As technology permeates every facet of our lives, industries across all sectors have adopted methods to make business faster and more efficient. One industry that has seen exponential growth thanks to modern advancements is the healthcare sector.

Hospitals, doctors, clinics, and pharmacies, among others, have been able to speed up their jobs by going paperless. Payment systems, questionnaires, and a host of other administrative and clinically based systems have been migrated to electronic devices, allowing healthcare professionals to see more patients and maintain easily accessible records.

However, before the Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) instituted the Health Insurance Portability and Accountability Act (HIPAA), there wasn’t a universally accepted set of privacy and security standards to safeguard patient information.

Today, we’ll take a detailed look at the various aspects of HIPAA compliance and which companies are affected by this regulation.

HIPAA Compliance Explained

HIPAA is an initiative that created standards and protocols governing the handling and storage of sensitive patient data. Organizations that manage protected health information (PHI) must abide by a stringent set of rules and security measures to ensure they remain HIPPA compliant and avoid penalties.

Those subjected to the mandates of HIPAA compliance requirements are typically referred to as covered entities or business associates. Covered entities are those in the healthcare profession that provides treatment, accept payments, or perform clinical operations within the industry. Business associates are ancillary organizations with access to PHI or offer support in delivering treatment, payment, or operations. If a private company, subcontractors, or public institutions manages PHI, they will need to meet HIPAA compliance standards.

The rules established under HIPAA are made so under the HHS, and the regulations are enforced by the OCR.

HIPAA Privacy Rule

HIPAA was enacted back on August 21, 1996, to provide a minimum standard for the safeguarding of sensitive patient data, as well as combating exploitable aspects in health insurance and healthcare delivery. Over the past two decades, HIPAA requirements have undergone a series of updates, with the most notable being written on April 14, 2003, as it set a precedent for what constitutes Protected Health Information (PHI).

According to the amendment, PHI is any data that is maintained by a company or healthcare center which can be used to identify an individual, as well as signifying their current health status, payment history, or provisions of healthcare. PHI includes demographic information such as:

• Names
• Addresses
• Phone numbers
• Social Security numbers
• Medical records
• Financial information
• Full facial photos

This definition was instituted in an attempt to provide autonomy over personal information to the linked individual. In this regard, healthcare providers and companies that hold PHI are required to seek permission from the patient before using the prescribed data for marketing, fundraising, or research.

With this added autonomy level, patients could also choose to withhold their private data concerning their healthcare provisions from health insurance providers if their treatment is conducted using private funds.

The HIPAA Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, created a federal standard governing the protection of certain health information. It’s important to note that the Privacy Rule only applies to covered entities (specifically health plans, health care clearinghouses, and health care providers), not business associates.

These covered entities are tasked with integrating the Privacy Rule standards into their operations to protect PHI from misuse or abuse. If a company fails to be HIPAA compliant, it can be subjected to the imposition of civil or criminal penalties.

As it stands, the HHS understands the necessity of healthcare communication so a patient can receive prompt and comprehensive treatment, even if it comes at the risk of exposing PHI. As there are a multitude of environments that healthcare treatment and processing can occur, the chance that some information will slip through the cracks. To this end, the HHS’s HIPAA compliance requirements doesn’t necessitate the need for all risks of an incidental use or accidental disclosure to be entirely eliminated.

General Provision

The Privacy Rule is deemed satisfied with HIPAA compliance if reasonable safeguards and minimum necessary policies and procedures have been implemented into a covered entity’s operations.

Reasonable Safeguards

A covered entity must incorporate an appropriate level of administrative, technical, and physical safeguards for patient PHI to fulfill the requirements under Reasonable Safeguards. While it would be unreasonable to expect a one hundred percent secure environment, these safeguards should limit the scope of incidental uses or disclosures.

Reasonable safeguards will differ between the various types of covered entities that are accountable for HIPAA compliance. In this regard, each individual covered entity will need to evaluate its own circumstances, assets, and held PHI to determine which minimum safeguards are necessary to protect patient data without overburdening the financial and administrative capabilities of the organization.

