Compliance to HIPAA, DPA, FDCPA, CFR 11

Introduction

Organizations are required to keep pace with established as well as emerging standards and laws that are finding acceptance universally. Non-compliance can make enterprises face the danger of eroding customer trust, while losing business to the competitors who have already complied.

Sify’s compliance services assist organizations to comply with various Acts, which are enacted in the USA or Europe. Many of these Acts are applicable to organizations operating for the clients in a particular country and also in a particular service sector.

HIPAA

Passed in 1996, the Health Insurance Portability and Accountability Act (HIPAA) is designed to protect confidential healthcare information through improved security standards and federal privacy legislation. It specifies requirements for storing patient information before, during and after electronic transmission. It also identifies compliance guidelines for critical business tasks such as risk analysis, awareness training, audit trail, disaster recovery plans, information access control and data encryption.

The security standards in HIPAA are spread across three areas, Viz.

Administrative safeguards

This deals with documented policies and procedures, managing EPHI, conduct of employees, etc.

Physical safeguards and

This deals with safeguarding organization's electronic information systems including workstations, facility access control, device and media controls, etc.

Technical safeguards

This deals with technical access controls, audit controls, integrity of health information, user authentication, etc.

DPA, FDCPA, CFR 11

The Data Protection Act 1998 (DPA) came into force on 1 March 2000. DPA governs the use of personal information through the eight data protection principles. The act regulates how personal information about living, identified or identifiable individuals is used and requires organizations to comply with the data protection principles.

The federal Fair Debt Collection Practices Act (FDCPA) was enacted in 1977 to protect consumers from unfair and abusive collection practices. The objective of FDCPA is to eliminate abusive debt collection practices by debt collectors, to insure that those debt collectors who refrain from using abusive debt collection practices are not competitively disadvantaged, and to promote consistent State action to protect consumers against debt collection abuses.

The US FDA issued Title 21 of the Code of Federal Regulations (CFR 11) in 1997, to monitor industries that produce pharmaceuticals, medical supplies and devices, food and beverages, and personal care products. CFR 11 defines requirements for submitting electronic records and criteria for using electronic signatures. It covers how the records shall be produced to be deemed trustworthy and how electronic signatures shall be applied to make the FDA consider them equivalent to full handwritten signatures. Topics such as controls, security, audit trail are covered by the regulation.

Why Sify?

Sify specializes in providing guidance to any organization, which intends to comply with HIPAA, DPA, FDCPA or CFR 11.

Sify Assure's Compliance Consulting team possesses required knowledge, skill and expertise to guide and assist any organization in any part of the world for smooth compliance with the above regulations.