"Running Case Study

Sandia Medical Services

Chapter $6$ System Design

As described in previous chapters, the Real$-$Time Glucose Monitoring $($RTGM$)$ system will include processing components on servers and on mobile devices with data exchange via $3$G and $4$G phone networks. Users will include patients, physicians, nurses, and physician assistants. In the United States, the Health Insurance Portability and Accountability Act of $1996($HIPAA$)$ mandates certain responsibilities regarding the privacy and security of electronic protected health information $($ePHI$).$ The law applies to what are collectively called covered entities$$that is$,$ health plans, health$-$care clearinghouses, and any health$-$care providers who transmit health information in electronic form. More information can be obtained from the U$.$S$.$ Department of Health and Human Services Web site $($www$.$hhs$.$gov$).$

In general, covered entities should do the following:

Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.

Identify and protect against reasonably anticipated threats to the security or integrity of the information.

Protect against reasonably anticipated, impermissible uses or disclosures of the information.

Ensure compliance by their workforces.

Specifically, covered entities should implement policies, procedures, and technologies that do the following:

Specify the proper use of and access to workstations and elect QO$07$ ronic media.

Regard the transfer, removal, disposal, and reuse of electronic media to ensure appropriate protection of ePHI.

Allow only authorized persons to access ePHI.

Record and examine access and other activity in information systems that contain or use ePHI.

Ensure ePHI isn$$t improperly altered or destroyed.

Guard against unauthorized access to ePHI that is being transmitted over an electronic network.

Case Questions:

What are some of the most important integrity and security controls for this system? Explain."