• The HEALTHeWV system addresses the technical system requirement specifications that pertain to HIPAA (Health Insurance Portability and Accountability Act of 1996) policies and regulations. HIPAA also provides a broader profession-specific policies issue that needs to be addressed by everyone at the local practice level. HIPAA rules may require many health care providers and staff to make changes in operations in order to adhere to HIPAA policies. Members in all health care settings must be familiar with HIPAA and pay attention to HIPAA requirements (i.e., members in private practice, community speech and hearing clinics, hospitals, skilled nursing facilities, university clinics, rehabilitation facilities, and nursing homes).
• HEALTHeWV adheres to privacy policies in accordance with HIPAA privacy standards. The final HIPAA regulation covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions (e.g., electronic billing and funds transfers) electronically. All medical records and other individually identifiable health information held or disclosed by a covered entity in any form, whether communicated electronically, on paper, or orally, are covered. Under this final rule, patients have significant new rights to understand and control how their health information is used.
• All HEALTHeWV staff have completed HIPAA training.

HIPAA Compliance and Security Standards

• HEALTHeWV is fully compliant with HIPAA security. HEALTHeWV is hosted on Windows 2000 and 2003 Server platforms, which have received the common Criteria Certification as defined by the International Organization for Standardization (ISO). The operating systems are deployed using the vendor-specified Common Criteria Evaluated Configuration User’s Guide.
• HEALTHeWV uses Oracle for its permanent storage. Oracle has been evaluated and rated at the C2 level of trust. Class C2 is a security rating established by the U.S. National Computer Security Center (NCSC) and granted to products that pass Department of Defense (DoD) Trusted Computer System Evaluation Criteria (TCSEC) tests. A C2 rating ensures the minimum allowable levels of confidence demanded for government agencies and offices and other organizations that process classified or secure information. This solution will also support Advanced Encryption Standards (AES). HEALTHeWV is compliant with the Privacy Act of 1974, with features such as a customizable privacy act statement on all generated documents.