ISSA-LA InfoSec Summit XI

Hear the latest important strategies for HIPAA enforcement from the Deputy Regional Manager at US Department of Health and Human Services - Office for Civil Rights -Pacific Region

What are CISOs in Healthcare worried about as their heads hit the pillow each night? What new types of attacks are we all looking at defending against?

The U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health IT (ONC) today issued a proposed rule to support seamless and secure access to, exchange of, and use of electronic health information (EHI).

The proposed rule is designed to increase innovation and competition by giving patients and their healthcare providers secure access to health information and to new tools, allowing for more choice in care and treatment. It calls on the healthcare industry to adopt standardized application programming interfaces (APIs), which would allow individuals to securely and easily access structured EHI using applications for smartphones and other mobile devices.

The proposed rule would implement provisions of the 21st Century Cures Act that deter and penalize information blocking by outlining seven proposed exceptions to its definition under the law.

The proposed rule would place a strong focus on patient access to their health information through a provision requiring that patients could electronically access their EHI at no cost. It would also encourage competition and new business models in the health care market.

The proposed rule also includes a request for information on the parameters and implications of including price information within the scope of EHI and if that information would help the public see the prices they are paying for their healthcare.

This session will explore the rapidly evolving privacy legal landscape in the US in 2019, in particular the California Consumer Privacy Act (taking effect on January 1, 2020), other state bills on the horizon, and the likelihood of a federal omnibus privacy law. The CCPA greatly expands the current scope of regulation of all kinds of sensitive information held by nearly all companies doing business in California. As relevant to healthcare, the CCPA imposes restrictions on the processing of health, wellness, and medical information handled by entities that are not regulated under HIPAA, and provides individuals with much more robust rights with respect to that information. Now is the time for organizations to prepare for compliance.

Are we close to the tipping point of an acceleration in medical device security? We are all affected (or will be at some point) by medical device security, and we all have a role to play to help push things forward. Learn about the latest FDA pre-market guidance, the HSCC Joint Security Plan, Medical Device Hacking Village, and other key initiatives that seem to indicate we are near a tipping point, though challenges remain. In an interactive Q&A, also hear from a healthcare provider CISO and medical device security program manager on lessons learned in this area.