Name: Sunil Kumar Buttagandla
Student Id: 10000126442
Course name: CMP 630 Network Security Audit & Forensics
Professor Name: Dr. Nigel Basta
Title: Week1- Assignment2

In the table below, identify compliance laws that are applicable to a large public health care organization. In the second column, include a description of each law. In the third column, justify your rationale for including the law by indicating why it applies to a large public health care organization

Answer: Compliance Law | Description of the
Compliance Law | Rationale for Including this Law | Title1 Health Care Access, Portability, and Renewability | offers protection of health insurance coverage without regard to pre-existing conditions | offers protection of health insurance coverage without regard to pre-existing conditions | Title II Preventing Health Care Fraud and Abuse,Administrative Simplification; | provides requirements for the privacy and security of health information | | Privacy Rule | •Provide information to patients about their privacy rights and how the information can be used.•Adopt clear privacy procedures.•Train employees on privacy procedures.•Designate someone to be responsible for overseeing that privacy procedures are adopted and followed. | It regulates the use and disclosure of PHI by covered entities. A covered entity, for example, includes health care providers, health plans, and health care clearinghouses | Security Rule | IT contains three broad safeguards. These safeguards include the following:•Administrative safeguards •Technical safeguards •Physical safeguard | The Security Rule provides for the confidentiality, integrity, and availability of ePHI | Enforcement Rule | The Enforcement Rule established the procedures for investigations and hearings into noncompliance. | To set the penalties to be levied as a result of HIPAA violations. |

The primary purpose of the HIPAA is s for helping citizens maintain their health insurance coverage. Second, it improves efficiency and effectiveness of the American health care system. It does so by combating waste, fraud, and abuse in both health insurance and the delivery of health care. The U.S. Department of Health and Human Services (HHS) is responsible for publishing requirements and for enforcing HIPAA laws.

Much of the focus around HIPAA is within the first two titles.
Title I

It offers protection of health insurance coverage without regard to pre-existing conditions to those, for example, who lose or change their jobs.
Title II

It provides requirements for the privacy and security of health information. This is often referred to as Administrative Simplification. The broader law calls for the following:
• Standardization of electronic data—patient, administrative, and financial— as well as the use of unique health identifiers
•Security standards and controls to protect the confidentiality and integrity of individually identifiable health information
As a result, the HHS has provided five rules regarding Title II of HIPAA. These include the Privacy Rule, the Transactions and Code Sets Rule, the Security Rule, the Unique Identifiers Rule, and the Enforcement Rule. These five rules impact and affect information technology operations within organizations. Specifically, the Privacy Rule and Security Rule affect information security. HIPAA is primarily concerned with protected health information (PHI). PHI means individually identifiable health information. PHI relates to physical or mental health of an individual. It can also relate to the delivery of health care to an individual as well as payment for the delivery of health care.
Privacy rule
The Privacy Rule went into effect in 2003. It regulates the use and disclosure of PHI by covered entities. A covered entity, for example, includes health care providers, health plans, and health care clearinghouses. In many ways, the Privacy Rule drives the Security Rule.
Security rule:
Administrative safeguards primarily consist of policies and procedures. They govern the security measures used to protect ePHI.
Physical safeguards include the policies, procedures, and physical controls put in place. These controls and documentation protect the information systems and physical structures from unauthorized access. The same goes for natural disasters and other environmental hazards. The physical safeguards include the four standards.
Technical safeguards consist of the policies, procedures, and controls put in place. These safeguards protect ePHI and prevent unauthorized access.
Enforcement Rule:
The potential for increased enforcement of noncompliance to HIPAA was later introduced in 2009 when the Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law. HITECH was signed in as part of the American Recover and Reinvestment Act (ARPA). In addition to laying the groundwork for increased enforcement, HITECH also adds requirements for a breach notification. The notification is what an organization puts in action should PHI becomes disclosed in a readable, that is, nonencrypted, format.
Compliance and Monitoring
The Compliance Committee consists of senior leaders from several corporate functions as well as three senior compliance leaders from the pharmaceutical, medical device and diagnostic, and consumer sectors. The Chief Compliance Officer chairs the Committee. The Compliance Committee is responsible for overseeing and approving corporate and sector-specific compliance policies, procedures and programs, and periodically reporting to the Executive Committee and the Board of Directors, including reports on the state of compliance.
The corporate functions represented on the Committee play a key role in overseeing the effectiveness of compliance programs in their functional area. They carry out this role by setting standards and policies, providing enterprise-wide training on new standards and policies, and reviewing the results of audits, testing and monitoring, programs, resource allocations, training plans, and management action plan reviews.