Privacy & Security Toolkit

The HIMSS Privacy&SecurityS Toolkit (formerly known as the HIMSS CPRI Toolkit) offers new insights and up-to-date information in many areas, including a timely discussion of some national-level initiatives from Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC), such as CCHIT and HITSP. 

Expand All | Collapse All

• Introduction
  • Executive Summary
  • Toolkit Layout
• Privacy & Security Principles
  • Privacy & Security Principles
  • A Primer in Information Security
  • Whitepaper: What Healthcare Executives Should Know and Do About Information Security
  • HIMSS Sound Security Practices
  • HIPAA Privacy and Security Resources for Solo Practitioners & Small Practices
  • HIPAA Privacy & Tools for Long-Term Care Organizations
  • JCAHO/NCQA Recommendations for Protecting Personal Health Information
  • Legal Health Record Issues (future chapter)
• Rights & Obligations – Laws, Regulations & Standards
  • Setting Standards in Healthcare Information
  • Privacy and Security Solutions for Interoperable Health Information Exchange (the HISPC Project)
  • The Healthcare Information Technology Standards Panel (HITSP)
  • Privacy Introduction
  • United States Laws Relating to Privacy
  • GLBA: Gramm-Leach-Bliley Act
  • US Patriot Act & Homeland Security Act
  • HIPAA: Health Insurance Portability and Accountability Act of 1996
    • HIPAA Privacy & Security
      • Who's Covered Under HIPAA
      • Who's Excluded from HIPAA
      • What Information is Covered
      • HIPAA Privacy & Security Standards
    • HIPAA Final Standards for Data Security
    • The HIPAA Final Security Rule in Plain English
    • Final HIPAA Security Standard Matrix
    • HIPAA Facts and Myths
    • HIPAA Final Standards for Privacy and Security
    • Protected Health Information: General Rules on Use and Disclosure
      • Permitted Uses and Disclosures Required
      • Minimum Necessary Standard
      • Agreed Upon Restriction
      • De-identified Protected Health Information
      • Disclosures to Business Associates
      • Deceased Individuals
      • Personal Representatives
      • Confidential Communications
      • Uses and Disclosures Consistent with Notice
      • Disclosures by Whistleblowers
      • Disclosures by Workforce Members Who are Victims of Crime
    • Use and/or Disclosure to Carry Out Treatment, Payment, and Health Care Operations (TPO)
      • Permitted Uses and Disclosures
      • Consent for Uses and Disclosures Permitted
      • Treatment, Payment, or Health Care Operations
    • When an Authorization is Required
      • Authorizations for Uses or Disclosures
      • Psychotherapy Notes
      • When Must the Individual be Given the Opportunity to Agree or to Object?
      • Facility Directories
      • Involvement in Individual’s Care
    • When an Authorization is Not Required
      • Uses and Disclosures Required by Law
      • Uses and Disclosures for Public Health Activities
      • Disclosures about Victims of Abuse, Neglect or Domestic Violence
      • Uses and Disclosures for Health Oversight Activities
      • Disclosures for Judicial and Administrative Proceedings
      • Disclosures for Law Enforcement Purposes
      • Uses and Disclosures about Decedents
      • Uses and Disclosures to Avert a Serious Threat to Health or Society
      • Uses and Disclosures for Specialized Government Functions
      • Disclosures for Workers' Compensation
    • Other Requirements
      • De-identification of Protected Health Information
      • Re-identification
      • Minimum Necessary Requirements
      • Limited Data Set
      • Disclosures for Law Enforcement Purposes
      • Underwriting and Related Purposes
      • Verification Requirements
    • Accounting of Disclosures of Protected Health Information
      • Right to an Accounting of Disclosures of Protected Health Information
      • Content of the Accounting
      • Provision of the Accounting
    • Marketing and Fundraising
      • Marketing
      • Fundraising
      • Authorization Not Required
      • Authorization Required
      • Practice Brief
    • Business Associates
      • Overview
      • Identifying a Business Associate Under HIPAA
      • Business Associate Contracts
      • Obligations of Business Associates
      • Accounting of Disclosures
      • Breach of Confidentiality by Business Associate
      • Disposition of PHI Upon Termination of Contract
      • Sample Business Associate Policy Document
      • Sample Business Associate Agreement
      • Sample Business Associate Cover Letter
    • Preemption of Laws
      • Overview
      • HIPAA Privacy Rule and State Laws
      • Federal Law
      • Preemption Analysis
    • Compliance and Enforcement
      • Overview
      • Compliance & Enforcement of the Privacy Rule
      • Penalties for Non-compliance
      • HIPAA Compliance Database
      • Audit & Compliance
      • Compliance Dates
    • Group Health Plans
      • Self-Insured Health Plan
  • State Medical Privacy Legislation
  • International Privacy Initiatives
    • European Union Privacy Directive
    • Canada Privacy Legislation
      • Canada Privacy Legislation
      • Links to Canadian Privacy Legislation
      • Canadian Privacy Commissioners and Oversight Agencies
• Policies
  • Developing Policies, Procedures, and Practices - Introduction
  • CPRI Guidelines - Information Security Policies
  • Sample Privacy and Security Policies
    • Beth Israel Deaconess Medical Center Technology Resources Policies
    • Department of Defense Information Assurance Program
    • Harris County Hospital District Texas HIPAA Policies
    • Georgetown University Medical Center
    • Mayo Foundation Information Security Policies
• Practices
  • NIST Special Publications
  • Privacy Impact Assessments
  • Assigning Roles and Responsibilities
