Healthcare Rules Regulations CSFs and Standards

HIPAA:

Security Rule
https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C
Breach Notification Rule
https://www.law.cornell.edu/cfr/text/45/part-164/subpart-D
Privacy Rule
https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E

HHS Office of Civil Rights

This one is scary. It is a list of over 1700 audit items the OCR uses when it performs and audit. I have cleaned up their content and provided a link to the original data on this page.

Cybersecurity Frameworks:

Center for Internet Security (CIS)
https://www.cisecurity.org/controls
NIST
https://www.nist.gov/cyberframework
HITRUST - This is for larger orgs and is not cost effective or appropriate for small private practices
https://hitrustalliance.net/hitrust-csf/
ISO 27001 ISMS
https://www.iso.org/isoiec-27001-information-security.html

General Business Regulations:

FTC Gramm-Leach-Bliley Act (GLBA)
https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act

This link provides a great summary of the scope of GLBA and guidance if it may apply to your business:
https://www.csoonline.com/article/3598568/glba-explained-what-the-graham-leach-bailey-act-means-for-privacy-and-it-security.html
Texas Identity Theft Enforcement and Protection Act (TITEPA)
https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm

If you use fingerprint readers, iris scanners, voice prints, hand or face geometry this is relevant to you.
https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm

390.2(a)(4)(A)(i) – Cancer
- Texas Health & Safety Code § 82.008-009
390.2(a)(4)(A)(ii) – HIV/AIDs
- Texas Health & Safety Code § 81.103
- 40 Texas Administrative Code § 8.288
390.2(a)(4)(A)(iii) – Genetic
390.2(a)(4)(A)(iv) – Sexual Assault
- Texas Government Code Chapter 420, Subchapter D
390.2(a)(4)(A)(v) – Communicable Diseases
- Section 81.046, Texas Health and Safety Code
- 25 Tex. Admin. Code Section 97.10
390.2(a)(4)(A)(vi) – Mental Health
390.2(a)(4)(A)(vii) – Substance Abuse/Disorder
390.2(a)(4)(A)(viii) – Immunizations
- Texas Health & Safety Code § 161.0073
- 25 Texas Administrative Code § 100.2
390.2(a)(4)(A)(ix) – Bureau of Vital Statistics
390.2(a)(4)(A)(x) – Reports of Abuse or Neglect
390.2(a)(4)(A)(xi) – Federal Tax Information
- 26 Code of Federal Regulations (CFR) § 6103(a-1)
- 26 CFR § 6103(e)
390.2(a)(4)(A)(xii) – Social Security Administration Data
- 42 United States Code § 1306
- 20 Code of Federal Regulations (CFR) § 401
390.2(a)(4)(A)(xiii) – Occupational Diseases
- Texas Health & Safety Code § 84.006
- 25 Texas Administrative Code § 99.1(d-f)
390.2(a)(4)(A)(xiv) – Family Planning
- 1 Texas Administrative Code (TAC) § 382.25
- 1 TAC § 382.125
390.2(a)(4)(A)(xv) – Government Benefits

390.2(a)(4)(B)(i) – Hospitals
- Texas Health & Safety Code (TH&SC) § 241.152-.155
- 25 Texas Administrative Code (TAC) § 133.42(a)(1)(H-I)
390.2(a)(4)(B)(ii) – Nursing Facilities
- Texas Health & Safety Code § 242.501(a)(8)
- 40 Texas Administrative Code § 19.407(2-3)
390.2(a)(4)(B)(iii) – ICF/IID
- Texas Health & Safety Code § 252.126
390.2(a)(4)(B)(iv) – Freestanding Emergency Medical Care Facilities
- 25 Texas Administrative Code (TAC) § 131.53(d-f)
- 25 TAC § 131.53(i)
390.2(a)(4)(B)(v) – Ambulatory Surgical Centers
- 25 Texas Administrative Code (TAC) § 135.5(c)
390.2(a)(4)(B)(vi) – Emergency Medical Services
390.2(a)(4)(B)(vii) – Physicians
390.2(a)(4)(B)(viii) – Chiropractors
- Texas Occupations Code (TOC) § 201.402-.404
- TOC § 201.405(f)
390.2(a)(4)(B)(ix) – Dentists
- Texas Occupations Code (TOC) § 258.051(b)
- TOC § 258.0511(a-b)
390.2(a)(4)(B)(x) – Labs
390.2(a)(4)(B)(xi) – Pharmacists
- Texas Occupations Code § 562.052
390.2(a)(4)(B)(xii) – Podiatrists
- Texas Occupations Code § 202.402-.407
390.2(a)(4)(B)(xiii) – PHR Vendors
- 16 Code of Federal Regulations (CFR) § 318.3(a-c)
- 16 CFR § 318.4-.6
390.2(a)(4)(B)(xiv) – End Stage Renal Disease Facilities
- 25 Texas Administrative Code § 117.42(2)
390.2(a)(4)(B)(xv) – Special Care Facilities
- 25 Texas Administrative Code (TAC) § 125.33(a)(4)
390.2(a)(4)(B)(xvi) – Private Psychiatric Hospitals & Crisis Stabilization Units
- 25 Texas Administrative Code (TAC) § 134.41(g)(6-7)
390.2(a)(4)(B)(xvii) – Birthing Centers
390.2(a)(4)(B)(xviii) – Applicable Health Professions
- 390.2(a)(4)(B)(xviii)(I) – Licensed Chemical Dependency Counselors & Treatment Facilities
- 390.2(a)(4)(B)(xviii)(II) – Medical Radiologic Technologists
  - 25 Tex. Admin. Code § 140.514
- 390.2(a)(4)(B)(xviii)(III) – Dyslexia Therapists & Dyslexia Practitioners
  - 25 Tex. Admin. Code § 120.90
- 390.2(a)(4)(B)(xviii)(IV) – Promoters of Community Health Workers
  - 25 Tex. Admin. Code § 146.7

390.2(a)(4)(C)(i) – Minors
390.2(a)(4)(C)(ii) – Children with Special Care Needs
- 25 Tex. Admin. Code § 38.5
390.2(a)(4)(C)(iii) – Early & Periodic Screening, Diagnosis, & Treatment
- 25 Tex. Admin. Code § 33.30