ISO/HIPPA Development & Analysis
An NSA ISO/HIPPA Development compliance program provides
structured methodology designed to help companies build
comprehensive and cost effective enterprise security programs,
ensuring that security resources are applied wisely, and efforts
are focused on activities that will reduce real business risk.
NSA's ISO/HIPPA Developmentservices provide a risk based
approach to help organizations comply with the HIPAA Privacy and
Security Rules. An NSA risk assessment and HIPAA/HITECH along with
an ISO verification gap analysis will:
- Establish a model for the adoption of an annual security risk
management program,
- Identify gaps in your security controls designed to protect
ePHI,
- Provide a Roadmap to Security and Compliance (RSC) or a
Corrective Action Plan (CAP) to correct deficiencies,
- Enable healthcare executives to develop budgets to support
implementation of the CAP and instill a mindset for continuously
monitoring security and compliance, and provide the services of a
Solutions Architect to guide the implementation of the plan.
HIPAA Compliance Program
The Health Insurance Portability and Accountability Act of 1996
(HIPAA) requires covered entities to comply with what is commonly
known as the Privacy Rule and the Security Rule.
NSA's HIPAA Compliance Program includes services to help our
clients expeditiously and cost effectively progress through the
entire compliance life-cycle and address the requirements published
by the Department of Health and Human Services. Specifically, NSA
assists its clients in preparing for the required ongoing HIPAA
reviews, conducting the reviews in a collegial, rather than
adversarial manner, documenting compliance with the rules, and
providing a HIPAA Compliance Statement that describes the scope of
HIPAA compliance activities and level of compliance
achieved.HIPAAreviews cover:
- Administrative safeguards
- Physical safeguards
- Technical safeguards
- Organizational requirements
- Policies, procedures, and documentation requirement
ISO Compliance Program
For years, organizations have been searching for an objective
benchmark to measure the security of potential business partners
and to distinguish the quality of their own services. ISO is an
international standard that defines an overarching security
framework consisting of 135 specific controls organized around 36
control objectives. This balanced framework serves as the basis for
both measuring an organization's effectiveness in addressing risk
and structuring an organization's overall security program. Because
ISO requirements are largely a superset of other major regulations,
achieving ISO compliance positions most organizations to be well on
their way to meeting the requirements of Sarbanes Oxley,
Gramm-Leach-Bliley, HIPAA, and other pertinent regulations.
NSA's ISO Compliance Program provides the following:
- Encourages organizations to develop a security program that
integrates business and technology
- Helps to identify and prioritize specific tasks to improve
security and achieve compliance
- Focuses on activities that reduce real business risk
- Positions companies to meet the security requirements of
Sarbanes Oxley, Gramm-Leach-Bliley, HIPAA, and other pertinent
regulations
- Improves cross-functional (e.g. Legal, HR, lines of business)
cooperation on security matters
- Identifies deficiencies in security areas that are often
overlooked
- Encourages organizations to develop a balanced view of security
that includes secure business processes, well designed policies,
and appropriate use of technology
- Communicates to prospective customers, business partners, board
members, employees, and regulators that the organization has a
comprehensive security program in place
PCI Compliance Program
NSA is a Qualified Security Assessor Company (QSAC) and its
staff members are recognized as Qualified Security Assessors by the
Payment Card Industry (PCI) Security Standards Council. The PCI
Security Standards Council's QSA qualification requirements are
exacting and detailed, involving both the security company and
individual employees. The organization was founded by American
Express, Discover Financial Services, JCB, MasterCard Worldwide,
and Visa International to enhance payment account data security.
NSA's PCI Compliance Program includes services to help our clients
expeditiously and cost effectively progress through the entire
compliance life-cycle. These services include:
- Helping our clients to understand the PCI Data Security
Standard compliance requirements as it applies specifically to
their business
- Assisting Level 2-4 merchants prepare for and complete the
Annual Self Assessment Questionnaire
- Working with acquirers to determine specific merchant
requirements
- Assisting Level 1 merchants and Service Providers prepare for
the PCI DSS annual on site review
- Conducting annual on site reviews
- Recommending practical measures to address any compliance
deficiencies
- Assisting in remediation efforts
|