  • Guidelines for Managing Information Security Programs at Organizations Using Computer-based Patient Record Systems
  • Special Issues and Concerns
    • Overview
    • Healthcare Education Programs
    • The Clergy and PHI
    • Shadow Charts and Independent Databases
    • Privacy Risk in Outsourcing
    • Mental Health Information
    • Privacy and Public Health
    • Privacy in Disaster Situations
    • Offsite/Remote Practices
  • Health Information Risk Assessment & Management
    • Health Information Risk Assessment and Management
    • Case Study: Project Phoenix - Risk Analysis of a Telemedicine System
    • Case Study: Project Phoenix - Risk Management Plan
  • CMS Security Guidance for Remote Users
  • Organizing Privacy and Security Training
  • Business Continuity Planning & Disaster Recovery Planning
  • Enforcing Security Policy
    • An Approach to Enforcing Security Policy
    • Case Study: Securing User Agreement at Kaiser Permanente
    • Physical Security of PHI (future chapter)
    • Implementing Information Security Policies
    • Security Features for Computer-based Patient Record Systems
    • Patient Centered Access To Secure Systems Online (PCASSO)
    • The CHIME-Trust Healthcare Public Key Infrastructure and Trusted Third Party Services: A Case Study
    • Security of Wireless Communications
  • Enhancing Patient Understanding
    • Enhancing Patient Understanding
    • HelpBot: Using an Internet Browser to Meet Varying Patient Needs for Information About Privacy and Security
  • Institutionalizing Responsibility
    • Introduction
    • Case Study - Kaiser Permanente Trustee-Custodian Agreement
    • AUDITING (future chapter)
    • The State of California Office of HIPAA Implementation
  • Health Network Infrastructure
    • Introduction
    • The Federal Information Security Management Act of 2002: an Introduction
    • Network Certification and Accreditation: Case Study of the New Defense Information Assurance Certification and Accreditation Program (DIACAP)
    • Privacy and Security in Public Health
    • Regional Health Information Organizations (RHIOs) and HIPAA
    • Advanced Methods of Authentication and Authorization (future chapter)
    • Privacy and Security Issues in HIE
    • RHIO P&S Update
    • Model Contract for Health Information Exchange (HIE)
  • Administrative Requirements
    • Personnel Designations: Privacy Officer
    • Policies & Procedures
    • Training Requirements
    • Security Safeguards
    • Privacy Risk Analysis
    • Complaints
    • Sanctions
  • Notice of Privacy Practices
    • Notice of Privacy Practices
    • Enhancing Patient Understanding
    • Overview
    • HIPAA's Notice of Privacy Practices NNP
    • Content & Distribution of HIPAA's NPP
    • Organizational Relationships and the NPP
    • Examples of NPPs
  • Consent and Authorization
    • Overview
    • OCR Privacy Guidance
    • HIPAA & State Regulations
    • About Authorizations
    • Documentation Requirements
    • Authorization Samples
  • Access and Amendment
    • Complying with requirements
    • Access Guidelines
    • Amendment Guidelines
    • Sample Documents
  • Alcohol and Drug Abuse
    • Overview
    • HIPAA & Substance Abuse
  • Research
  • Retention and Disposal
    • Retention of Health Information
    • HIPAA Retention Requirements
    • Disposal
    • General Guidelines for Destruction
  • Communication Tools
    • Overview
    • E-Mail Communications
    • Facsimile (Fax) Transmissions
  • Radio Frequency Identification (RFID)
    • NIST Guidelines for Ensuring RFID Security
• Federal Case Studies
  • The Centers for Medicare & Medicaid Services (CMS) Information Security
  • Sending Records Efficiently and Securely To the Social Security Administration’s Disability Claims System
• Medical Device Security
  • Medical Device Security Issues (future chapter)
• Personal Health Record (PHR) Security
  • Personal Health Records
  • AHIMA MyPHR
  • Markle Foundation's Common Framework for Networked PHI
• eHealth Privacy & Security Issues
  • Overview of the GAO HIT Privacy Report
• The American Recovery and Reinvestment Act (ARRA)
  • Effect of the HITECH Act on HIPAA Matrix
  • ARRA Privacy and Security FAQs
  • ARRA Chronological Listing of Key Privacy and Security Dates
  • Privacy and Security Implications of ARRA Webinar
  • Ensuring Policies are Aligned to Comply with Breach Notification & Accounting of Disclosures Webinar
  • Business Associate Agreements: Beyond HIPAA and into ARRA Webinar
• Appendix A - Web Sites
• Appendix B - Glossary

The HIMSS Privacy & Security Work Group engages in a structured process tocontinually update, revise, and add new material to the HIMSS Privacy & Security Toolkit.  We are very interested in receiving feedback. Please click the link below if you have questions, concerns or ideas for new content or if you would like to contribute new material to the Toolkit.

Suggestions/Comments

Tips on Using the Toolkit

HIMSS Privacy&SecurityS Toolkit features

• Table of contents
• Drop-down menus
• A consolidated annotated bibliography
• A list of reference websites
• Glossary of terms 

Each section of the Toolkit includes:

• An introduction to topic at hand
• The latest edition of the pertinent guidelines or literature, case studies with sample policies, procedures and forms, and extensive references to print and Internet sources of more information.

The HIMSS Privacy and Security Toolkit Work Group

The HIMSS Privacy and Security Toolkit Work Group, created to maintain the Toolkit content, is comprised of industry leaders and information privacy and security experts who will ensure the Toolkit's place as a "must have" reference tool. See the list of the Members of the HIMSS P&S Toolkit Work Group at the bottom of this page. Members include:

HIMSS Resources: