mHealth & Multi-Compliance

June 20, 2012
61 Views

Last week, Eric Wicklund, Editor of mHIMSS.org reported on new tools for physicians and patients to support payment processing and the ability to check insurance eligibility while using an iPad, iPhone or iPod Touch.

These tools must, by nature of their industry and function, satisfy both PCI DSS (Payment Card Industry Data Security Standard) compliance (to accept credit card payments) and HIPAA (Health Insurance Portability and Accountability Act) compliance (to protect personally identifiable and patient health information).

Last week, Eric Wicklund, Editor of mHIMSS.org reported on new tools for physicians and patients to support payment processing and the ability to check insurance eligibility while using an iPad, iPhone or iPod Touch.

These tools must, by nature of their industry and function, satisfy both PCI DSS (Payment Card Industry Data Security Standard) compliance (to accept credit card payments) and HIPAA (Health Insurance Portability and Accountability Act) compliance (to protect personally identifiable and patient health information).

The company that developed these tools is drchrono, a California-based company known initially for developing an electronic health record (EHR) system for the iPad. This new realm of mobile devices and the need for multi-compliance is an emerging trend that requires a layered security approach to meet each standard.

This particular tool works in conjunction with another company’s tool, called Square. The actual device is a card reader that, once plugged into a mobile device audio jack, allows credit card data to be collected with a mere swipe. The transaction goes directly to the physician’s or practice’s bank account, and is updated in their practice management system. Physicians can also check health insurance eligibility in real-time using the tool.

What does this mean for service providers previously supporting e-commerce and healthcare industries separately? No longer can hosting providers only offer proof of their PCI DSS audit and report on compliance if they intend to support healthcare and mobile healthcare apps. An independent HIPAA audit and report on compliance is recommended to determine which standards are within the scope of a provider’s service.

Conversely, the rare few providers that have been initially more healthcare-focused must realize certain technology and security standards that are only best practice or highly recommended for HIPAA, are, in fact, explicitly required by PCI.

For example, two-factor authentication is an additional, enhanced security measure that a covered entity (physician or other healthcare provider) can use to ensure only authorized persons can access sensitive information. But for PCI compliance, it is specifically stated in requirement 8.3:

Incorporate two-factor authentication for remote access (network-level access originating from outside the network) to the network by employees, administrators, and third parties.

File integrity monitoring (FIM) is another security method that monitors and sends alerts when a few key file changes occur within a system, such as change of ownership, security settings or configuration values. While recommended to help protect healthcare data, it is required by PCI under the 10.5.5 sub-requirement stating,

Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

As well as the 11.5 clause that requires:

Deploy file integrity monitoring tools to alert personnel to unauthorized modification of critical system files, configuration files or content files. Configure the software to perform critical file comparisons at least weekly.

 

You may be interested

Healthcare Tech Advances That All Clinics Should Use
Medical Devices
461 views
Medical Devices
461 views

Healthcare Tech Advances That All Clinics Should Use

Dennis Hung - August 12, 2017

Healthcare will always be important to employees and the government since the issues surrounding healthcare are inherently ethical and moral…

Balancing Smart Data With Cybersecurity for Hospitals
Hospital Administration
453 views
Hospital Administration
453 views

Balancing Smart Data With Cybersecurity for Hospitals

Kayla Matthews - August 11, 2017

It should come as no surprise that your discussions and interactions with physicians and health professionals influence diagnoses, prescriptions, visit…

4 Ways to Halt Testosterone Problems After 40
Wellness
469 views
Wellness
469 views

4 Ways to Halt Testosterone Problems After 40

JohnHenning - August 10, 2017

Among men of all ages, testosterone is an important hormone for regulating health. Men over the age of 65 tend…