1. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 1 Security & Privacy Agenda Security & Privacy Concepts Security & Privacy Awareness Security & Privacy Cycle Security & Privacy References

2. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 2 Security & Privacy Concepts -Security Policy - Corporation -Digital Signature Act - Business -Sarbanes/Oxley – Financial HIPAA - HealthCare

3. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 3 Security & Privacy Concepts HIPAA GOAL Protecting individuals patient data without compromising personal safety Quality of CareInformation Security Patient Safety

4. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 4 Security & Privacy Concepts Privacy: Access, Use of, and disclose of Confidential Information Security: Safeguard in place to protect Confidential Information PRIVACY - What to protected SECURITY How it is protected

5. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 5 Security & Privacy Awareness Security Categories: Administrative –Policies, procedures and practices Physical –Doors, Locks, Badge Access Technical –Software Electronic Access, Audits

6. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 6 Security & Privacy Concepts Security Mission -Confidentiality – Insures proper authorization to Information -Availability – Information is Accessible -Integrity – Accurate and Reliable -Authentication - Proof of Identity -Non Repudiation – legally bound

7. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 7 Security & Privacy Awareness Security is a continuous Cycle of: Assessment - Identify or follow up to changes to environment? Plan - Suggest solutions to mitigate risk where appropriate Implement - Implement corrective action based on plan Report - Success or Failure of corrective actions

8. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 8 Security & Privacy Cycle Assessment Tasks for Security Identify Threats What is being protected? Who is it being protected from? What are the threats? Where are the Assets? Identify probability of Risk Identify Impact of Risk Identify acceptability of Risk

9. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 9 Security & Privacy Cycle Plan Tasks for Security Mitigate those High Risks Verify security planned is reasonable for: Authentication, Non Repudiation Confidentiality, Availability, Integrity Establish Cost of Solutions –Physical, administrative, technical costs

10. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 10 Security & Privacy Cycle Implement Tasks for Security Document Plan Verify Benchmarks Verify contingencies are available and ready Initiate changes Test initial success Complete documentation

11. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 11 Security & Privacy Cycle Report for Security Review with end users Report availability of system Initiate any additional training Identify and report breaches

12. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 12 Security & Privacy References References Used: http://www.HIPAAdvisory.com http://aspe.hhs.gov/ http://www.nema.org/medical/spc http://snip.wedi.org http://www.sans.org

13. Energize Your Workflow! www.merge-emed.com ©2006 Merge eMed. All Rights Reserved. 2006 User Group Meeting “Energize Your Workflow” May 7-9, 2006 13 Security & Privacy Albert Allen Klumpp Email: aklumpp@merge-efilm.comaklumpp@merge-efilm.com Phone: 1-414-977-4000 Location: Milwaukee