributor. When your distributor confirms the order, a letter of credit is drawn from that company's bank to a branch in the United States or to your bank.
This letter of credit confirms that funds are available from the distributor to cover the same costs you quoted. An irrevocable letter of credit assures you the order will not be cancelled at any time... When that letter of credit is likewise confirmed by your bank to deliver the goods, the distributor is assured of delivery. Once the letter of credit is confirmed, so you don't have to worry about the fluctuation in currency.
Basically, the bank holds the money until all shipping documents are presented. The letter of credit states the terms and conditions to make it legal and negotiable into money, usually holding for proof of shipment of the goods. Your freight forwarder helps you attain all those documents. When you hand them to the banker, the letter of credit is turned into liquid assets for you to pay the manufacturer and all other invoices from the transaction.
Never work on promises. Not only do you take a gigantic risk, but you create bad risks for everyone you are involved with. A letter of credit is the only sure way to transfer these payments.

DELIVERING THE GOODS
There are many combinations of people and methods you can use to deliver the goods that were ordered. When you produced a price quotation for the goods, you had to go through all the steps the merchandise will follow. Now, before you proceed, check again.
Do you have a confirmed order signed by the authorized representatives of the distributing company?? Has your banker approved the letter of credit from the company?
Compare the amount of the letter of credit to the amount quoted for the goods. Be sure they match exactly. Or, if the distributor chose a certain quantity of several offers, check the prices again and confirm the quantity.
Confirm the quotation and sale with the manufacturer, and do the same with the freight forwarder and any marine insurance agents you are working with. Then follow through.
I order to assure the quality of merchandise, some manufacturers prefer to handle freight to the loading docks,, which makes it easier for you. If you handle overland shipping, follow through to be sure the merchandise is picked up and arrives safely at its destination.
Be informed of the date the goods are loaded onto the ship. The factory should have them freighted in time to avoid costly dock storage charges.
Since all conditions of the sale must be met to comply with the terms of the letter of credit, you need all the signed documents.
Have your freight forwarder or other contacts get authorized bills of lading for the merchandise each step of the way--from destination to destination.
Once you have all the signed documents, present them to your banker. If all the terms are met, the funds will be released. 
Since your commission is part of the quoted price of the merchandise, you'll usually collect your fees from the manufacturer.
When it is totally complete, you collect your money--and make a sizeable profit for simply making connections. Consider the commissions when you have dozens of orders coming and going.

IMPORTING
Take a look at the household items and equipment you have in your home. Made in West Germany, made in Japan, made in Korea. You may have clothing from India, shoes from Brazil,,, a leather wallet from Italy.. Your car may be an import; your stereo equipment may be manufacturer elsewhere. There are hundreds and hundreds of items manufactured all over the world, now being used by the American consumer.
The market is huge. And there are many American firms looking for foreign made merchandise to distribute. Some items are less expensive; some are better made; some are imported because they are made in a country now fashionable with the designers.
What can you tap into? Maybe you have contacts in the Unites 
States, distributors looking for certain goods. And you've already made contacts in the foreign countries that produce these goods.. Follow through and get yourself an exclusive distribution agreement with those manufacturers.
Importing requires the same diligence and follow up as exporting does. You'll need a signed contract with the manufacturer to be a sole agent distributor to North America, or even the world.
You'll also need to obtain firm price quotes from the manufacturer in the quantities your distributor requests. These quotes should be converted into the appropriate dollar figures representing the currency exchange.
Investigate the reputation of the manufacturer and the reliability of the goods. If you import something like electronic components, check into other distribution market the manufacturer has to assure the quality of merchandise.
Your commission will come through from the foreign manufacturer. 
Have your bank investigate the solvency of that company and the reputation of living up to agreements. Since it's on foreign territory you'd have more trouble in any legal suits, even in light of many international laws.
Prepare the price quotation. It is easiest if you request terms of delivery to the port of that country. Your freight forwarder can help you move the merchandise from port, overseas, and through domestic customs.
Follow through with all the details of shipment. Be sure to include any insurance, dock fees, storage rates, and shipping overland. Overlook nothing so your price quotation to the 
American distributor is accurate,
Itemize the quotation and give it to the American distributor.. 
Upon receipt of an authorized order, double check prices and follow through on delivery.
The letter of credit will go from the American distributor to the bank of the manufacturer. All terms and agreements regarding prices, freight and insurance will be defined. The manufacturer's representative will confirm receipt of the letter of credit, which will release the goods for shipment.
Have your freight forwarder follow up on the shipment of goods. 
They may have to be freighted from the factory to the docks.. 
Arrangements for shipping need to be carried out.. Customs duties and unloading need to be followed through from the American port.
Then the goods may need to be freighted overland to the final destination...
As soon as the goods have arrived at the proper assigned destination, papers have to be documented and presented to the bank that holds the letter of credit. Then, all carriers and agents need to be paid, and you collect your commission.