Key factors that should be maintained in a covered entities documentation to ensure reasonable safeguards include:

• Speaking quietly when discussing a patient’s condition with family members in a waiting room or other public area
• Avoid identifiable markers such as patients names in public areas
• Securing areas that provide access to PHI
• Encrypting devices that have access to PHI

Minimum Necessary

Covered entities are required to institute policies and procedures regarding the use of private health information so that only the minimum necessary is disclosed. The policies outlined should also reasonably limit who has access to the PHI within the entity as well as the conditions required for them to request it.

HIPAA Security Rule

Following the PHI definition, the HHS enacted HIPPA compliance regarding security protocols on April 21, 2005. While the Privacy Rule created a regulation surrounding PHI and who can access it, the Security Rule standardized the measures around who has access to the data in electronic form.

As providers and companies sought to ease the burden of administrative and clinical tasks through applications such as computerized physician order entry (CPOE) systems and electronic health records (EHR), the need for newer security protocols became an issue. These systems and others like them give healthcare providers quick access to patient information without being at a centralized terminal. However, it does create security risks. To balance the potential risk associated with the ease of mobility, the federal government mandated that the medical workforce maintain a baseline known as HIPAA Security Rule.

The new Security Rule was drafted to govern HIPAA secure data stored in electronic form (ePHI) and goes into further detail than that of the Privacy Rule.

The Security Rule mandated that organizations needed to maintain three security safeguards – administrative, physical and technical – to be considered HIPAA compliant:

Administrative

The Security Rule places the most stringent regulations around the administrative aspects of HIPAA compliance. These administrative safeguards comprise more than fifty percent of the HIPAA compliance requirements. According to the ruleset regarding electronic transmission of PHI, administrative actions, policies, and procedures need to establish security measures involving:

• Selection management
• Implementation
• Security Maintenance
• Conduct Management

The Administrative Safeguards standards will need to be thoroughly investigated in their current state so that an evaluation of the security controls can be accurately accounted for regarding risks that are unique to the covered entity to ensure HIPAA compliance.

Security Management Process

The first standard that covered entities must meet is the Security Management Process standard. This rule covers the administrative processes and procedures that create a security posture for this particular environment. The four implementation specifications in this standard include:

Risk Analysis — Covered entities will need to account for potential risks within their organization that can lead to exposure of confidentiality, integrity, and availability of ePHI.

Risk Management — Covered entities will need to create a system of security measures that can reduce risk to a reasonable and appropriate level to the circumstances unique to it.

Sanction Policy — Reasonable levels of sanctions need to be established to deter the workforce from failing to uphold the Administrative standards.

Information System Activity Review — Under the information system activity review, covered entities will need to be able to determine if any ePHI was used or disclosed inappropriately.

Assigned Security Responsibility

The Assigned Security Responsibility standard aims to create a final point of liability for the individual responsible for ensuring the standards are upheld.

Workforce Security

Workforce Security is the third standard. It’s designed to ensure that workforce members have a reasonable level of access to ePHI to conduct their job functions. Covered entities will also need to include who sets the authorization levels, as well as any termination processes to restrict access once a member of the workforce leaves the organization’s employ.

Information Access Management

The fourth standard is designed to restrict access to the workforce to the minimum necessary ePHI access in an attempt to reduce the risk of inappropriate disclosure, alteration, or destruction.

Security Awareness and Training

Training and periodic retraining are necessary if conditions within the covered entity change due to updated policies and procedures, newly implemented software, or even new amendments to the Security Rule.

Security Incident Procedures

The Security Incident Procedures standard requires covered entities to address any and all security incidents they may experience. Even with the most fool-proof safeguards in place, security incidents will occur. However, even if these incidents turn out to be slight, they should be addressed to reduce the risk of creating a larger exploitable breach.

Contingency Plan

The Contingency Plan standard ensures that a covered entity has a strategy to retrieve ePHI should it experience an emergency or critical disruption to operations.

Evaluation

The purpose of the Evaluation standard is to make sure that a covered entity is continually reviewing and maintaining a reasonable level of safeguards to ensure it remains HIPAA compliant.

Business Associate Contracts And Other Arrangements

The final standard that makes up the bulk of the Security Rule governs the need for a covered entity to have a contract or similarly binding agreement with persons or organizations that meet the definition of a business associate. The contract should guarantee that the business associate will reasonably safeguard the ePHI it receives from the covered entity.

