Case Study 2: HIPAA and IT Audits
Due Week 7 and worth 125 points
Imagine you are the Information Security Officer at a medium-sized hospital chain. The
CEO and the other senior leadership of the company want to ensure that all of their
hospitals are and remain HIPAA compliant. They are concerned about the HIPAA
Security and Privacy Rules and its impact on the organization. You begin looking at the
information provided by the Department of Health and Human Services, located
at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html. Specifically, you are asked to
provide an analysis of two (2) of the cases found here with emphasis on what was done
to resolve the compliance issues.
Section 1. Written Paper
Non-compliance with HIPAA regulations can result in significant fines and negative
publicity. To help ensure that your organization remains in compliance with HIPAA
regulations you have been asked to write a three to five (3-5) page paper in which you:
1a. Create an overview of the HIPAA Security Rule and Privacy Rule.
1b. Analyze the major types of incidents and breaches that occur based on the
1c. Analyze the technical controls and the non-technical controls that are needed
to mitigate the identified risks and vulnerabilities.
1d. Analyze and describe the network architecture that is needed within an
organization, including a medium-sized hospital, in order to be compliant with
1e. Analyze how a hospital is similar to and different from other organizations in
regards to HIPAA compliance.
1f. List the IT audit steps that need to be included in the organization’s overall IT
audit plan to ensure compliance with HIPAA rules and regulations.
1g. Use at least three (3) quality resources in this assignment. Note: Wikipedia
and similar Websites do not qualify as quality resources.
Your assignment must follow these formatting requirements:
Be typed, double spaced, using Times New Roman font (size 12), with one-inch
margins on all sides; citations and references must follow APA or school-specific format.
Check with your professor for any additional instructions.
Include a cover page containing the title of the assignment, the student’s name, the
professor’s name, the course title, and the date. The cover page and the reference page
are not included in the required assignment page length.
Section 2. Network Architecture
2a. Create a network architecture diagram (using Visio or an open-source
equivalent to Visio for creating diagrams), based on the description of the network
architecture that you defined above for the organization to be compliant with HIPAA
2b. Include in the diagram the switches, routers, firewalls, IDS / IPS, and any
other devices needed for a compliant network architecture.