Rebecca Herold: Use the Right Encryption

Choosing the right form of encryption is essential when attempting to comply with the HITECH Act, says consultant Rebecca Herold. In an interview, Herold: Stresses that healthcare organizations can gain an exemption from the HITECH requirement to report data breaches only if they use specific NIST-approved minimum encryption standards. She points out that many encryption programs fall short of that standard. Notes that many hospitals simply "scramble" data on their own, thinking it will meet the HITECH breach notification "safe harbor" requirement for encryption, when it does not. Urges all healthcare organizations to formally document and assign responsibility for information security and privacy, and then communicate all policies to the entire staff. Stresses the cost-effectiveness of security safeguards. "It is much less expensive to implement safeguards than it is to pay for the expenses of incidents and privacy breaches after the fact." Herold, owner of Rebecca Herold & Associates, is known as the Privacy Professor. For more than two decades, she has specialized in information security privacy, security and compliance. She has served as an adviser to organizations in a number of industries, including healthcare.