AHA Selects Ernst & Young as Member Advisor on HIPAA Security Regulations.

Business Editors/Health/Medical Writers

WASHINGTON--(BUSINESS WIRE)--July 15, 2003

To help the nation's health care providers with the security requirements of the Health Insurance Portability and Accountability Act (HIPAA), American Hospital Association (AHA) has selected Ernst & Young LLP as its strategic advisor for HIPAA security services. Additionally, AHA has exclusively endorsed Ernst & Young's HIPAA security services, including risk analysis, gap assessment and all security implementation services. AHA endorsed Ernst &Young after careful review.

On February 20, the Centers for Medicare & Medicaid Services (CMS) published the final HIPAA security regulations calling for compliance in five areas: administrative safeguards, physical safeguards, technical safeguards, organizational safeguards, and security policies, procedures and documentation. Hospitals have two years - until April 20, 2005 - to comply.

The AHA chose Ernst & Young as the strategic advisor and endorsed HIPAA security provider for Ernst & Young's developed framework that allows hospitals to assess, control, monitor, and mitigate exposure in information security. Over the next several months, AHA and Ernst & Young will develop joint advisories, checklists, briefings and other documents for AHA members.

"Ernst & Young's ability to provide guidance in a clear and thorough manner will help our members with their decision-making processes, sequencing of activities, and provide them with accurate investment breakdowns - all of which are necessary to address the HIPAA security requirements," commented Neil J. Jesuele, AHA executive vice president.

"Ernst & Young is honored to have been selected as the strategic HIPAA advisor to the AHA and the HIPAA security provider for AHA membership," said Robert Dongoski, leader of Ernst & Young's HIPAA security advisory services.

Ken Vanderwal, Ernst & Young's national director of HIPAA Services added, "Our people are eager to put our capabilities and experience as industry and HIPAA advisors to work with the AHA membership to address the HIPAA security regulations."

Hospitals interested in guidance on HIPAA security compliance can begin the process working with Ernst & Young by performing a security risk analysis. Based on the results of this analysis, Ernst & Young works with hospitals to complete a gap assessment - identify missing HIPAA elements - and create a customized HIPAA security implementation roadmap so hospitals can achieve compliance by April 2005.

Among the services available to hospitals are:

-- HIPAA Security Risk Analysis - hospitals can identify

potential security risk and its impact.

-- HIPAA Gap Assessment - helps hospitals identify key gaps

comparing the current security environment to what's required

for compliance with the regulation.

-- HIPAA Security Roadmap - based on the HIPAA Gap Assessment,

the roadmap identifies specific initiatives needed and

respective resources required to help hospitals achieve

compliance.

-- HIPAA Security Blueprint - more detailed than the HIPAA

security roadmap, the blueprint is intended to be a 'guide'

for HIPAA security-related activities providing detailed

definition of major activities, resource requirements and

related costs to achieve compliance.

-- Implementation Solutions - implementation services for HIPAA

security remediation including policies and procedures,

vulnerability management, application security, network

security, physical security, and other HIPAA required and

addressable areas.

-- Business Continuity Services - advisory services focused on

crisis management, physical security, and the development and

deployment of business continuity solutions.

-- Technical Access Controls - advisory services on remote

access, wireless, single sign and access control solutions.

In the coming weeks, AHA members will receive detailed information regarding the resources available to them through this collaboration. For specific information regarding the AHA/Ernst & Young relationship, contact Brian Lane, assistant vice president of technology at 800-242-4677 or via e-mail at [e-mail].

About AHA

The American Hospital Association (AHA) is a not-for-profit association of health care provider organizations and individuals that are committed to the health improvement of their communities. The AHA is the national advocate for its members, which includes approximately 4,700 hospitals, health care systems, networks, other providers of care and 30,000 individual members. Founded in 1898, the AHA provides education for health care leaders and is a source of information on health care issues and trends. For more information, please visit the AHA Web site at www.aha.org.

About AHA Financial Solutions, Inc.

AHA Financial Solutions, Inc. (AHA-FSI) is the subsidiary of the American Hospital Association that collaborates with companies to create strategic financial, technology, regulatory, employee benefit, and insurance products and services for health care professionals. It functions as a resource agency to AHA-member hospitals and other health care organizations. For more information, contact AHA-FSI at [phone] or visit the Web site at www.ahafinancialsolutions.com.

About Ernst & Young LLP

Ernst & Young, a global leader in professional services, is committed to restoring the public's trust in professional services firms and in the quality of financial reporting. Its 106,000 people in more than 140 countries around the globe pursue the highest levels of integrity, quality, and professionalism to provide clients with solutions based on financial, transactional, and risk-management knowledge in Ernst & Young's core services of audit, tax, and corporate finance. Ernst & Young practices also provide legal services in those parts of the world where permitted. Further information about Ernst & Young and its approach to a variety of business issues can be found at www.ey.com/perspectives. Ernst & Young refers to all the members of the global Ernst & Young organization.