 By
Business Need
|
|
Secure email Service : |
CMAMedMail
to enable physicians, their staff, and other healthcare
providers to communicate with each other as well as with
patients. This system allows all subscribers to use secure
e-mail that supports open communication with all healthcare
participants, while ensuring the security of personal health
information (PHI) and compliance with HIPAA regulations.
This significant advance comes at a particularly opportune
time. The demand for efficiency and electronic authentication
is increasing in all segments of healthcare. At the same
time, providers, patients, labs, pharmacies, and payors
are turning to electronic communications to simplify healthcare
transactions and facilitate communication. Image X has teamed
with California Medical Association to offer.
|
|
At a glance : |
- An affordable and easy way to send HIPAA compliant
emails and healthcare documents.
- Easy for patients and physicians to use.
- Send any size document or attachment with the security
that it is encrypted, stamped, protected and with the
absolute knowledge that it has been retrieved.
- Send document via fax also.
- Provides a spam and phishing/spyware solution for emails.
- Easy access to the document/message from anywhere in
the world.
|
|
Brief Description : |
HIPAA is a set of sweeping
federal regulations that requires health care organizations
and businesses that handle confidential patient health information
to simplify and standardize data exchange in an effort to
protect the security, privacy and confidentiality of that
information. HIPAA established a set of uniform
standards for the privacy of patient health information used
by health plans, hospitals, pharmacies and other covered entities.
These regulations cover the electronic, oral and printed data
exchange of individually identifiable health information.
The HIPAA regulations are administered by
the Department of Health and Human Services (DHHS).
The core administrative and functional requirements of
HIPAA establish the security and privacy
standards of the HIPAA regulations. The
HIPAA privacy standards section of US 45
CFR 164.530(c)(1) is the regulatory section that delineates
standards of how healthcare organizations will protect individually
identifiable health information. The standards, known as
The Privacy Rule, spell out these administrative safeguards
standards. This section's safeguard standards establish
that "a covered entity must have in place appropriate
administrative, technical, and physical safeguards to protect
the privacy of protected health information". The key
word in the rule is "appropriate", which allows
the covered entity to define appropriateness for itself,
within reason. Neither HIPAA nor the US
DHHS define appropriateness because there is no one size
fits all measure. The appropriateness of any safeguard standard
is viewed as relative to the size, nature, and capacity
of each business. Therefore, adherence to The Privacy Rule
safeguard standards is relative. Technical Safeguards section
of the HIPAA security standards established in US 45 CFR
164.312. The standards, also referred to as the Security
Rule, established five security standards for electronic
protected health information (EPHI) protection; access control
(unique user identification, emergency access, automatic
logoff, and encryption), audit controls, integrity, authentication,
and transmission security.
The legal risk is simply a reflection of the underlying technical
risk. If the e-mail messages are being transmitted without
any encryption or policy based filtering then intercepting
PHI is not a difficult task. A mail message bound for an
external client may cross 3, 5, 10 or more Internet Service
Providers (ISPs) or mail relay systems before it reaches
its final destination. Anyone with administrative access
at any of these relay points could intercept and then view,
edit, or copy the message prior to final delivery. Thankfully,
the vast majority of ISP administrators do not intercept
email messages. The more nefarious scenario is that of the
computer hacker. Computer hackers can also intercept electronic
transmissions. Hackers commonly employ a tool called a packet
sniffer, which can monitor and intercept data on almost
any TCP/IP based network. A hacker could configure a packet
sniffer to silently intercept information as it traverses
one of theses relay points, the destination network or any
unsecured device involved with the transmission. Although
e-mail interception and packet sniffing are not something
that most administrators encourage or allow, it does happen.
Because it does happen, we should understand that transmitting
unsecured e-mail messages is inherently trusting in the
kindness and security effectiveness of strangers.
CMAMedMAIL has been designed to incorporate
all of the requirements of HIPAA regulations
by providing a means of exchanging healthcare information
between healthcare providers, health plans, and healthcare
clearinghouses and, any business associates working on behalf
of a covered entity such as accountants, auditors, attorneys,
and consultants in a secure fashion.
|
|
Features : |
- Archiving every mail and attached documents using the
proven MINDS system, which has been used by courts and
organizations since 1990 to archive legal and protected
documents.
- Converting and stamping of every document authenticating
the data of receipt and providing the information to sender
and receiver about the status of message as it travels
from sender to receiver.
