Quick Feedback Request
Highlighted Resources & Events
Need Assistance?
Would you like more assistance regarding Privacy and Security strategies or support in using any of the included resource sets?

  Request Support

 

Upcoming Events
The Quadruple Aim
Quadruple Aim

A Conceptual Framework

Improving the U.S. health care system requires four aims: improving the experience of care, improving the health of populations, reducing per capita costs and improving care team well-being. HITEQ Center resources seek to provide content and direction aligned with the goals of the Quadruple Aim

Learn More

Resource Overview

The Office for Civil Right's new HIPAA random audit program is in effect and significantly increases enforcement procedures following breaches, Health Centers need to ensure that their organization is fully complying with HIPAA regulations while at the same time providing systems that meet modern health information sharing and communication requirements that allow for increaseed continuity of care.  

Health Centers will need the right privacy protections for health information, and the necessary documented policies and procedures per HIPAA regulations, as well as documentation of actions taken per the policies of their organization. The resources in this section provide best practices, strategies and templates for better understanding nuances of HIPAA regulations and how they pertain to a Health Center's specific setting.

HIPAA Resources

Creating and Managing Strong Passwords at Your Health Center
HITEQ Center
/ Categories: Privacy and Security, Privacy & Security Best Practices, HIPAA, Security Risk Analysis

Creating and Managing Strong Passwords at Your Health Center

Guidance in relation to updated NIST security requirements and HIPAA

Question: Is it acceptable/recommended for health centers to adopt the new password policy guidelines under NIST Special Publication 800-63B and will that still uphold the HIPAA security rule?

This question had been posed to the HITEQ Center asking whether we had any guidance or recommendations on implementing the new NIST Guidelines regarding password security.  New Digital Identity Guidelines under NIST Special Publication 800-63-B presents new guidelines regarding password security that are much more user-friendly and consequently more likely to be observed by health center staff since constantly changing, complex password on multiple systems can be a source of frustration for the end user. 

After consulting with HITEQ cybersecurity experts and consultants who have helped publish cybersecurity guidelines, the recommendations outlined below were communicated.

Answer: The short answer is Yes. HIPAA is not prescriptive and takes the general stance that authentication mechanisms should be “reasonable and appropriate” for the risk they present. Being able to say that you are implementing NIST Standards is a good way to show that you are implementing “reasonable and appropriate” controls.

Some standards are relaxed in regards to password change and complexity, those items shouldn’t be taken in isolation. The additional controls in the 800-63 recommendations should also be put in place and can include:

  • Having users check passwords against password lists from breaches (e.g., https://haveibeenpwned.com/Passwords )
  • Increasing the length requirements
  • Getting rid of password reminder questions
  • Increasing usability

Further Guidance from NCCIC/US-CERT: NCCIC/US-CERT reminds users of the importance of creating and managing strong passwords. Passwords are often the only barrier between you and your personal information. There are several programs attackers can use to help guess or "crack" passwords. However, choosing strong passwords and keeping them confidential can make it more difficult for others to access your information.

NCCIC/US-CERT recommends users take the following actions:

  • Use multi-factor authentication when available.
  • Use different passwords on different systems and accounts.
  • Don't use passwords that are based on personal information that can be easily accessed or guessed.
  • Use the longest password or passphrase permissible by each password system.
  • Don't use words that can be found in any dictionary of any language.
  • Refer to Tips on Choosing and Protecting Passwords and Supplementing Passwords for best practices and additional information.
Previous Article The Health Center CIO’s Guide to HIPAA Compliant Text Messaging
Next Article Substance Abuse Confidentiality Regulations - 42 CFR Part 2
Print
44732
Tags: HIPAANISTcybersecuritysecure messagingpasswordspassword policyauthenticationsecurity measurescybersecurity defender
Intended AudienceCIO's, Privacy & Security Staff, health center staff

Resource Links

Related Resources

Leave a comment

Add comment

Acknowledgements

This resource collection was cultivated and developed by the HITEQ team with valuable suggestions and contributions from HITEQ Project collaborators.

Looking for something different or have something you think could assist?

HITEQ works to provide top quality resources, but know your needs can be specific. If you are just not finding the right resource or have a highly explicit need then please use the Request a Resource button below so that we can try to better understand your requirements.

If on the other hand you know of a great resource already or have one that you have developed then please get in touch with us by clicking on the Share a Resource button below. We are always on the hunt for tools that can better server Health Centers.

Request a Resource  Share a Resource