Course Title:
Information Security in Healthcare
Course Number:
MI 5152
Course Credits:
3
Course Director:
James R. Templeton, Ph.D.
Associate Professor
619.889.5566
jtemplet@nova.edu
3200 S. University Drive
Ft. Lauderdale, FL 33328
Office Hours:
12pm-11pm ET virtual office
Dates:
05/11/2015 – 08/02/2015 (12 weeks class)
Observed Holidays:
Memorial Day 05/25/2015
Day before 4th of July, 07/03/2015
Days and Time:
Monday: 06/01/2015, 06/22/2014, and 07/06/2014 from 8-10pm ET
Location:
Online within Blackboard
Course Description:
The course will cover concepts, applications and techniques of data security in healthcare system. Topics
include healthcare industry, regulatory environment, decision making, policy assurance, information
management, access control, risks and vulnerabilities management, database security, web security,
personnel and physical security issues, and issues of law and privacy. Areas of particular focus include
secure healthcare system design, implementation, data encryption and decryption, attacks, and techniques
for responding to security breaches.
1 of 5
Course Textbook (required):
Hernandez, S. (Ed.). (2015). Official (ISC)2 Guide to the HCISPP CBK. Boca Raton, FL:CRC Press.
ISBN-13: 978-1-4822-4277-3
Murphy, S.P. (2015). Healthcare Information Security and Privacy. New York, NY: McGraw Hill
Education.
ISBN-13: 978-0-07-183179-6
Further reading will be posted on class website within Blackboard.
Course Structure and Requirements:
Methods of instruction include:
• Reading and homework assignments
• Discussion forum contributions
• Emails, chat rooms, and live classrooms within Blackboard
• Quizzes
• Group Project
Students should check the class website on Blackboard frequently (at least once a week) for updated
information, supplementary reading and announcements etc. You will be graded on course participation
through interaction/login via Blackboard
Course Goals:
1.
2.
3.
4.
5.
6.
7.
Learn healthcare organization and information technology
Learn who the players are in healthcare
Learn the regulatory environment of healthcare information
Learn information decision making and risk
Learn data encryption and decryption techniques
Understand the strengths, and weaknesses of information security
Understand cybersecurity security in general
Course Learning Objectives:
Upon completion of this course, students will have gained knowledge of information security and
healthcare information security. Students will be able to use security tools and devices to encrypt data,
to enhance access control and to increase application and system security.
1.
2.
3.
4.
5.
6.
Identify healthcare organizations and third party affiliates.
Prioritize threats to healthcare information resources.
Define an information security strategy and architecture.
Plan for and respond to intruders in a healthcare information system.
Demonstrate comprehensive knowledge of risk management and decision making.
Demonstrate comprehensive knowledge of risk assessment.
2 of 5
Evaluation Format:
The evaluation format of this course includes: homework assignments, class participation including
discussions, live classroom sessions, quizzes and a group project.
Homework Assignments:
Assignments should be submitted on time and via the Blackboard assignment drop box. There will be
five (5) homework assignments. Each is worth 5% to the final grade for a total of 25%. Homework
will be posted in the Blackboard Assignment section.
Online Discussions
There will be eight (8) discussion topics throughout the course. All contributions must be made in the
applicable discussion forum queue in Blackboard. Discussion forum contributions are evaluated as
participation by the student, this means that each student will be expected to participate in the
discussions during the timeframe of the discussions.
All students should participant in the discussion throughout the period of the forum. Active
participation here means join in the forum in a timely manner and submit well-written, on-topic
posts. You are required to have one original entry per discussion topic, as well as comments on
two (2) separate discussions from other posts (unless otherwise specified). These comments need
to be at least one paragraph in length. The discussion topics are as follows:
DB#1 - Introduction
DB#2 - When you think about healthcare information security...
