Nortel Systems and HIPAA Compliance

[Bulldog81]

I work in the healthcare industry, and HIPAA compliance is always a big topic with our IT Department. I know Windows XP will lose all support in April 2014, which would mean any healthcare facilities running Windows XP workstations on their networks are not HIPPA compliant per HIPAA Security Rule section 164.308(a)(5)(ii)(B) which states that you must implement "procedures for guarding against, detecting, and reporting malicious software."

Anyhow, that got me to thinking about all the healthcare facilities still utilizing Nortel products that are no longer supported due to Nortel going out of business. So my question is does using Nortel telephone and data equipment a HIPPA compliance issue? I'm pretty sure the all digital telephony equipment would be ok, but I'm not for certain. I know the Nortel BCM, which uses VOIP, and the Nortel data routers and switches could definitely be an issue. Can any of you experts and veterans shed any light on the subject?

 

[curlycord]

Sorry wouldn't know but I dont see any info on HIPAA, in fact it seems as if phones are not a part of this compliant issue.


"I work in the healthcare industry"
I thought you started your own gig last year.




=----(((((((((()----=
curlycord

http://www.curlycord.com

Toronto Canada

http://www.telcopc.ca

 

[Bulldog81]

Haha, life changes things sometimes. You know how it goes. I'm still working on getting some certifications at the moment while I decide which direction I want to go.

 

[GordonKapesMZ4]

Our Walgreens stores have to deal with hippa, but what I know is that the Nortel analog trunk key systems and Cisco IP systems are all compliant.

Plus here in the city, Northwestern Memorial Hospital uses Cisco 79xx sets while the new Lurie children's hospital next door uses avaya 96xx IP sets.

"Keep the Peace, Use RLS"

http://www.joetheucxguy.com

 

[GordonKapesMZ4]

Here in Chicago I mean!

"Keep the Peace, Use RLS"

http://www.joetheucxguy.com

 

[Bulldog81]

Looks like Avaya is going to keep rolling out updates for the Nortel IP phone system line for the next 4 years, but who knows how long they will keep doing this. It would have to be a HIPAA violation to use an IP phone system that no longer gets manufacturer updates, because hackers could exploit vulnerabilities in the outdated programming on your VOIP PBX to access patient information through your data network. I believe you will always be HIPAA compliant on a Nortel MICS/CIS (which no longer gets software updates), because digital PBX's are on a separate analog network, and don't provide a pathway to patient information through a company's data network. Toll fraud could still be an issue, but a high phone bill is the worst case scenario there. So I guess there is still some benefit for staying with a digital PBX, because you don't have the extra HIPAA compliance issues to worry about if your IP PBX's manufacturer discontinues software patches for your particular phone system.

 

[davidwalters]

Take a look at these videos:

https://www.youtube.com/watch?v=f3zUOZcewtA

https://www.youtube.com/watch?v=PjEA8HPBPs8