New HIPAA Rule - what, how and when?

HIPAA New Rule

I spent some time collating a lot of expert opinions and adding to it my experience, thoughts, carved out below article, whitepaper for you to get everything at one place - 

HIPAA has finally released the rule on Privacy, Security, Breach Notification and Enforcement on January 25th 2013. The final rule will further strengthen government’s capability to enforce the law and also protect the patient’s privacy, safeguarding their personal information. Let us go back and understand the history and reason for existence of HIPAA before we dive deeper into the details of this latest rule.

HIPAA is an acronym for Health Insurance Portability and Accountability Act. The act was introduced in 1996 in Unites States of America to bring changes in for healthcare delivery, transaction, and administrative information systems.

The rise of tablets and smartphones has stressed upon the need of having stringent regulations and laws in place to ensure security of information and better health care delivery. The healthcare industry has been most supportive in adapting mobility and in turn mobility has helped the healthcare industry to aid in the ultimate goal of providing better healthcare services. Considering this, many patient and provider centric applications/ software solutions have been developed and deployed in the recent past. The common challenge for all such applications and solution has been to deliver information securely.

According to an article in MobiHealthNews, over 10,000 mobile healthcare applications are used to access electronic health records (EHRs) daily, but the

Office of Civil Rights has reported dramatic increase in the incidence of data loss or leakage through mobile devices—more than half of them attributed to tablets alone. These breaches may have left the personal records of 1.9 million patients at risk. Healthcare became one of the most breached industries in 2011, and medical records were involved in the three worst data breaches of that year.

Keeping this in mind, the recent regulatory changes to Health Insurance Portability and Accountability Act (HIPAA) is made stringent. For example, to safeguard the use of mobile devices among healthcare providers, new HIPAA regulations insist that all patient data be encrypted at all times—during transmission, at any time data resides on wireless devices, and even while it is stored within applications. In addition to the greater liability, an increased chance of reputational damage, the IT professional and solution providers will be facing threat of severe governmental fines, and other consequences!

On January 25, 2013, the Department of Health and Human Services issued the long-awaited revisions to the HIPAA rules, making a number of changes to the current HIPAA privacy, security, breach notification and enforcement requirements.

The most fascinating and encouraging change in the new amendment is default mechanism to share PHI (Protected Health Information) with owner is through electronic channels. This change should trigger more adoption towards sharing information with patient through electronic media such as mobile application, email or digital report with secure channel distribution. The major provisions in the new rule cover, Hefty Penalties, Breach Notification, Expansion of Covered Entities, and PHI Distribution.

Endeavour has published a whitepaper covering in detail the changes in the new HIPAA rule, their impact on the mobile solutions, and the best practices a healthcare focused mobile app developer should consider when developing solutions for healthcare domain. For more details, download this whitepaper for free and make sure you are developing applications which are HIPAA compliant.

Note: The new rule analysis, best practices, recommendations are built based on my experience with Endeavour working on mHealth solutions, healthcare IT expert's thoughts. I am thankful to all those experts and colleagues whose thoughts, published work i have referred to in this article and whitepaper.

Enterprise Security and Mobility

Security is the most important thing in everything we see around. It is no exception when it comes to Enterprise solutions. It is the prime concern for all IT departments and CTO/ CIOs of the enterprises. Security is generally understood as just the policies and regulations by end user but we must also note that the enterprise applications and solution are first candidates to consider security. With the proliferation of consumer mobile devices into the enterprise networks and BYOD policies it is even more difficult to keep the enterprise information secure. The workforce demands to enable wide variety of application onto a scalable mobile platform throws larger challenges in front of an enterprise. Due to the mobile nature of the devices and criticality of the information residing on those devices, security can be the most important thing on any CIO's mind!

The sound mobility roadmap should be built keeping security at the core and considering growing trends, user profiles and needs of near future. The security isn't only about extending the IT policies to devices or computers but effectively building it into the solution DNA. Companies have realized the importance of mobilizing and empowering their field force or employees. However, IT is indebted to choose an implementation, which will not compromise enterprise security.

