Information Security

Jess Smith is the founder and CEO of Yourhealth.com, a start-up company engaged in the business of providing on-line medical referrals to patients suffering from chronic diseases.   The Yourhealth.com website contains a detailed menu of health care services available to patients based on each patient’s needs.  From the comfort of their home, a patient can select the type of service needed by clicking on the service.  Thereafter, the patient is directed to open an online account by providing a user name and password.  Once the account is opened, the patient is asked to fill out a detailed medical form explaining the patient’s symptoms and given diagnosis, if any.   In addition, the patient is asked to fill out a credit card authorization form authorizing the company to charge the patient for the referral service.   Once all of the information has been provided, a representative from the company evaluates the patient’s condition and then provides the patient the names of 3 medical professionals who can treat the specific symptoms/conditions.  The company guarantees that the medical professionals will be available for an in person consultation within 5 days or less.  Once the patient selects the physician, the company makes the appointment for the patient.  If the patient has no insurance or is unable to pay for the physician’s services, the company also offers financing for qualifying individuals.   The financing process is handled in a separate transaction and requires the patient to fill out an online loan application by providing the patient’s social security number, date of birth, salary history, among other financial information, which the company uses to run a credit report check.   If approved, the company fully funds the patient’s medical expenses and the patient can immediately receive whatever medical treatment is needed.

Within a few days from going live, Yourhealth.com has seen a steady number of users sign up for the various services the company has to offer.  The company, however, hasn’t yet had the opportunity to fully develop an information security protocol.   Jess Smith decides that the information security rule should go to you because you are a fast learner and have taken the Information Security course at NSU.  As preliminary matter, Jess wants you to assess the various laws, regulations or industry standards implicated by  the company’s collection, storage and use of patient data, and explain how those laws could affect or regulate the company’s practices.  Please do so in a bullet-point style memo to CEO Smith listing each data-related practice, the relevant laws, and your analysis as to the significance of the law on the company’s practices.