Physical

The second component of the Security Rule revolves around the physical safeguards necessary to protect ePHI. As with the other two components, adhering to the Physical Safeguards standards in the Security Rule is necessary for ensuring HIPAA compliance. It will require a thorough analysis of the current security posture, potential exploits, and documentation regarding any necessary solutions for the aspects unique to a particular covered entity.

Physical safeguards refer to policies and procedures as well as physical obstacles that protect a covered entity’s ePHI.

Facility Access Controls

The Physical Safeguards’ first standard is Facility Access Control. Under this standard, policies, and procedures need to be created and implemented to ensure only authorized individuals are physically capable of accessing electronic data within the covered entity’s premises.

The policies should also include procedures toward identifying specific workforce members (or business associates) by title or job function.

Finally, the standard dictates that a covered entity should have established protocols governing who has and under what circumstances they can physically access areas that hold ePHI.

Workstation Use

The Workstation Use standard mandates that protocols and procedures be established to govern the access and environment of a workstation. Workstations pose a substantial threat to unauthorized ePHI disclosure. Individuals who gain entry to a network through a workstation can put the covered entity at risk of virus attacks, hijacking, and breach of confidentiality.

This standard isn’t secluded to facility or on-premise workstation, but to workforce members who can access ePHI remotely as well.

Workstation Security

The previous standard is designed to ensure appropriate policies and procedures are implemented, while the Workstation Security standard governs how workstations are to be physically protected from unauthorized users. An example of Workstation Security HIPAA compliance is to have workstations that grant access to ePHI placed in secured rooms, behind lock and key.

Device and Media Controls

The Device and Media Controls standard refer to the transfer of hardware and electronic media that contain ePHI to and from a covered entity’s facility.

The policies and procedures developed should account for the tracking, identifying, disposal, and reuse of hardware and electronic media, such as:

• Hard drives
• Magnetic tapes
• Optical disks
• Digital memory cards

The Physical Safeguards under the second section of the Security Rule require that a covered entity has implemented reasonable physical measures and policies to protect electronic information from unauthorized individuals as well as natural and environmental hazards.

Technical

As technology continues its exponential advancements, creating specific policies and procedures is becoming increasingly more difficult. To address this growing issue, the Security Rule has designed its third section to be as technology-neutral as possible.

With each new advancement, the ease of access and portability that healthcare works can use ePHI grows, but not without increasing risk. To ensure ePHI is as protected as it can reasonably be, HIPAA compliance requires that covered entities implement technical safeguards.

While the Security Rule sets a standard for technical safeguards, it is designed to be flexible and scalable as technology improvements are made. To this end, the Security Rule doesn’t dictate the type of technology that needs to be safeguarded, as it may be rendered obsolete in the near future. Instead, the policies and procedures surrounding technology safeguards must adhere to core principles.

It is also understood that the size and scope of covered entities can vary drastically. Therefore reasonable judgment should be used when determining the level of measures reasonable for any specific organization.

Access Control

The first standard described under Technical Safeguards refers to Access Control. This standard sets a precedent for the access control methods and technical controls needed by a covered entity. As there are a vast amount of access control methods and technical controls accessible to a covered entity, the Security Rule does not define specific forms that need to be implemented. Other than that, policies and procedures need to be implemented.

Audit Controls

The majority of data centers available on the market will provide users with some level of audit control through means such as an audit report. Under HIPAA compliance requirements, covered entities will need to produce recordings and analysis of information system activity to identify potential security violations.

Once again, in an effort to remain technology-neutral, HIPAA compliance doesn’t mandate specific data to be gathered or its frequency of review. Each covered entity will have its specific circumstances to contend with. As long as it maintains reasonable and appropriate audit controls over information systems that hold ePHI, it is deemed HIPAA compliant.

Integrity

The Integrity standard deals with how ePHI is altered. ePHI that is inadvertently altered or destroyed can result in breaches or issues in clinical quality. Regardless of the source, whether it’s through human or electronic intervention, this standard requires policies and procedures to be implemented to protect the integrity of ePHI.

