Security
As of May 23, 2005, all health care providers could apply for their National Provider Identifier (NPI). The NPI is replacing health care provider identifiers used in standard health care transactions. The health plans with whom you do business will instruct you about when you may begin using the NPI in standard transactions. All HIPAA-covered entities except small health plans must start using the NPI on May 23, 2007; small health plans have until May 23, 2008. For additional information and to complete an application, visit https://nppes.cms.hhs.gov on the web.
Also, an instructional web tool, called the NPI Viewlet, is now available for viewing at http://www.cms.hhs.gov/medlearn/npi/npiviewlet.asp and under “HIPAA Latest News” at www.cms.hhs.gov/hipaa/hipaa2 on the CMS website. This tool provides an overview of the NPI, a walkthrough of the application, as well as live links to the NPPES website where the learner can apply for an NPI. This tool is designed for all health care providers. In the near future, you will also be able to access the viewlet at https://nppes.cms.hhs.gov on the web.
The Security and Electronic Signature Standard requires covered entities to protect health care information they electronically collect, maintain, utilize or transmit. This standard has four components:
- Administrative procedures - Certification, chain of trust partner agreement, contingency plan, formal mechanisms for processing records, information access control, internal audits, personnel security, security configuration management, security incident procedures, security management process, termination procedures and training.
- Physical safeguards - Assigning security responsibility, physical access controls, policy/guideline on workstation use, secure workstation location and security awareness training.
- Technical security services - Access control, audit controls, authorization control, data authentication and entity authentication.
- Technical security mechanisms - Communications and network controls.
- Electronic signatures - Digital signatures.