HITECH Breach Notifications - NIST Required or Safe Harbor?

[Chris Kidd <chris.kidd () UTAH EDU>]

A question about the HITECH encryption standard for the breach notification requirements: Do you view NIST/FIPS 
standards/certifications as a requirement to meet the HITECH encryption requirements or is NIST just a safe harbor, and 
other similar technological standards would also meet with the HITECH standards?  Another way of asking the same 
question is whether compliance with the encryption standards in the HIPAA security rule equates with compliance under 
HITECH.  We have looked at the guidance on this and it's hard to tell if NIST is the only relevant standard or just a 
safe harbor.

Thanks,
Chris Kidd



Chris Kidd
650 Komas Drive, Suite 102
Salt Lake City, UT 84108
Office: 801.587.9241
Cell: 801.747.9028
chris.kidd () utah edu

http://www.secureit.utah.edu