NIST guidance on managing IoT(Internet of Things) cybersecurity and privacy

Jonathan P. Tomes, J.D., is Keynote Speaker at Compliance Key. He is a health care attorney practicing in the greater Kansas City. He is a nationally recognized authority and expert witness on the legal requirements for health information. Jonathan P. Tomes is a healthcare attorney, consultant, educator, author and expert witness. He is a leading expert on the Health Insurance Portability and Accountability Act of 1996, particularly its Security and Privacy Rules. He also has litigated medical malpractice cases, defended doctors in revocation of licensure and credentialing proceedings, reviewe........


To date the only specific requirement relating to the National Institute of Standards and Technology ("NIST") Standards in the Security Rule does not require compliance with any NIST Standard but rather exempts covered entities from having to report breaches if they meet either of two NIST standards-the encryption standard or the disposal standard. The Security Breach Notification Rule only requires reporting of breaches of "unsecured" PHI. 45 C.F.R.  164.400-414. If data is encrypted or disposed of consistent with those two standards, it is secured, and, hence, unreportable

With the increasing number of cybersecurity breaches since HIPAA became law, DHHS recognized that more attention needed to be paid to improving cybersecurity and focused on the NIST Framework for Improving Critical Infrastructure Cybersecurity (the Cybersecurity Framework) and developed a crosswalk between it and the HIPAA Security Rule. It provides a policy framework of computer security guidance for how private sector organizations in the U.S. can improve their ability to prevent, detect, and respond to cyber attacks.

NIST publications, many of which are required for federal agencies, can serve as voluntary guidelines and best practices for state, local, and tribal governments and the private sector, and may provide enough depth and breadth to help organizations of many sizes select the type of implementation that best fits their unique circumstances. NIST security standards and guidelines (Federal Information Processing Standards [FIPS], Special Publications in the 800 series), which can be used to support the requirements of HIPAA and may be used by organizations to help provide a structured, yet flexible framework for selecting, specifying, employing, and evaluating the security controls in information systems.

Although not a specific reference like the one above re reporting, HHS has referenced the NIST standards in several places as a valuable resource and has provided a crosswalk between the HIPAA

Why should you attend this webinar?

With the increasing number of cybersecurity breaches since HIPAA became law, DHHS has become more aggressive in penalizing covered entities and business associates for breaches of Protected Health Information ("PHI") Privacy and Security with civil money penalties (fines) as high as high as $5.5 million and with the majority in the seven-figure range. Many of these fines could have been avoided if the entity had encrypted or destroyed the PHI consistent with the NIST standards. While HIPAA does not require encryption or that level of destruction, in terms, if encryption or destruction consistent with the NIST standards is employed, the possible compromise is not considered a breach and need not be reported to the Department of Health and Human Services ("DHHS") for possible enforcement action.
Additionally, the Security Rule is very vague and only requires "reasonable and appropriate security measures. But what are such measures? In recent guidance, DHHS has released a crosswalk developed with NIST and the Office of the National Coordinator for Health IT ("ONC"), that identifies "mappings" between the NIST Framework for Improving Critical Infrastructure Cybersecurity (the Cybersecurity Framework) and the HIPAA Security Rule. Use of this crosswalk will help covered entities and business asssociates ensure that their security measures are reasonable and appropriate. If one follows the NIST guidance, it would be extremely difficult for HHS or any court to find that a healthcare information security system was anything but reasonable and appropriate.

Areas Covered in the Session:

Who can Benefit:

HIPAA compliance officers, HIPAA Security Officers, HIPAA Privacy Officers, Healthcare IT Officers, CFOs, CEOs, COOs, CIOs, human resources directors, business office managers, administrators, medical records personnel, health information management professionals, health care attorneys, patient accounts managers, billing services, physicians, dentists, pharmacists, physical and occupational therapists, mental and behavioral health professionals, speech and language pathologists and audiologists, nurses, chiropractors, and business associates.

Webinar Id: HIPJPT011

Training Options:

Duration: 90 mins

 Stop, pause, and rewind: learn at your own place.

No reviews yet!!
 Recorded: [Six month unlimited access]

 $167 (Single Attendee)  $599 (Unlimited Attendee)

Refund Policy
Past Webinar of Jonathan P. Tomes
HIPAA Breach Notification Rule....
Presenter: Jonathan P. Tomes
View it anytime
Price: $231
HIPAA Compliance Through Polic....
Presenter: Jonathan P. Tomes
View it anytime
Price: $167

More Webinar

Pay Pal Logo   PayPal Verified Logo   GoDaddy Certified
Copyright © 2020 Compliance Key . All Rights Reserved. Back to Top