Since the Security Rule isn finalized yet, is it necessary to begin work on implementation now?
While you may want to wait until guidance about the final Security Rule from the HHS is released before spending time and money on security implementation, there are many things you can start doing now with in-house resources. For example, you’ll have to examine your current privacy policies and procedures in order to meet the April 14th, 2003 privacy compliance deadline. It makes sense to review your security policies and procedures at the same time. Make notes of security policies that will need to be changed. Get started on your gap assessment-you can start analyzing your current information flows now. You can also begin corresponding with your IT and software vendors now, to see if they are planning on updating their products to help your organization reach Security compliance.
