HIPAA Security Rules: Compliance and Solutions | HelpSystems
HIPAA Compliance

HIPAA Compliance

Complying with HIPAA is more complex than ever and threats to healthcare data are growing. Attack both problems with a robust compliance solution.

What is HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) was initiated in 1996 to develop regulations protecting the privacy and security of healthcare data. As a result of this work, the Federal Department of Health and Human Services (HHS) published the following privacy protection standards:

compliance-et-audit-reporting Created with Sketch.

The Privacy Rule

The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information, specifically Personally Identifiable Information (PII),  Protected Health Information (PHI) and electronic Protected Health Information (ePHI). These standards include setting limits and conditions on the uses and disclosures of PII without patient authorization.

compliance-et-audit-reporting Created with Sketch.

The Security Rule

The Security Rule goes a step further to operationalize the Privacy Rule protections defined by HIPAA by addressing the administrative, physical, and technical safeguards that health care organizations or “covered entities” must put in place to secure and protect electronically stored and shared ePHI. These protections help ensure the protected health information’s confidentiality, integrity, and security.

HIPAA - continued

HITECH Act

HITECH Act (Health Information Technology for Economic and Clinical Health Act)

Hand-in-hand with HIPAA is the HITECH Act (Health Information Technology for Economic and Clinical Health Act), which passed in 2009 and urges health providers to:

  • Adopt electronic health records (EHR) to improve quality of patient care
  • Adhere to expanded data breach notification requirements
  • Secure ePHI data using appropriate privacy protections

Both HIPAA and HITECH address ePHI security, but measures within HITECH support the enforcement of HIPAA through the Breach Notification Rule and the HIPAA Enforcement Rule.

Consequences of Not Complying with HIPAA

The need to share health data is there – by hospitals, clinics, insurers, research facilities, pharmacies, and public health organizations. However, very specific guidelines around how this information can be stored and shared are needed to ensure patient privacy. Breaching the trust of individuals who’ve entrusted their data comes with consequences.

According to HIPAA security laws and regulations for professionals, the Office for Civil Rights (OCR) within the HSS is responsible for enforcing Privacy and Security Rules, establishing compliance requirements as well as for levying civil monetary penalties.

Organizations that fail to comply with HIPAA regulations can see substantial fines levied against them, even if no actual PHI breach occurs. In addition, criminal charges and even civil action lawsuits can be filed following a breach. And it should be noted: ignorance of HIPAA compliance requirements doesn’t pass muster as a defense against violations sanctions. The OCR issues fines whether a violation is inadvertent or is the result of willful neglect.

Ensuring your administrative policies and procedures, physical protection, as well as technical solutions as a Covered Entity or Business Associate are in place can go a long way in keeping off the OCR’s radar.

What is a Covered Entity?

A Covered Entity is any health care provider, health plan, or health care clearinghouse who, as part of their day-to-day business, creates, maintains, or transmits PHI. There are a few exceptions, including:

  • Most health care providers employed by a hospital, as the hospital itself is the Covered Entity and therefore the party responsible for implementing and enforcing HIPAA compliant policies.
  • Employers, even though they may maintain some health care data on employees. They are exempt unless they provide self-insured health coverage or benefits such as an Employee Assistance Program (EAP). This would be considered a “hybrid” entity situation and still may be subject to HIPAA breach consequences for any unauthorized disclosure of PHI.

What is a Business Associate?

A Business Associate is defined as any person or business that provides a service to, or performs a function or activity for, a Covered Entity when that action involves accessing PHI maintained by the Covered Entity. Accountants, IT contractors, lawyers, billing companies, cloud storage services, email encryption services are all examples of Business Associates.

To be in HIPAA compliance, Business Associates must sign a Business Associate Agreement with the Covered Entity before gaining access to PHI which details what PHI they can access, how they plan to use it, and that the PHI will be returned or destroyed once the need for it or task is completed. The Business Associate is under the same HIPAA compliance obligations as the Covered Entity while they are in possession of the PHI.

Physical Safeguards for HIPAA Security Rule Compliance

physical safeguards of HIPAA

Physical Safeguards for HIPAA Security Rule Compliance

  • Limit physical access to and control of facilities while still allowing authorized access.
  • Secure workstations and devices. Policies and procedures should specify proper, secure use of and access to workstations and electronic media as well as the transfer, removal, disposal, and re-use of electronic media, to protect electronic health information.

Technical Safeguards Help Ensure HIPAA Security Rules Compliance

Putting robust technical safeguards in place is not only necessary it also makes complying with HIPAA regulations easier, especially when data security solutions are coupled with automation to help reduce the risks of human error and reduce the compliance burden of a Covered Entity’s IT staff.

Per HIPAA’s Security Rule, Covered Entities must:

Control access

Control access by implementing policies and procedures that allow only authorized persons to access e-PHI.

Audit controls

Audit controls by putting hardware, software, and/or procedural mechanisms to record and examine all access and activity surrounding e-PHI.

Ensure the integrity of e-PHI

Ensure the integrity of e-PHI by implementing policies and procedures to ensure that the personal health information is not improperly altered or destroyed. Electronic measures must be put in place to confirm the integrity of e-PHI.

Secure transmission of e-PHI

Secure transmission of e-PHI by implementing technical security measures to guard against unauthorized access when the data is being transmitted over an electronic network.

Learn more about how HelpSystems can help with HIPAA Security Rule compliance

HelpSystems is the single provider you need to implement the technical safeguards healthcare organizations require to feel confident in their ability to meet stringent HIPAA Security Rule compliance mandates.