Project Brief

The theft of a USB drive potentially containing health information regulated by HIPAA (the Health Insurance Portability and Accountability Act of 1996) was the genesis of a stringent information security Corrective Action Plan required by the U.S. Department of Justice of the Alaska Department of Health and Social Services. The Department responded with a comprehensive, multi-pronged approach developed to meet and exceed the CAP requirements.

Wostmann, through its extensive network of subcontractors, provided a security consultant to guide the Department to compliance with the CAP. Wostmann advised the Department on the robust policies and procedures needed for compliance with HIPAA and the CAP, prepared a timeline for meeting CAP obligations, and provided advice on HIPAA security training and recommendations on handling of security incident investigations. Wostmann assisted with eliminating orphaned machines not regularly connected or updated via the network. Perhaps most importantly, Wostmann served as an independent external monitor as required by the CAP, reporting results of the ongoing compliance efforts directly to the U.S. Department of Health and Human Services.