Slashdot Mirror

← Back to Stories (view on slashdot.org)

Using Encryption Garners Exemption For Data Breach Notification

Posted by timothy on from the keep-your-breeches-on dept.

Combat Wombat writes with this excerpt from the Register: "New data breach rules for US healthcare providers have come under criticism from a security firm that specialises in encryption. As part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, which comes into effect from 23 September, health organisations in the US that use encryption will no longer be obliged to notify clients of breaches."

11 of 101 comments (clear)

  1. XOR! by DarkFencer · · Score: 4, Interesting

    So all they have to do is 'encrypt' it? XOR here we come!

    Seriously - is there any guide to what TYPES of encryption are covered under this? Otherwise its inane.

    1. Re:XOR! by Pieroxy · · Score: 5, Interesting

      In any case, you need a key to decrypt your data. If the guy that broke in got the key along with the data, no amount of cryptography is going to help. Usually, from experience, the key is very often to close to the data.

      In a company I worked for, we had to set up a bridge between two web apps. We chose an SSO-like solution who worked well on the paper, but the devil is on the details. The guys on the other application decided to encrypt the SSO key in JavaScript on the client.... So the key ended up in clear text in the source of the page!

      Oh well....

      --
      Write boring code, not shiny code!
    2. Re:XOR! by selven · · Score: 4, Funny

      I tried that and now my data is all 1s. Thanks a lot!

    3. Re:XOR! by Anonymous Coward · · Score: 4, Insightful

      and I don't either. It's the key management that is the weak point. 10-to-1 the people who claim exemptions under this rule will lose a laptop in the same bag as the usb key that decrypts the whole mess...

  2. Re:great by AliasMarlowe · · Score: 4, Funny

    If the provider uses rot13, they can consider that good enough

    But they're already using rot0. Isn't that good enough?

    --
    Those who can make you believe absurdities can make you commit atrocities. - Voltaire
  3. Encryption methodology is defined by sthomas · · Score: 5, Informative

    The method of encryption is defined in the law, adopts the standards set forth by the NIST, and there is a mechanism to update what is acceptable annually through published Guidances. This law is an improvement over what was previously in place. Read the HIPAA Security and Privacy rules as last updated in 2005, and then look at the major steps forward HITECH makes.

    That future Guidances can update standards without having to send a law through Congress is also going to allow for future improvements in security, too. HITECH was part of the economic recovery act (ARRA), which shows how difficult it was for HIPAA to get updates - this had to be tacked onto an unrelated must-pass bill.

    This article is from an encryption vendor who is stating that most encryption products are what he calls "point-to-point" encryption I bet he considers his own product to not be, thus it is superior, and thus HIPAA should require all companies to buy his products.

    For those of you who think "encryption" is left up to the governed:

    The HHS Guidance identifies four situations where paper or electronic data may be vulnerable to a breach, and suggests appropriate safeguards to secure the PHI:

                        - "Data at Rest". This is data that resides in databases, file systems, and other structured storage methods. The HHS Guidance points to the National Institute of Standards and Technology Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices as the approved methodology.
                        - "Data in Motion". This is data that is moving through a network, including wireless transmission. The HHS Guidance points to specific requirements in Federal Information Processing Standards (FIPS) 140-2 which include, as appropriate, standards described in NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, and may include others which are FIPS 140-2 validated.
                        - "Data Disposed". This is discarded paper records or recycled electronic media. The electronic media must have been cleared, purged, or destroyed consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization, such that the PHI cannot be retrieved. For discarded paper records, PHI would need to be shredded or destroyed in a manner that precludes reconstruction.
                        - "Data in Useâ. This is data in the process of being created, retrieved, updated or deleted. The encryption and destruction processes described above, along with the general HIPAA safeguards, will apply to all data in use.
     

    1. Re:Encryption methodology is defined by sthomas · · Score: 4, Informative

      There's an excellent overview by a law firm here:

      http://www.faegre.com/showarticle.aspx?Show=8969

      "Previously, covered entities were obligated to mitigate harm caused by unauthorized disclosures of protected health information, but not required to give notice to the individuals whose information was inappropriately disclosed. Going forward, covered entities and business associates will be required to notify individuals when security breaches occur with respect to "unsecured" information. Unsecured information means information not protected through technology or methods designated by the federal government. In addition, if the breach involves 500 or more individuals, notice to the federal Department of Health and Human Services and the media is also required."

  4. The actual document by belthize · · Score: 5, Informative

    The actual document is here:
    http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/federalregisterbreachrfi.pdf

    I started to post several derogatory comments as I read through it but eventually I came to the conclusion that while nearly unfathomable to most readers it doesn't completely suck.

    In several cases they specifically ask for comment from the public where they think there may be valid concern and I think they accurately identified the weak links where they requested comment. If you have an opinion you might consider posting it there rather than (or in addition to) here.

    They do actually address reporting breaches of encrypted data where that encryption could arguably have been broken or circumvented.

    I don't quite understand the logic of not simply reporting any breach but it's hardly the disaster it's being made out to be.

    1. Re:The actual document by fluffy99 · · Score: 5, Insightful

      Congratulations, you're one of the few people that read the article or the document itself. My take on this is that if end-end encryption was used, meaning the actual files lost were still securely encrypted and the keys were not compromised, then the data owner does not have to report it as compromised data. Sounds reasonable to me.

      The ACT is also a huge motivator for these agencies to implement encryption in a secure manner, thereby avoiding the whole mess that happens every time a laptop gets stolen and they don't know what files were actually on it.

  5. Re:Dream job by MurphyZero · · Score: 4, Funny

    I just know I don't want to be in charge of the Fully User Capable Key Encryption Device program.

    --
    Our founding fathers removed the guys in charge. Be American. Vote incumbents out.
  6. Re:Who is advising these guys? by pushing-robot · · Score: 4, Funny

    No I can't.

    --
    How can I believe you when you tell me what I don't want to hear?