- Generating complete reports that provide who, when
and from where documents are accessed.
- Providing firewall and encryption at server level.
- Interfacing to popular mail server software to provide
a means of converting and stamping all documents from
any persons that are sending documents using normal E-mail
system.
- Incorporates Web based faxing which can be used to
distribute, day sheets, transcriptions and other protected
information by organizations that use Fax machines. Fax
machines are generally not considered HIPAA compliant
but by converting these faxes to protected e mail, CMAMEDMAIL
provides a means of making these fax transmissions HIPAA
compliant.
- Uses SQL database to provide secure login and password-based
access to authenticate users, and data backup and storage
systems to ensure system continuity and recovery.
- CMAMedMAIL-IDS and Mail-Firewall have
security features designed to detect suspicious internal
computer user behavior and thwart subversive attacks,
including the ability to automatically detect and respond
to e-mail anomalies; generate log files and reports that
are useful for audit trails.
- Detects malicious code including viruses, worms, and
Trojan horse applications.
- Customizable policies, alerts, and notifications for
handling messages containing malicious Code.
|
|
Spam and Phishing? |
Although HIPAA does not
specifically mandate protection against unsolicited commercial
emails, spam can certainly pose a threat to PHI. For example,
spam could be used to perform a social engineering or phishing
attack against PHI by coercing an otherwise innocent user
to unintentionally or inadvertently forward PHI to an unreliable
source. Additionally, spam could either contain malicious
code or direct a user’s e-mail application to a website
that executes malicious code. These types of threats can easily
compromise PHI within the enterprise. CMAMedMAIL’s
anti-spamming and anti-phishing features protect against these
vulnerabilities at the network border helping to prevent them
from ever reaching the mail server or the end user. David
Ginsberg, president of PrivaPlan Associates Inc., a leading
solutions provider for HIPAA compliance, believes that “it
provides an easy to use and secure system that can be adopted
by even the smallest health care providers; this same ease
of use makes it an ideal solution for secure patient communication.
HIPAA solutions that are hard to implement or use face barriers
to adoption that lessen their effectiveness. We believe CMAMedMAIL
addresses these barriers. Thus we believe that CMAMedMAIL
will provide solutions for the entire spectrum of
covered entities under HIPAA such as health care providers
(both ambulatory and institutional), clearinghouses and health
plans, and their respective business associates. The unique
offering of CMAMedMAIL as either an ASP model
or a client/server model (that in turn can be used as a local
ASP) should appeal to institutional providers as well as provide
a solution set for the rapidly emerging connected healthcare
community market which encompasses the federal mandate for
a personal health record. One of CMAMEDMAIL’s unique
features is the secure archiving of relevant documents. Typical
electronic health care email transactions include document
or image transmission as well.
CMAMedMAIL’s use of the Image X date
stamp system should provide value to many different trading
partners. The use of industry standard MS SQL databases and
appropriate internal access and authentication controls along
with encryption should also provide assurances of compliance
with the emerging identity theft regulations. We understand
that CMAMedMAIL will interface with popular
email server software and can operate compatibly with MS Exchange
server. This should further strengthen its appeal.”
|
|
Conclusion : |
| HIPAA compliance is seen
by many healthcare organizations as a difficult hurdle to
overcome. In addition, the healthcare industry’s growing
dependence on e-mail as a mission critical application requires
security and privacy to be a top priority. Due to the sensitive
and highly proprietary nature of the healthcare industry,
our ability to give professionals the peace of mind they need
to be able to concentrate on their vital day-to-day responsibilities
without having to worry about patient privacy or compliance
is invaluable. CMAMedMAIL provides an easy
to use secure and economical solution than any other HIPAA
compliant email solution. The technology allows its participants
to leverage Internet e-mail communication in a way that is
not only secure, but also complies with the level of auditing
and encryption recommended in the Health Insurance Portability
and Accountability Act of 1996. CMAMedMAIL
provides an elegant and technologically superior solution
that allows healthcare users to extend the convenience of
sending sensitive medical correspondence knowing it will not
be intercepted - ever! |
|
|
| |
|
|
|
|
|
|
|
 |
| |
 |
 |
Chelan
County Clerk and Image-X jointly
offering free services to soldiers.
|
| |
 |
|
|
|
|
|
|
|
|
|
| |
|
(805)
964-3535