PROMOTION
After you have completed a few sales transactions to establish yourself, you'll need to promote your import/export business to get more clients. The first transactions give you the experience to learn the ropes of the business, and to establish contacts and agents both here and abroad.
Join organizations of commerce and foreign trade associations to develop more contracts and extend your territory. Talk to everybody you contact about importing and exporting, learning from their mistakes and successes.
Advertise in the print media for distributors and for goods. 
Manufacturers don't know how to make the contacts for foreign distributions. Show them your credentials and pick them up on exclusive contracts. With a little experience, you can market almost anything anywhere.

EXPANDING THE BUSINESS
The profit of the import/export business is in the quantity of the goods traded. The higher the cost of the merchandise, the higher the profit from your percentage. Since you need to go through all the steps for each transaction, having more sales on a continual basis simply adds to profit.
Send constant mailings to your original list of contacts and follow-up leads. You might develop a sales approach. As you develop more clients, you can convince the bigger companies of your reputation. Contact as many manufacturers and distributors as you can on both side of the ocean. And solidify these contacts. You may be able to work out an arrangement with someone to work in certain country for a commission. Or, you might want to take a business trip there to personally meet with the various companies. get in-depth information on the products now selling.. Why are certain products successful?? Maybe you can get into the same market with more competitive product. Investigate ways to sell more.. Do the products need to be better made? Do they sell better at a reduced price? Know what sells and where to get it.

MAKING IT WORK
The import/export is a high profit enterprise. Because of the low overhead, most of the money you make on commission is yours.. But building a truly profitable business requires dedication and a good knowledge of the business.
You need numerous contacts who know you, respect you,, and can recommend your work. You need to have good agents both here and abroad to help follow through on the delivery of the goods... You need a good working relationship with your own bank and possibly the others that letters of credit come into as branch transfers from foreign offices.
Don't be hasty for orders. Investigate the manufacturers and distributors to be sure the products and sales methods are reputable.. Check out the particulars of shipping and manufacturers from the foreign country. Each culture works in a specific manner... Get to know how to work with those people..
The import/export business is not for everyone.. But it is a personal operation that you can run yourself-- you don't have to answer to anybody. The rewards of negotiating in a foreign country are excitement, a touch of the exotic and the great profit potentials.
When you make the proper contacts and follow through completely with reputable manufacturers, reliable shipping companies, and responsible distributors, you have it made.
If you are ready to put in the time, sell yourself. Start making inquiries and contacts. Try it on for size.. Does it feel good? 
Then MAKE IT SUCCEED,
If you need specialized LEGAL advice or assistance on this subject, the services of a professional person are recommended.