Person or Entity Authentication

The Person or Entity Authentication standard ensures that an individual access ePHI is, in fact, the person with access to sensitive material. The proof of identity can be authenticated by requiring the person to:

• Know personal information such as a password or PIN
• Possess a smart card, token, or key
• Produce biometric authentication such as a fingerprint or iris pattern

Many covered entities will require two-factor authentication to ensure that one form of authorization has been illicitly garnered.

Transmission Security

As will each standard, covered entities need to review their current practices to see if they are within the HIPAA compliance standards. Regarding the Transmission Security standard, a covered entity must review its current method to transfer and transmit ePHI. Once the delivery methods are reviewed, it is up to the covered entity to ensure that reasonable technical safeguards are in place to protect the data during transmission.

Under the Security Rule, these Technical Safeguards govern all ePHI. Combined with adherence to the Administrative and Physical Safeguards, these Technical Safeguards will allow covered entities to adequately protect and maintain their patient’s ePHI.

HIPAA IT Compliance

The HIPAA IT requirements aim to ensure that the mandates issued through the Security Rules are upheld.

The HIPAA compliance regulations were updated in 2009 under the economic stimulus package, the American Recovery and Reinvestment Act (ARRA). Signed in by President Obama to quell the pressure of the Great Recession, the ARRA was also packaged with the Health Information Technology for Economic and Clinical Health Act (HITECH). The laws prescribed in the act made direct reference to evolving technology as well as the business associates that covered entities contracted. Under HITECH, these organizations would now be liable for adhering to federal provisions.

In addition, covered entities were urged to adopt electronic health records (EHR) systems while increasing privacy and security protection through HIPAA information technology compliance. EHRs were readily adopted by healthcare providers due to the monetary incentive granted by the federal government, while those found not to be HIPAA compliant were punished with increased fines and penalties.

Before HITECH was written into law, only a tenth of all hospitals in America were using EHR systems. This reliance on paper records made delivering the appropriate treatment and coordination between separate covered entities a cumbersome affair. While switching over to an electronic system seems like an obvious choice, the costs to integrate an entirely new infrastructure was prohibitively expensive.

The Meaningful Use Program

To facilitate healthcare providers of varying sizes to adopt EHR technology, the HHS was given a budget of over $25 billion to create an incentive program. With this budget, they were able to develop and launch the Meaningful Use program. If covered entities incorporated a certified EHR into their operations, they would receive monetary inducements.

Certified EHRs are deemed worthy of the incentive program if they could demonstrate they met the prescribed standards issued by an authorized testing and certification body.

However, even if healthcare providers adopted a certified EHR, they had to show they were using the system in a meaningful way. An organization would need to show that they were improving its:

• Efficiency, safety, and quality of treatment
• Patient, family, and caregiver engagement in their healthcare
• Healthcare coordination
• Work toward public health
• Protection over PHI

The financial inducements for voluntarily joining the Meaningful Use program are substantial. However, while over the years, the inducements increased, so did the penalties and the need to join the program.

To remain HIPAA compliant, avoid fines, and receive the incentive, healthcare providers need to go through the three stages of the Meaningful Use program.

Stage 1

The first stage is composed of 15 core requirements and 10 menu requirements and deals with the sharing of data through an EHR. If a covered entity wants to recoup 100% of the incentive, they will need to meet each of the 15 core requirements and a minimum of five of the menu requirements within 90 days of beginning the program.

Stage 2

Stage 2 builds upon the first, requiring covered entities to maintain the standards of the first stage. The primary concern of Stage 2 is on the exchange of PHI, such as immunizations and care coordination of patients. Healthcare providers in this stage will have to demonstrate that they satisfy 17 core objectives and a minimum of three of the six menu objectives.

Stage 3

The final stage of the program is centered around improving the outcome of patient treatment. As with stage two, the standards of the previous stages need to be continually fulfilled in order to obtain the financial incentive and avoid penalization.

