HIPA and Network Configs

On Tue, 7 Jan 2003, Lee Einer wrote:
> True! My last employer was one of the largest Home Health Agencies in
> the country, and when it came to matters of HIPAA, they didn't get it,
> they didn't get that they didn't get it, and they didn't want anyone
> pointing out that they didn't get it. I expect that down the road, HIPAA
> will be the windshield and they will be the bug. Que sera. Wanton
> ignorance /should/ be expensive.

Here's something to scare you. I attend every HIPAA-related meeting and
conference I can find that directly relates to my responsibilities. I
have met people at these events that (as of 12/02) haven't even started a
Risk Analysis or Gap Analysis! They have no idea what they have, who has
it, and where it should be (so to speak).

To these people I give... a boot to the head!

I always get their name and company name - and I make sure that I do zero
business with them. Unfortunately a lot of these companies are
clearinghouses or 'pass-throughs' used by larger companies to offload
workload. You never really know WHO gets your information.

*shudder*

People, what happened to George can happen to ANYONE. Now is the time to
start asking the companies you do business with for some information.

How much of my personal information do you have?
Where did you get it?
Where do you keep it?
Who has access to it?
What do you do with it?
Do you sell it?
To Whom?
What security and privacy precautions are in place?
Are you audited annually by a big-3 firm? The government?
Have you ever failed an information security audit? Privacy audit?
Can I 'opt out' of using my SSN as my ID?
Can I 'opt out' of any program you have the gives my info to other
people/companies?

The sooner you ask, the better.

Gary