Legal Regulations and Compliance

Running head: LEGAL REGULATIONS AND COMPLIANCE
Legal Regulations and Compliance
Name of the Student
Name of the University
Author Note

1LEGAL REGULATIONS AND COMPLIANCE
1. Why were these contractors held accountable? How can the agency better handle
managing contractor access to sensitive privacy data in the future? What type of
training do you think should be put in place to better equip the VA staff and
contractors so that this does not happen again?
The health insurance portability and accountability Act explains the essentiality of the
protection f the sensitive data related to the patient. In the above mentioned scenario, the lack
of proper access to the HIPAA Compliant Data by the U.S. Veterans Administration lead to
the scenario of susceptibility of the personal or the private data of the patient towards leakage
or attack (Lye et al., 2018). Thus the individuals involved in the process of the access of the
data were imposed heavy penalties and was held accountable on the basis of the discrepancy
caused by them towards the risk of the manhandling or the leakage of the personal data of the
patients.
In the future perspective, the agency can better handle the management towards the
access sensitive issue of the privacy of the data by reviewing the organization's ongoing
posture of cyber security, identifying and prioritizing the improvement areas and initiate
effective communication with both the internal and the external stakeholders on the topic of
the cyber security risk.
Proper trainings are required for the compliance of the data for the VA staff members
so that the discrepancy does not happen again, Trainings on implementation of the written
policies and the procedures, training relevant to record handling, state and the federal laws,

2LEGAL REGULATIONS AND COMPLIANCE
appropriate staff access and the agreements of the business associates are required in the
agency.
2. CardData Systems thought they were PCI-DSS Compliant but they were not. What
steps should they or any organization looking to ensure they are compliant must
consider and adhere to?
The payment card industry data security standard or PCI DSS is applicable to the
organization that accepts the process of the card payments. In the above scenario, though the
CardData Systems thought that were PCI DSS compliant but later they found that are not.
For ensuring and considering for the compliances for adhering to, he company needs to
follow certain process and regimes (Brown et al., 2015). There lie three of the essential steps
in the journey for adhering the PCI DSS and to be compliant. These include firstly, the
assess, second, the remediate and finally the reporting. The process of assess includes
performance of the audit identity , the process of remediate includes fixing the vulnerabilities
and reporting means compiling and submitting the remediation validation recording.
3. We know that HIPAA is integral to PHI and vice versa. What is so important?
Please explain the relationship. Also. explain how PHI and HIPAA are being
changed dramatically by e-commerce and the rapid expansion of healthcare in an
online marketplace.
The factors of HIPAA and PHI are considerable and identifiable health data that is
generally used for the maintenance, storing and the transmission by the covered identity of
HIPAA. PHI is integral to HIPAA since both of them provide the protection towards the