With Stage 3, healthcare providers will need to meet eight requirements:

1. Protected Health Information (PHI) — Parallel to HIPAA compliance, clinicians will need to perform security risk analysis on the EHR systems.
2. Electronic Prescribing — Physicians will need to transmit 80% of their prescriptions electronically.
3. Clinical Decision Support (CDS) — Adhere to the five CDS interventions while also performing active checks on drug interactions.
4. Computerized Provider Order Entry — Eligible providers will need to meet the standards attributed to medication, lab, and diagnostic imaging orders.
5. Patient Engagement — Physicians will need to maintain at least 80% of the patient’s records on an EHR. This condition is supplemented with the need to provide educational information to at least 35% of their patients.
6. Coordination of Care — A covered entity must induce their patients to use electronic systems. To fulfill this criterion, a healthcare provider needs to have:
   1. A quarter of their patients use their EHR
   2. 15% of their patient provide data through a fitness tracker
   3. 35% of their patients obtain secure digital information from a healthcare provider
7. Health Information Exchange — Eligible providers need to have:
   1. A minimum of 50% of care record-transition done electronically
   2. A minimum of 40% of new patients’ PHI recorded electronically
8. Public Health Data Reporting — Providers need to submit EHR information to three out of five of these destinations:
   1. Public health registry
   2. Clinical data registry
   3. Syndromic surveillance
   4. Cases
   5. Immunization registry

While the Meaningful Use program was constructed under the HITECH Act, it is one of the avenues towards fulfilling HIPAA IT requirements. Complying with the standards under this program shows that a covered entity has instituted safeguards over its held ePHI.

HITECH adds additional venues for an organization to be fined. This new act is broken into four subtitles:

• Subtitle A: Promotion of Health Information Technology
  • Part 1: Improving Healthcare Quality, Safety, and Efficiency
  • Part 2: Application and Use of Adopted Health Information Technology Standards; Reports
• Subtitle B: Testing of Health Information Technology
• Subtitle C: Grants and Loans Funding
• Subtitle D: Privacy
  • Part 1: Improved Privacy Provisions and Security Provisions
  • Part 2: Relationship to Other Laws; Regulatory References; Effective Date; Reports

Cost of Integrating a HIPAA Information Technology Compliance System

Covered entities will need to invest heavily in servers or similar platforms to meet HIPAA information technology compliance standards. For medium to large-scale HIPAA-regulated organizations, the costs can exceed $50,000, not including the cost of training and manpower for migrating systems. Smaller firms may be able to switch over to HIPAA compliant systems for a fifth of the associated costs.

Electronic Data Interchange (EDI) Standards

As HITECH places a strong emphasis on interoperability, the transmission of ePHI has been a key point for regulators. As such, regulators have mandated the transmission of ePHI needs to conform to electronic data interchange (EDI) standards.

Under this standard, HITECH has dictated the means of:

• Format of the data transfer
• Coordination of benefits
• Referrals and authorizations
• Eligibility verifications and responses
• Claims status and remittance advice
• Health care claims

These rules were implemented to unify the means of ePHI transmission into a standard practice.

Risk Assessment and Management

A key factor under the HIPAA IT requirements is the need for enhanced security standards. Covered entities and business associates will need to adopt systems and protocols for preventing data breaches and create policies for identifying and remediating attacks.

Any system within an organization that comes in contact with ePHI, whether it has transmitted, received, placed in storage, or altered the data in any way, must maintain a reasonable level of security protection.

HIPAA IT Compliance Checklist

While there are specific regulations that need to be followed by an IT department to remain HIPAA compliant, there are several steps it can take to ensure the company’s ePHI is secured.

• Integrate a secure messaging solution for devices that transmit ePHI within a covered entities workforce
• Encrypt every outgoing email that contains ePHI
• Educate staff against social engineering attacks
• Create physical safeguards around on-site servers

There are claims that medical records are more valuable than credit card details on the dark web, and taking basic safety precautions can significantly reduce a company’s likelihood of being compromised.

How to Become HIPAA Compliant

While many solution providers may be developing the latest and greatest technological feat, they still need to ensure they deliver a product that can undergo the scrutiny of HIPAA compliance regulators.

There are publicly provided HIPAA compliance checklists offered by the HHS. However, unless the company is well-versed in the nuances of the regulations, the process can be convoluted and challenging to execute correctly while at the same time avoiding any of the hefty fines.

Vendors need to validate and ensure that they’ve satisfied an appropriate level of policies, procedures, and safeguards when it comes to transmitting ePHI. A system with an easily detectable exploit that leaks unauthorized disclosure of ePHI can expect swift and harsh penalties. Additionally, until a solution provider has met HIPAA’s prerequisites, its products can be used by HIPAA-regulated covered entities.

