Privacy and security certification program launched in Texas
The Texas Health Services Authority (THSA) and the Health Information Trust Alliance (HITRUST) announced a partnership to develop and implement the Texas Covered Entity Privacy and Security Certification Program, according to a joint announcement.
Texas is the first state to develop such a formal certification program, which incorporates state and federal privacy and security regulations. The program stems from the 2011 passage of the Texas House Bill 300, which amended the Texas Medical Records Privacy Act and builds upon the HITECH Act to include additional protection requirements. The bill specifies state-level administrative penalties and legal liability for health information breaches due to non-compliance.
HITRUST is the sole recipient of a contract to provide certification recommendation and related services to the THSA in support of HB 300, according to the announcement.
To obtain a Texas certification recommendation from HITRUST, covered entities must undergo an assessment conducted by a HITRUST Common Security Framework (CSF) assessor organization against the controls specified in the HITRUST CSF. However, smaller entities will be able to request a certification recommendation through HITRUST by conducting a remote assessment.
“[The] program’s impact will likely be felt far beyond the state of Texas because Texas certification requires compliance with the HIPAA Privacy and Security Rules, which means that organizations must implement reasonable safeguards appropriate to their organization to ensure sensitive health information is adequately protected. The Texas Covered Entity Privacy and Security Certification Program will help define what is ‘reasonable,’ ‘appropriate’ and ‘adequate’ for not only Texas, but for healthcare organizations across the country,” said Bryan Cline, MD, vice president, CSF development, HITRUST, in a statement.
More information on the Texas Covered Entity Privacy and Security Certification Program can be found here.