Assessing the current security implementation, understanding enterprise mobile risks, designing a mobile security policy and selecting a robust mobile security strategy should be a ‘must do’ for the enterprises rather than a ‘good to do’ exercise. The enterprises have matured in enterprise security practices over the years and have robust security infrastructure in place for their current system or network infrastructure. But the enterprise application on tablets or Phones opens up an array of concerns, which they never had to bother about earlier. There is no single device/ platform that offers real end-to-end security infrastructure as well as best use case. So, the challenge is, how do we make the mobile a trusted device for the enterprises!

Security Approach

To build a robust and secure policy, one need to visualize the security as multilayered approach. Ideally the solution/ strategy needs to depend on more than one layer of validations and not just one. Most enterprises might already have invested in security in some or the other way. The one term strategy must consider the return on this investment. Mechanisms such as two-factor authentication, VPN networks etc. may be already in existence. The mobility must extend or be built on those premises. The chosen strategy and solution should be easy to manage, infallible. Typically enterprises would safeguard their networks and sensitive from single point of failure. The security should be seen as end-to-end. That typically means - On device, In transit, and Inside network. As long as enterprises put together a strategy to secure the information/ data in these three places, any devices can ideally be trusted!

The key touch points of the Enterprise Mobile Security are depicted in the figure below.

The multilayered security approach entails the following considerations Application Level security, Network level security and device Level Security.

The application level security mainly encompasses Runtime Protection

•       Mandatory Code signing

•       Secure authentication framework

•       Common crypto architecture

•       Application data protection

The network level security can be easily devised dependent on VPN, SSL/ TLS or WPA based transmission channels. The device level security can be handled through use of robust mobile Device Management (MDM) solution.

The data security on the device can also be viewed in different modes such as Access Mode (Authentication and Authorization), Storage Mode (Encrypt, sandboxed). Security requirement of a mobility solution must be assessed in various stages of the project life cycle such as architecture and design, development and deployment.

The choice of the device and solution delivery plays an important role in security. The advanced mobile operating systems such as iOS, Android and Windows Phone support security to a greater extent anyway. The security strategy must use these out of the of the box features provided by mobile operating systems.

Windows Phone 8 - Whats on the horizon?

Earlier in the month we saw Apple announcing iOS version 6 and now we hear Microsoft announcing Windows Phone 8 for the phone. Earlier this week, microsoft showcased the windows tablet "surface". A cool video i must say. Earlier I thought of writing a detailed post on what is the enterprise readiness for the mobile platform and then compare all platforms head on head. But i think with Windows and iOS new version announcement, i would first cover what I learn from these versions. 


My colleague Ram covered the iOS 6 in his recent blog post here, so let me constrain here with Windows Phone :)


The Windows phone 8 update will not be a full update to the existing windows phone devices. Thats the sad news. They will only get 7.8 update with just a minor set of features like start screen. This is mainly due to the new base on which the Windows Phone OS is designed. Microsoft claims that WP 8 is a convergence of age old windows OS with latest Metro design and newness in mobile world. It looks like, the new windows phone OS shall support higher resolutions and multi-core processors. It means better games and faster apps. The discontinued support actually means only limited features from WP8 will be enabled on the existing WP7.5 phones. This is i think obvious as a lot of features are dependent on the hardware.


NFC, Digital Wallet and More...
Microsoft has built NFC, external SD card and digital wallet into the new WP version. NFC and SD cards were expected but digital wallet surprises as it just comes after Apple's passbook announcement from iOS 6. Apple constrained their passbook offering to boarding passes, coupons but Microsoft took it to combine features from google wallet and apple passbook. Windows Phone 8’s new digital Wallet feature offers better experience than google and apple. It can keep debit and credit cards, coupons, boarding passes, and other important info in the digital wallet. And when paired with a secure SIM from supporting carrier, spot payments can be made at compatible checkout counters.