DB#3 – Is a regulatory system really necessary
DB#4 – Privacy vs. Security
DB#5 – Risk Management
DB#6 – Risk Assessment
DB#7 – Third Party Risk
DB#8 – Group Project Discussion
The quality of the contribution is determined by whether the submission is within scope of the topic
and contributes to the understanding of the information being discussed.
The combined eight (8) Online Discussions will account for 10% (1.25% each) of the final grade.
When required to post comments to a DB topic, your post will be worth 0.43%, and each of your
comments on other posts are worth 0.43%, for a maximum of 1.25% total.
Quizzes:
There will be seven (7) quizzes in the class. Each quiz is worth 5% of the final grade. Quizzes are open
book and in multiple choice formats. It is generally good practice to study the slides and read the
textbook before taking a quiz.
3 of 5
Live Classroom:
There will be three (3) live sessions over Blackboard on 06/01/2015, 06/22/2015, and 07/06/2015.
Participation in all three live sessions is required. Extra live sessions may be added as appropriate.
Participation in the extra live sessions is voluntary, but it is strongly recommended. Please check the
weekly announcements regularly for up-to-date information. Each required live session classroom is
worth 5% of final grade, for a total of 15%.
Group Research Project and Paper:
Each student must participate in a group project. The group must include at least 3 students (recommend
4-5). The scope of the project will be development a healthcare security implementation at a fictitious
regional hospital with 500 beds. The security design and implementation project must include the
following components: security analysis, security policy, and security of the hospital information systems,
including, but not limited to the email system, electronic health records, radiology, pharmacy,
telemedicine, and human resources. The job of the team is to plan and implement a security approach
based upon the tenets learned in the course. The team is responsible for making sure that all of the
necessary security components are in place to protect the hospital information systems. Appropriate
citations and research will be necessary as necessary. The paper must be submitted in proper format and
style. Contents of the paper must include an abstract/executive summary, table of contents, introduction,
detailed security analysis, security policy, and resource allocation to manage the various components of
the hospital information systems. The group project will count as 15% of the final grade.
Grading Policy:
All assignments are to be submitted through the Blackboard assignment drop box, unless otherwise
specified in the explanation of the assignment.
The deadline for all submissions is11:55 pm (ET) on the date indicated. No late submission is allowed.
However each student is permitted to exercise an emergency exception twice per term and the
assignment has to be submitted within 5 days beyond the deadline.
Assignments
Points
Homework (5)
5% x 5 = 25 %
Discussion Board (8)
10 %
Quizzes(7)
5% x 7 = 35 %
Live Sessions(3)
5% x 3 = 15 %
Research Paper
15 %
Total
100 %
4 of 5
Grading Scale
Points Earned
94-100
90-93
87-89
83-86
80-82
77-79
73-76
70-72
Below 70
Letter Grade
A
AB+
B
BC+
C
CF
Attendance Policy:
Attendance at all scheduled classes and online chat sessions are required by HPD policy. Students are
responsible for following the progress of the course. Failure to attend the Live Classrooms without
prior arrangement with and approval from the instructor is considered unexcused absence and will be
penalized (up to 5% of the final grade) for each absence.
Course Schedule:
This course starts on 05/11/2015 and ends on 08/02/2015, a total of 12 weeks.
Week
1- 2
Topics
Healthcare Industry
Readings
HCISPP Domain 1
Murphy: Chap 1 – 2
3-4
Regulatory Environment
HCISPP Domain 2
Murphy: Chap 3
5-6
Privacy and Security
HCISPP Domain 3
Murphy: Chap 7 and 9
7-8
Info. Governance and Risk Management
HCISPP Domain 4
Murphy: Chap 4 and 6
9-10
Information Risk Assessment
HCISPP Domain 5
Murphy: Chap 8, 10, 11
11-12
Third Party Risk Management
HCISPP Domain 6
Murphy: Chap 5
Note: Scheduled Live Classrooms (participation is required): Mondays: 06/02/2015, 06/22/2015, and
07/06/2015 from 8:00pm to 10:00pm ET.
5 of 5