Understanding HIPAA Security Implications Of a Wireless LAN Subsystem Using the ISO/IEC 17799 ISMS Standard

This paper describes the initial development of an Information Security Management System (ISMS) that will address possible regulatory issues of using Wireless LANs in an assisted living / extended care facility (EcFac1). The company has started a major expansion program and will be significantly increasing their reliance on information management systems. The Company does not have a formalized security management system in place and intends to develop one as it rolls out its new information technology (IT) infrastructure as a part of its expansion plans. Due to the nature of their operation (patient healthcare) security is an overdriving force as they develop their new IT capabilities. Current privacy concerns and regulatory affairs such as the Health Insurance Portability and Accountability Act2 (HIPAA) [1], mandate their attention to security issues required to maintain the safeguarding of patient electronic Protected Health Information (e-PHI). The development of their ISMS under a recognized framework such as ISO 17799 is a natural process to follow.