Cybrary.it HIPAA training



HIPAA – Is the Federal Health Insurance Portability
Act of 1996. HIPAA helps protect the privacy of patients and it helps healthcare industry companies control administrative costs. HIPAA sets guidelines that organizations must follow in regards to the security of data. Personally identifiable information is collected widely in the healthcare industry, and it is this information that HIPAA regulations seek to protect. An organization that incurs a breach or data loss, and was not HIPAA compliant, faces severe penalties.
About the Online HIPAA Training Course
This HIPAA online training course is designed to instill understanding of the principles involved in data system security procedures which ensure that all processes ad applications are up to HIPAA regulation standards. Subject Matter Expert, Kelly Handerhan, walks the student through a logical path that begins with understanding and develops competence.
Cyrbary’s HIPAA training course is essential for healthcare professionals, HR staff, third party administrators as well as many other fields in order to have the information necessary to be in compliance. Key topics covered in a HIPAA training course include:
  • HIPAA Overview
  • Protected Health Information (PHI)
  • HIPAA Privacy
  • Notice of Privacy Practices
  • Reasonable Safeguards
  • Using PHI for Marketing
  • HIPAA Security
  • Administrative Safeguards
  • Physical Safeguards
  • Technical Safeguards
  • Handling PHI
  • Security Breach
  • PHI Rights of Individuals
  • Enforcement of HIPAA
Related Compliance Training for End Users
Other classes relating to end user security and compliance, for free on Cybrary, include:
1)
PCI / DSS Training
2)
End User Security Awareness


HIPAA Introduction
This lesson gives an introduction to the HIPPA course. HIPPA stands for the Health Insurance Portability and Accountability Act. The following are some of the topics this course covers:
• Why HIPPA is needed
• What is HIPPA
• Notice of Privacy Practices
• Security Rule
• Protected Health Information (PHI)
Participants will learn about the rules of HIPPA and what they are meant to protect as well as the safeguards of HIPPA; focus on which specifications are in place to make sure these safeguards are enforced and carried out properly.

Why do we need HIPAA?
This lesson focuses on the history of HIPAA. Before 1996, there was no legislation regarding how a patient’s personal medical information could be shared. HIPAA was introduced to protect individuals as well as society with a set of ethics, rules and best practices. Even though HIPAA was formed in 1996, it wasn’t strongly enforced until 2003. However, at the present time there was very strong audits and regulations surrounding HIPAA.

To protect the individual:
Protecting personal privacy is to protect the interests and dignity of individuals. To protect the identity of the patient!
To benefit society through furthering research ethically:
Protecting patients involved in research from harm and preserving their rights is essential to ethical research!



HIPAA Part 2 – What is HIPAA Privacy Rule
This lesson covers the HIPPA Privacy Rule. The HIPPA Privacy Rule is one of the two main elements of HIPPA, the other being the Security Rule. The Privacy Rule mainly focuses on Protected Health Information (PHI) which includes demographic information and relates to person’s physical/and or mental health and also includes the financial information that is necessary to collect payment and includes 18 elements that must be protected. Privacy practices must be stated in plain language so they can be comprehended by all so the individual clearly understands their rights.
18 elements considered PHI (Protected Health Information):
2 main elements: privacy rule and security rule!
1.      Names
2.      All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, etc.
3.      All elements of dates (except year) for dates directly related to an individual, including birth dates, admission date, discharge date, date of death
4.      Phone numbers
5.      Fax numbers
6.      Electronic mail addresses
7.      Social security numbers
8.      Medical record numbers
9.      Health plan beneficiary numbers
10.  Account numbers
11.  Certificate/license numbers
12.  Vehicle identifiers and serial numbers, including license plate numbers, phone numbers
13.  Device identifiers and serial numbers
14.  Web universal resource locators (URLs)
15.  Internet Protocol (IP) address numbers
16.  Biometric identifiers, including finger comparable images
17.  Full face photographic images and any comparable images
18.  Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data).