New Pure OS features
In the new Windows Phone version, the IE 10 will be bundled. The start screen is smartly refreshed. The notable innovation on the start screen is ability to resize the tiles into 1/4th of curent screen size. This means, once can keep the tiles they like with the sizes they want! If i like reading SMS on the tile itself, just stretch it to full width tile or if i dont use the phone app much, squeeze it to 1/4 of the screen! Pretty cool. I personally use the Windows Phone for past 6-8 months and i love the tiles! This would be one feature i would certainly vote high! With new windows phone version, the maps are getting revised too. Microsoft and Nokia are merging their maps to build beter one. Not really sure hw much will this score against industry giant google maps and new kid on the block - apple maps. The windows phone among other features now supports multi-lingual interfaces and languages for around 50 countries. The OS updates will be delivered over the air similar to close rivals iOS and Android.


Windows Phone 8 SDK enhancements
Support for native C and C++ code would lead to older C++ apps and device interface apps to run smoother and with lesser efforts. DirectX based games and screen rendering would be a breeze provided now phone hardware is keeping up with this pace. this may mean some of the old C/ C++ games start popping up on the app store! I can now bring some of my proprietary hardware interface code to work for enterprise apps easily on the phone. Another welcome addition is in-app purchases and VOIP app integration into people hub. Not just Skype but apps like tango, IM etc can now build the interfaces right into the people hub with calling facility. This creates the hope for apps like gTalk to be able to use for calling from the phone directly from the app hub. The question would be if google would do that app someday :D)


Enterprise Support
A big leap from the earlier version, Windows Phone now supports the enterprise use of devices. The device management, security and policy enforcement, app deployments and custom app stores would be a possibility with new windows phone version. The entire device encryption has been enabled wherein one can set the device OS, contents and all data to be securely encrypted. Windows phone will now support UEFI (United Extensible Firmware Interface) boot protocol to enhance security. Microsoft claims that the same tools used for windows desktop devices management can be used to remotely manage the windows phone devices too. The remote wipe, install, uninstall would be a possibility. The biggest yet enhancement targeted for enterprises is Company Hub and apps. This will enable the custom application to be distributed in secure an private manner to limited audience in the enterprise.


Although we havent got chance to play with any physical phone that runs windows phone 8 yet, it looks like microsoft is slowly catching up with apple and google. The Gartner, IDC, CommScore etc have some or the other way hinted at windows phone being a string contender for enterprise grade OS. [Refer this link] Blackberry is fast fading but Microsoft is not. The future of Nokia can be still doubted but windows phone sure looks promising. I just hope that apple keeps the pace with its iPhone 6 for hardware innovation and pushes the limits further. The mobile OS war is now seems to be getting focused around Microsoft, Google and Apple in the ascending order of leadership of course. Will this change in near future? I guess so but as they say, to test the reality, you can to live in reality. Lets just wait and watch. Oh i should say, develop apps and watch :)


Quick Note: For those who are interested in a detailed view of earlier WP version view, visit this blog by Basavraj.


Disclaimer: All the information here about windows phone 8 are based on Windows Phone team blog by Microsoft. And of course "IMO, I feel, I guess" are my omments :)

iPhone 4S in Enterprise

Ram does a review of the iPhone 4S - enterprise perspective.

iOS and I: iPhone 4S in Enterprise: Overview Since its launch, iPhone 4S is talk of the town because of many reasons. On Oct 4 th when whole world was waiting for iPhon...

Courtesy: Ramananda Shetty.

Webinar on "Enterprise Security & Android Platform" held on August 25, 2011

The Webinar held on August 25, 2011 by my Technology Consulting Group at Endeavour, on "Enterprise Security & Android Platform" emphasized on the importance of Enterprise security and the role that Android Platform plays in it.

Data and transaction security has become of paramount importance with increase in mobile application usage in enterprises. The challenges of the security issues faced have become a top priority in every enterprise. Businesses and IT departments are experiencing employees opting for Android phones as corporate communication tools over other Smartphone as they offer powerful apps and innovative hardware specs. 

The Webinar covered:

• An Overview of Mobility and Mobile Security
• Best Practices for Secure Software Development
• Android OS specific details with respect to the above

Here is the link to access the presentation - Presentation Link