CHRIS: Now, this is really important, because what they're doing here is giving you a spectrum that you're going to be operating within. It goes on to say that, “given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity’s particular size, organizational structure, and risks to consumers’ ePHI.”
This is [both] a major weakness and a major strength of the Security Rule. And they're generally saying nothing and something all at once. This can be really challenging to understand. One of the best things to do is to look at some examples and what exactly are they expecting?
Generally speaking, the goal here is to operationalize the Privacy Rules, so keep that in mind. That should be the heartbeat of why the Security Rule is there. And you'll probably want to think about the context of how this Security Rule came about. The overall HIPAA laws were published and established in 1996, so there wasn't a lot of Internet activity, there weren't a lot of massive security breaches. These things really started happening later as the Internet matured, this became a pretty substantial concern.
Naturally, half-a-decade to a decade later, as sometimes legislation can go, there was finally a legislative consequence, and that was the Security Rule. Then the Security Rule for HIPAA was modified and there are guidelines posted, etc. So the point is that the Security Rule was intended to, as they state here, operationalize the Privacy Rule. And this means in technical and non-technical ways. Substantially, they're talking about ePHI, electronic situations.