Companies that hope to become a HIPAA compliant business associate will certainly need to rely on a HIPAA compliance checklist to ensure their business has instituted the reasonable levels of administrative, physical, and technical safeguards described above in the Security Rule section. Failing to do so can have financially crippling ramifications. It also poses the possibility of criminal charges being brought forth by the Office for Civil Rights (OCR).

HIPAA Compliance Requirements

The regulations outlined under the HIPAA created a standardized formula that impacts every covered entity and business associate.

Aspects that need to be addressed to fall within HIPAA compliance include:

Self-Audits

Under the articles of the HIPAA, both covered entities and business associates must undergo a yearly audit of their PHI policies and infrastructure to assess if they are in compliance with HIPAA Privacy and Security standards in terms of their Administrative, Physical, and Technical protocols.

Remediation Plans

After detecting and gaps found from its self-audit analysis, covered entities must undertake remediation actions to correct the violations. The remediation plans must be documented and accompanied by milestone dates that indicate when violations will be reversed.

Policies and Procedures

One of the most common aspects throughout the HIPAA ruleset is for covered entities and HIPAA-regulated business associates to create policies and procedures in line with HIPAA regulatory standards.

These policies and procedures must be updated regularly to account for newly implemented technology and changes within the organization. Both new staff and long-standing workforce members must be annually updated on the guidelines within the company’s policy and procedures. The training must be documented, indicating that the staff has been trained and understood the material.

Documentation

To remain HIPAA compliant, covered entities and business associates must document any and all measures taken to achieve compliance. If an organization undergoes the scrutiny of an OCR audit, this documentation will need to be presented.

Business Associate Management

HIPAA-beholden organizations must maintain documentation regarding any Business Associate Agreements made with vendors who may come in contact with privileged PHI. These agreements must be reviewed annually to ensure they are aligned with the current environment that the organization is operating within.

Incident Management

In the event that a covered entity or business associate has identified they’ve experienced a leak of PHI, there must be a documented established protocol on how to remediate the issue. According to the HIPAA Breach Notification Rule, the patients who may have had their personal data exposed must also be notified.

How to Create a HIPAA Compliance Program

To create a HIPAA compliance program, every covered entity and business associate needs to compose a minimum of the following seven elements.

1. Implementing written policies, procedures, and standards of conduct.

The first element is to create written standards that apply to every member of the organization’s workforce. These policies should incorporate the entirety of the entity’s compliance program, code of ethics, training, remediation plans, and disaster recovery plan.

2. Establishing a compliance officer and compliance committee.

Covered entities and business associates will need to place an individual in a compliance officer’s role, who will lead the committee.

3. Performing effective training and education.

Designed to maintain a strict level of competency concerning the safeguarding of PHI, companies will need to regularly perform HIPAA compliance training.

4. Developing open lines of communication.

Companies and organizations need to establish an environment where HIPAA compliance violations can be brought to the compliance officer’s attention without fear of reprisal.

5. Conducting internal monitoring and auditing.

For any program to remain effective, it will need to undergo regular analysis to ensure it’s meeting the necessary standards it’s designed to achieve.

6. Enforcing policy through well-publicized disciplinary guidelines.

Covered entities and business associates must create and distribute the information concerning how violations within the organizations will be handled.

7. Responding promptly to detected offenses and performing remediating action.

The plan isn’t complete until it sets a standard for how violations will be detected, verified, and remedied.

If a covered entity or business associate experiences an OCR investigation due to a HIPAA violation, the auditor will measure the organization’s established policies against these aforementioned elements.

HIPAA Violations

A healthcare provider may be in HIPAA violation if the integrity of their PHI or ePHI becomes compromised due to the intrusion of a data breach. While not every breach is considered a HIPAA violation, it is if it’s the result of an inadequate, deficient, or obsolete HIPAA compliance program. It can also be deemed a violation if the data is leaked through the willful disregard of the established HIPAA policies and procedures.

The HIPAA Breach Notification Rule

The differences between a data breach and HIPAA violation are outlined in the HIPAA Breach Notification Rule. The rule details the actions necessary should covered entities or business associates experience a data breach.

