CSOL 540 – Module 6 / Jon Boucher Assignment 6 (Privacy Policy)

The purpose of this white paper is to explain the data handling privacy policy for HIC by

highlighting three unique privacy domains. Each privacy domain is configured with certain

controls and governed by polices that adhere to specific laws and regulations. While each

privacy domain is unique, they are all hosted within the same HIC security domain. In our

network environment, a security domain is defined as the set of physical and logical resources

such as routers, file servers, FTP service, web servers, email servers, etc. (Harris, 2016)

We have one security domain which hosts four different privacy domains. The privacy

domains use virtual machines, thus providing a segmented environment. Before defining each

privacy domain, it is important to understand the applicable privacy legislation. HIC’s status as a

California based healthcare provider requires compliance with specific federal and state privacy

regulations.

[A] Electronic Communications Privacy Act of 1986 – This piece of federal legislation

prohibits unauthorized and intentional interception of wire, oral, and electronic communications

during transmission and accessing that stored wire of electronic information. (Judy, 2014)

[B] The Health Insurance Portability and Protection Act (HIPPA) Privacy Rule -

Establishes a federal regulatory requirement for safeguarding privacy of protected health

information (PHI) in multiple forms, such as paper or electronic by “covered entities.” The term

covered entities refers to organizations that might handle PHI such as health insurance carriers,

providers, billing clearinghouses and business associates/contractors. (Brusil, 2014)

[C] California Confidentiality of Medical Information Act (CMIA) - CMIA’s primary

purpose is to protect an individual’s medical information, in electronic or paper format, from

unauthorized disclosure. (Privacy Rights Clearinghouse, 2017)

CSOL 540 – Module 6 / Jon Boucher Assignment 6 (Privacy Policy)

[D] California Security Breach Information Act (SB 1386) - California state law requires our

organization maintain personal information about individuals to inform those individuals if the

security of their information is compromised. The Act stipulates that if there's a security breach

of a database containing personal data, the responsible organization must notify each individual

for whom it maintained information. (Rouse, 2018)

Privacy Domain Information Privacy Authority to Who has access

to be laws (see grant/revoke
protected / above for access
security legend)
objective
Electronic Health Patient [A], [B], IT System Medical caregivers
Records and PHI Confidential [C] and Administrator (Physicians, nurses,
(PHI) / [D] Manager for surgeons, physical
Confidentiality ePHI therapists, etc.) and
and Integrity employees charged
of Data with handling any
PHI.
Internet facing public Unclassified [A] IT System The public and all
website corporate data Administrators employees.
/ Integrity of with approval
Data from Strategic
Communications
Department
Corporate network Business [A], [B] IT System Designated people
(Personal Identifiable Confidential / and [D] Administrators from the following
Material) Confidentiality with approval departments:
and Integrity from Finance, Human
of Data Department Resources,
Managers Contracts, and
Legal.
Corporate network Business [A] IT System Director level and
(Business/Competition Proprietary / Administrators above, Contracts,
sensitive) Confidentiality with approval Strategic
and Integrity from Development and
of Data Department proposals.
Managers

Harris S., Maymi F (2016) All in One CISSP – Exam Guide 7th ed. New York, New York.
McGraw Hill Education.
CSOL 540 – Module 6 / Jon Boucher Assignment 6 (Privacy Policy)

Judy H. (2014). Computer Security Handbook – Privacy in Cyber Space: US and European
Perspectives. (6th ed., Vol. 1). Hoboken, NJ: Wiley. Chapter 69

Paul Brusil. (2014) Computer Security Handbook – Healthcare Security and Privacy (Chapter
71). Joh Wiley and Sons, Inc. Hoboken, New Jersey.

Privacy Rights Clearinghouse (October 2017) – “Health and Medical Privacy Laws (California
Medical Privacy Series”. Retrieved on 25 March 2017 from:
https://www.privacyrights.org/consumer-guides/health-and-medical-privacy-laws-california-
medical-privacy-series

Rouse M. (2018) Tech Target - California Security Breach Information Act (SB-1386).
Retrieved on 21 April 2018 from: https://searchcio.techtarget.com/definition/California-Security-
Breach-Information-Act