5.1

HIPAA (Healthcare Insurance Portability and Accountability Act) Policy
The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the Congress of the United
States of America. HIPAA includes a Privacy Rule regulating the use and disclosure of protected health
information (PHI), a Security Rule defining security safeguards required for electronic protected health
information (ePHI), and an Enforcement Rule that defines procedures for violation investigations and penalties
for confirmed violations.
PHI is defined as individually identifiable health information that is transmitted or maintained in any form or
medium (electronic, oral, or paper) by a covered entity or its business associates, excluding certain educational
and employment records. Individually identifiable means the identity of the subject is or may readily be
ascertained by the investigator or associated with the information.
This policy is designed to detect electronic PHI, which contains a personal health number in addition to health-
related terminology. Some false negatives may occur since combinations of personally identifiable information,
such as name and address, would not be considered as ePHI with this policy. Internal research indicates that
the majority of health communication will contain a personal health number in addition to health-related
terminology.
Idaho SB-1374 Policy
Idaho SB-1374 is a state data privacy law which protects personally identifiable information. Idaho SB-1374
was signed into law March 30, 2006 and became effective July 1, 2006. The law applies to any agency, individual,
or commercial entity that conducts business in Idaho and owns or licenses unencrypted computerized data
that includes personally identifiable information about a resident of Idaho.
The policy looks for at least one match to personally identifiable information, which may include:
n
Credit Card Number
n
Credit Card Track Data
n
US Drivers License Number
n
US Social Security Number
Illinois SB-1633
Illinois SB-1633 is a state data privacy law which protects personally identifiable information. Illinois SB-1633
was signed into law June 16, 2005 and became effective June 27, 2006.
The law applies to any data collector, which includes, but is not limited to, government agencies, public and
private universities, privately and publicly held corporations, financial institutions, retail operators, and any
other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personally
identifiable information that owns or licenses personally identifiable information concerning an Illinois
resident.
The policy looks for at least one match to personally identifiable information, which may include:
n
Credit Card Number
n
Credit Card Track Data
n
US Drivers License Number
n
US Social Security Number
Chapter 15 vShield Data Security Management
VMware, Inc. 189