1. Security and Privacy Workgroup SMALL PRACTICE IMPLEMENTATION WEDI/SNIP Security and Privacy Workgroup White Paper Version 2.0 – Dated April 2004

2. Security and Privacy Work Group Background u White Paper based on Final Security Rule issued February 20, 2003 u White Paper for education and awareness use only

3. Security and Privacy Work Group Background u White paper intended for use by trusted entities – associations, consultants, and others – to inform small practices about HIPAA u Outlines awareness campaign to enable small practices to come into compliance with Security Rule u Two central goals: – Present strategy to inform small practices about HIPAA Security Rule – Give guidance to small practices to enable them to become compliant with Security Rule

4. Security and Privacy Work Group Background u Important to keep in mind small practices need basics – not detailed discussion of the more esoteric points – Practices want simple, straightforward, and, to extent possible, non-technical information – Recommended non-technical language be used and practices be encouraged to keep implementation as simple as possible – Technical language will make no sense to small practices

5. Security and Privacy Work Group HIPAA and Small Practices u HIPAA applies to small provider practice if that practice submits claims electronically either directly or through a billing service or “clearinghouse” u Does not apply to practice that does not submit any standard transactions electronically u ASCA requires submission of electronic claims to Medicare, except if small practice with less than 10 full-time equivalent employees

6. Security and Privacy Work Group Initial Information u Version 1.0 of white paper reviews Security Rule in detail – specification by specification u Translates rule into language understandable by small practices u Provides specific guidance on how to proceed in more complex areas – Future versions will provide more specific guidance as industry consensus starts to continues to take shape around these issues

7. Security and Privacy Work Group Specific Requirements u White paper reviews each requirement of Security Rule u Addresses administrative, physical, and technical security separately u Provides initial guidance on each of the 18 security “standards” in rule u Provides initial guidance on each of the 36 “implementation specifications” in rule

8. Security and Privacy Work Group Future Direction u Future versions of white paper will provide more specific information regarding how to approach and implement each standard and implementation specification u Where appropriate, templates and other documents may be developed, similar to WEDI/SNIP Small Practice Privacy Implementation White Paper

9. Security and Privacy Work Group Conclusion u Task of ensuring small practices come into compliance significant u Requires concerted effort by many individuals and organizations u White paper provides road map for trusted sources to provide consistent information u Information in white paper can be used by trusted sources to design specific guidance for their small practices

10. Security and Privacy Work Group White Paper u Much more depth and guidance in White Paper u Download White Paper at snip.wedi.org – Go to Workgroups, Security and Privacy, White Papers u If you have questions, contact the Security and Privacy Workgroup at snip@wedi.org

11. Security and Privacy Work Group Acknowledgements u WEDI/SNIP thanks the following individual for preparing this presentation: – Andrew Melczer, Ph.D., Illinois State Medical Society, melczer@isms.orgmelczer@isms.org