CONCLUSION

There is no single security measure that will provide total security to any medical center information system. Security policies and procedures must be in place, taught and enforced. It is the security hardware that implements security policies by enforcing rules. Proper installation, configuration, use and monitoring of routers, firewalls, VPNs, Windows-based web servers, Windows-based mail servers, wireless access points and modems requires constant vigilance on the part of an IT or IS staff and the ISO. All of these pieces of hardware combined with all other security measures can help provide a secure network.

Before HIPAA-compliant systems security certification can take place, intrusion testing must be run and permission should be obtained to prevent misunderstandings and possible prosecution . Proper HIPAA Security certification will determine whether technical security controls are implemented and comply with. This certification must demonstrate and document that the networks and information systems meet HIPAA Security criteria and must consider and document accepted risks in the final accreditation process.

Lastly, security is a state of mind and an on-going process, not a project with a certain start and completion date.