The Privacy Rule
Also known as Standards for Privacy of Individually Identifiable Health Information!
Issued by the Department of Health and Human Service (HHS) as a set of national standards for the protection of certain health information!
Provides assurance that individuals’ health information is properly protected
Must also consider the necessary flow of health information needed to provide and promote high quality health care and to protect the public’s health and well-being.
The HIPAA Privacy Rule gives individuals a fundamental right to be informed of the privacy practices of their health plans their health care providers, as well as to be informed of their privacy rights with respect to their personal health information.
The NOPP must be provided to patients who request this information and post prominently on its website.
Notice of Privacy Practices, must be in plain language:
·         Provide adequate notice of how a covered entity may use and disclose PHI
·         Indicate his/her rights and the covered entity’s obligations in relation to that information

What is HIPAA Security Rule
This lesson covers the HIPPA Security Rule. This rule protects the privacy of an individual’s health information while allowing enough flexibility to adapt to new and changing technology. The HIPPA Security Rule requires appropriate measures to allow the security of electronic protected information. The HIPPA Security Rule has four basic requirements. Participants also learn about privacy versus security.
·         Protect the privacy of individuals’ health information
·         Allow enough flexibility to allow for growth and new technologies
·         Requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of electronic protected health information, and also availability!
·         CIA – confidentiality, integrity and availability!


Four Basic Requirements:
1.      Ensure the confidentiality, integrity and availability of all e-PHI they create, receive, maintain or transmit;
2.      Identify and protect against reasonably anticipated threats to the security or integrity of the information;
3.      Protect against reasonably anticipated, impermissible uses or disclosures; and
4.      Ensure compliance by their workforce.

Privacy vs. Security – what’s the difference?
The Privacy rule focuses on the right of an individual to control the USE of his or her personal information. Protected health information (PHI) should not be divulged or used by others against their wishes.
·         The Privacy rule covers the confidentiality of PHI in all formats including electronic, paper and oral
·         Confidentiality is an assurance that the information will be protected from unauthorized disclosure. The physical security of PHI in ALL FORMATS is an element of the Privacy rule.
The Security rule focuses on administrative, technical and physical SAFEGUARDSspecifically as they related to ELECTRONIC. Protection of ePHI data from unauthorized access, whether external or internal, stored or in transit, in all part of the security rule. Typically ePHI is stored in:
·         Computer hard drives
·         Magnetic tapes, disks, memory cards
·         Any kind of removable/transportable digital memory media
·         All transmission media used to exchange information such as the Internet, leased lines, dial-up, intranets and private networks.

     
How: Security Rule
This lesson covers the HIPPA Security Rule and how it is enforced. The HIPPA Security Rule requires the following three layers of protection to guard PHI:

1. Physical
2. Administrative
3. Technical
All of these rules come together to form rules which relate to everything from access to a health facility, to who handles information and how to the security of workstations; to name only a few.
Physical Safeguards:
Facility Access and Control: a covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.
Workstation and Device Security: a covered entity must implement policies and procedures to specify proper use of an access workstation and electronic media. A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).


How: Technical Safeguards and Consent
This lesson covers how private patient information is protected via technical means. Technical methods of protecting information range from encryption, to authentication and authorization. Covered entities must also implement policies pertaining to:
• Access Control
• Audit controls
• Integrity Controls
• Transmission Security


IF YOU DON’T NEED IT, DON’T STORE IT; IF YOU DO NEED IT, PROTECT IT!

Ignorance of the law is not an excuse!

To Whom does HIPAA Apply
This lesson covers who HIPPA applies too! It’s important to realize many organizations collect important health information; however, they may not be covered entities and have to comply with The Privacy Rule.
Covered entities include:
• Health Plans
• Health Care clearing houses
• Health Care providers
• Business associates
• Subcontractors


Can You Share PHI
This lesson covers the exceptions in what can be shared without a patient’s consent under the Privacy Rule. A covered entity can share the following limited information without the patient’s consent:
• To the individual patient
• Treatment
• Payment
• Health care operations activities
The Policy Rule informs of the limitations pertaining to exactly what and how information can be shared.

The individual patient:
Besides required disclosure, Covered Entities also may disclose PHI to their patients/health plan enrollees.
Examples:
·         Health plans can contact their enrollees
·         Providers can talk to their patients

About Us