Minor Breach

According to the HIPAA Breach Notification Rule, a minor breach entails an event that affects fewer than 500 individuals within the parameters of a single jurisdiction.

Under this rule, organizations must document each breach that spans the length of a year and must report them to HHS’ OCR within 60 days from the last day of the calendar year that they took place. Organizations are also required to notify individuals impacted by the breach within 60 days of detecting the intrusion.

Meaningful Breach

As described by the HIPAA Breach Notification Rule, a meaningful breach is an exploited situation that affects more than 500 individuals within the parameters of a single jurisdiction. Unlike a minor breach, in which the organization only has to report all events once a year, a meaningful breach must be reported within 60 days of detection. Affected individuals, along with local law enforcement and news outlets, must also be notified immediately upon discovery of the breach.

To encourage strict adherence to HIPAA compliance, the HHS maintains a permanent ledger known as the “Wall of Shame” that lists every meaningful breach which has occurred.

Common HIPAA violations?

Common violations include:

• Stolen devices with access to ePHI
• Stolen drives with ePHI stored on them
• Hacking, malware, and ransomware attack
• Business associate breach
• EHR breach
• Physical on-site break-ins
• Negligence in transmitting PHI
• Openly discussing PHI in public areas

The fines and penalties for violating HIPAA standards can range from a few hundred dollars to tens of thousands of dollars, reaching as high as $1.5 million per calendar year for violations. Financial penalties aren’t the only punishments that can be imposed. If the level of negligence or willful malice permits, jail time can also be levied.

HIPAA Compliance Checklist

To help you begin the road to HIPAA compliance, here is a checklist to ensure you have the necessary safeguards established.

Administrative

• Perform an ongoing risk assessment to detect any potential gaps.
• Conduct risk management to ensure reasonable PHI security is in place.
• Train staff in ePHI access protocols and how to mitigate chances of social engineering to reduce chances of cyber-intrusion.
• Design contingency plans to ensure continued business operations.
• Perform regular testing on contingency plans.
• Create and sign business associate agreements with any vendor or business associate who may have contact with ePHI.
• Record every security breach, successful or otherwise.

Physical

• Monitor and control access to areas that hold PHI or ePHI.
• Establish a written policy concerning workstation habits to inhibit accidental PHI disclosure.
• Create policies governing the exchange and transfer of mobile devices, which may at one time contained ePHI.

Technical

• Encrypt all transmitted ePHI to meet NIST cryptographic standards
• Issue PIN codes, keycards, and / or passwords to authorized personnel with access to ePHI.
• Regularly authenticate ePHI to protect its integrity.
• Encrypt any device that can access ePHI.
• Monitor the logs of ePHI access attempts.
• Create auto-logoff systems to ensure workstations are secured once authorized personnel leaves the area.

HIPAA Privacy Rule

• Respond within 30 days to patient access requests.
• Inform patients and subscribers of data sharing policies through a Notice of Privacy Practices (NPP) form.
• Receive permission from patients to use their PHI for marketing, research, or fundraising.
• Conduct privacy training with the workforce to ensure understanding of the Privacy Rule.
• Ensure your documentation accounts for the changes in the treatment of school immunizations, ePHI restriction in disclosure to health plans, and the right of patients to their electronic records.

HIPAA Breach Notification Rule

• Understand the differences between a minor breach and a meaningful breach and the required measures once one is identified.
• Ensure that a breach is notated with:
  • A description of the ePHI
  • Who gained unauthorized access
  • The degree that the data’s integrity was misused or corrupted
  • How well the safeguards mitigated any damages

HIPAA Final Omnibus Rule

• Update Business Associate Agreements to indicate the amendments of the Omnibus Rule.
• Retrieve newly signed copies of BAAs that incorporate the Omnibus information.
• Update privacy policies to include the Omnibus changes.
• Update NPPs to address the changes to authorizations and the right to privacy.

This checklist does not cover the entirety of the HIPAA compliance regulations. It’s also important to note if you transfer over to a new cloud-based system, there are several additional steps required to stay compliant.

Top 21 what is hipaa compliance edit by Top Q&A

Top 20 what is a whooping cough

Top 9 what age is millennials

Top 10+ what do actuaries do