To your health, revisited
 
|
|||
 | |||
|
Sign up to receive this and other networking newsletters in your inbox.
A few weeks ago I noted in this newsletter that the Health Insurance Portability and Accountability Act, which requires confidentiality of electronic patient records, might be met in part through the use of VPNs.
If health care providers need to keep this data secret but also provide a broad mesh of legitimate access to it from many different parties, VPNs seem to be a tailor-made solution.
The earlier newsletter sought comment on a draft of a VPN policy being considered by a health care provider. While readers sent in responses, most did not actually address the specifics of the draft. But they did offer some helpful advice and resources you can use in formulating your own policy.
(To read the earlier newsletter, go to www.nwfusion.com/newsletters/vpn/2001/00991506.html).
Some readers noted that service providers offering managed VPN services could lift the chore of setting up VPNs from health care enterprise executives. True enough, and that is an option open to all enterprises for all VPNs.
But another reader notes that not all VPN services are encrypted from end to end or in some cases at all. Many network-based VPN services are encrypted at the provider's point-of-presence (POP), but not at all between customers' sites and the POPs. This would violate an HIPAA rule that traffic be encrypted from source to destination.
Smaller medical offices face the same responsibilities to HIPAA as hospitals and medical centers do, but they likely lack the expert staff to make informed decisions. This is another case where VPN services might be the answer. In these cases, users will want some assurance in writing that a given service meets HIPAA requirements.
HIPAA regulations and a set of best-practices that meet its requirements are still being formulated, and the best course of action for large enterprises is to be involved directly in deciding what these best practices are. The rest of us can stay informed about the progress of the work via groups dedicated to the work, some of which are listed here.
RELATED LINKS
Tim Greene is a senior editor at Network World, covering virtual private networking gear, remote access, core switching and local phone companies. You can reach him at tgreene@nww.com.
Network World VPNs archive
Past newsletters.
U.S. Health and Human Services HIPAA site
U.S. Health and Human Services HIPAA list-serve
U.S. Health Care Financing Administration HIPAA site
Red Creek aims to automate VPN mgmt.
Network World, 09/24/01
