ITN 267 Assignment 4
Add your answer to this file and format your answers in blue font.
Answer the following to the best of your ability in complete sentences with proper spelling and grammar. Be sure to elaborate on your answers and provide support for each of your statements. Your textbook and your own knowledge are your sources for answering questions unless otherwise instructed. Recall that you must cite any sources, and it is never okay to copy from any source. Answers should be paraphrased in your own words, and you should explain your answers and support your statements. TurnItIn Plagiarism checking is run against all submissions. Your work must be below a 40% match overall and no more than 20% match per question (this is only for your answers, not the included questions). There is a draft TurnItIn submission for you to check your work before submitting. I suggest you take advantage of that.
Analyzing and Comparing GLBA and HIPAA (3e)
Introduction
In the United States, laws requiring information security and data privacy protections are created according to industry sector. That means that companies and organizations must review their business operations and the laws that apply to those operations to determine the appropriate data protection requirements, instead of just protecting all types of personally identifiable information in the same way. As you can imagine, at times, different laws might require different protections for the same types of data, which can be difficult to implement in an information technology system. (Note: If this happens to you, always apply the protection that best protects the data. You can never go wrong when you provide a higher level of security or privacy protection than what is required by law.)
There are two landmark pieces of legislation in the United States that deal with information security and data privacy protections. They are the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA).
GLBA applies to financial institutions and organizations that carry out certain types of consumer transactions. It contains privacy and information security provisions that are designed to protect consumer financial data. It applies to how financial institutions and covered organizations collect, store, and use financial records containing personally identifiable information. The U.S. Federal Trade Commission has a website that contains more information on GLBA at .
HIPAA requires covered entities, which are typically medical and health insurance providers and their associates, to protect the security and privacy of medical records. Under HIPAA covered entities must notify patients of their HIPAA rights, put in place safeguards to protect health information, and ensure that they do not improperly disclose a patient’s health information. The U.S. Department of Health and Human Services has a website that contains more information on HIPAA at.
In this lab, you will identify the similarities and differences of GLBA and HIPAA compliance laws, explain how the requirements of GLBA and HIPAA align with information systems security, identify privacy data elements for each, and describe security controls and countermeasures that support each.
Lab Overview
This lab has three parts, which should be completed in the order specified.
• In the first part of the lab, you will learn about the major provisions of the Gramm-Leach-Bliley Act (GLBA).
• In the second part of the lab, you will learn about the major provision of the Health Insurance Portability and Accountability Act (HIPAA).
• In the third part of the lab, you will compare GLBA and HIPAA.
Finally, you will complete a challenge exercise that allows you to use the skills you learned in the lab to conduct independent, unguided work – similar to what you will encounter in a real-world situation.
Learning Objectives
Upon completing this lab, you will be able to:
• Identify the main provisions of GLBA and HIPAA.
• Identify the similarities between GLBA and HIPAA compliance laws.
• Identify the differences between GLBA and HIPAA compliance laws.
Part 1: Research the Gramm-Leach-Bliley Act (GLBA)
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet. Be sure to cite all resource and it is never acceptable to copy from any source.
Conduct an internet or library search on the Gramm-Leach-Bliley Act (GLBA). Read one or two articles that you find interesting.
1. Identify the article(s) you read, including a link to the article(s).
2. Explain the main security and privacy requirements of GLBA. What data elements does GLBA protect? What are the main privacy requirements of the law? What are the main security requirements of the law? Who enforces the law?
Research the Health Insurance Portability and Accountability Act (HIPAA)
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet. Be sure to cite all resource and it is never acceptable to copy from any source.
Conduct an internet or library search on the Health Insurance Portability and Accountability Act (HIPAA). Read one or two articles that you find interesting.
3. Identify the article(s) you read, including a link to the article.
4. Explain the main security and privacy requirements of HIPAA. What data elements does HIPAA protect? What are the main privacy requirements of the law? What are the main security requirements of the law? Who enforces the law?
Compare and Contrast GLBA and HIPAA
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet. Be sure to cite all resource and it is never acceptable to copy from any source.
5. Describe what the GLBA and HIPAA security rules have in common. List three to five elements or concepts that are similar in the security provisions of both rules.
6. Describe the differences between the GLBA and HIPAA security rules. List three to five elements or concepts where the security provisions of both rules diverge.
Challenge Exercise
Note: The following exercise is provided to allow independent, unguided work—similar to what you will encounter in a real situation. Be sure to cite all resource and it is never acceptable to copy from any source.
Both the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA) contain numerous provisions that an organization that is subject to the legislation must follow. In some instances, an organization will have business activities that place its information technology systems under the regulatory requirement of both laws. Both GLBA and HIPAA require subject organizations to create written information security plans/policies for their IT operations and provide employee training on each law’s regulatory requirements.
7. Which law gives an organization more instruction and insight into the type of information security plans/policies required?
8. Which law gives better instruction and insight into training practices?
9. How would you advise an organization that has to follow both laws on its information security plans/policies activities and training activities?
10. Why would you advise that course of action?
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|