What is HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) was initiated in 1996 to develop regulations protecting the privacy and security of healthcare data. As a result of this work, the Federal Department of Health and Human Services (HHS) published the following privacy protection standards:
The Privacy Rule
The Security Rule
HITECH Act (Health Information Technology for Economic and Clinical Health Act)
Hand-in-hand with HIPAA is the HITECH Act (Health Information Technology for Economic and Clinical Health Act), which passed in 2009 and urges health providers to:
- Adopt electronic health records (EHR) to improve quality of patient care
- Adhere to expanded data breach notification requirements
- Secure ePHI data using appropriate privacy protections
Both HIPAA and HITECH address ePHI security, but measures within HITECH support the enforcement of HIPAA through the Breach Notification Rule and the HIPAA Enforcement Rule.
Consequences of Not Complying with HIPAA
The need to share health data is there – by hospitals, clinics, insurers, research facilities, pharmacies, and public health organizations. However, very specific guidelines around how this information can be stored and shared are needed to ensure patient privacy. Breaching the trust of individuals who’ve entrusted their data comes with consequences.
According to HIPAA security laws and regulations for professionals, the Office for Civil Rights (OCR) within the HSS is responsible for enforcing Privacy and Security Rules, establishing compliance requirements as well as for levying civil monetary penalties.
Organizations that fail to comply with HIPAA regulations can see substantial fines levied against them, even if no actual PHI breach occurs. In addition, criminal charges and even civil action lawsuits can be filed following a breach. And it should be noted: ignorance of HIPAA compliance requirements doesn’t pass muster as a defense against violations sanctions. The OCR issues fines whether a violation is inadvertent or is the result of willful neglect.
Ensuring your administrative policies and procedures, physical protection, as well as technical solutions as a Covered Entity or Business Associate are in place can go a long way in keeping off the OCR’s radar.
What is a Covered Entity?
A Covered Entity is any health care provider, health plan, or health care clearinghouse who, as part of their day-to-day business, creates, maintains, or transmits PHI. There are a few exceptions, including:
- Most health care providers employed by a hospital, as the hospital itself is the Covered Entity and therefore the party responsible for implementing and enforcing HIPAA compliant policies.
- Employers, even though they may maintain some health care data on employees. They are exempt unless they provide self-insured health coverage or benefits such as an Employee Assistance Program (EAP). This would be considered a “hybrid” entity situation and still may be subject to HIPAA breach consequences for any unauthorized disclosure of PHI.
What is a Business Associate?
A Business Associate is defined as any person or business that provides a service to, or performs a function or activity for, a Covered Entity when that action involves accessing PHI maintained by the Covered Entity. Accountants, IT contractors, lawyers, billing companies, cloud storage services, email encryption services are all examples of Business Associates.
To be in HIPAA compliance, Business Associates must sign a Business Associate Agreement with the Covered Entity before gaining access to PHI which details what PHI they can access, how they plan to use it, and that the PHI will be returned or destroyed once the need for it or task is completed. The Business Associate is under the same HIPAA compliance obligations as the Covered Entity while they are in possession of the PHI.
HIPAA Security Rule Checklist
There are three categories of safeguards to help ensure the HIPAA Security Rule is adhered to by covered Entities and Business Associates – administrative, physical, and technical.
Administrative Safeguards to Meet HIPAA Security Rule Requirements
Identification and analysis
Designate a security official
Manage information access
Training and management of workforce
Evaluation of Policies and Procedures
Physical Safeguards for HIPAA Security Rule Compliance
- Limit physical access to and control of facilities while still allowing authorized access.
- Secure workstations and devices. Policies and procedures should specify proper, secure use of and access to workstations and electronic media as well as the transfer, removal, disposal, and re-use of electronic media, to protect electronic health information.
Technical Safeguards Help Ensure HIPAA Security Rules Compliance
Putting robust technical safeguards in place is not only necessary it also makes complying with HIPAA regulations easier, especially when data security solutions are coupled with automation to help reduce the risks of human error and reduce the compliance burden of a Covered Entity’s IT staff.
Per HIPAA’s Security Rule, Covered Entities must:
Control access
Control access by implementing policies and procedures that allow only authorized persons to access e-PHI.
Audit controls
Audit controls by putting hardware, software, and/or procedural mechanisms to record and examine all access and activity surrounding e-PHI.
Ensure the integrity of e-PHI
Ensure the integrity of e-PHI by implementing policies and procedures to ensure that the personal health information is not improperly altered or destroyed. Electronic measures must be put in place to confirm the integrity of e-PHI.
Secure transmission of e-PHI
Secure transmission of e-PHI by implementing technical security measures to guard against unauthorized access when the data is being transmitted over an electronic network.
HIPAA Security Rule Technical Solutions from Fortra
Covered Entities and Business Associates meet their HIPAA Security Rule obligations through proven, robust technical solutions, regardless of infrastructure, end-to-end. Fortra's best-of-breed and simple to deploy and manage solutions not only can safeguard health care information, meet critical HIPAA compliance requirements, and help avoid making security breach headlines, they also can assist your organization in increasing efficiency and productivity by seamlessly integrating automation into your critical health care business processes with minimal impact on internal resources and productivity.
Solutions include:
Data Loss Protection (DLP)
Secure Managed File Transfer (MFT)
Data Classification
Digital Rights Management (DRM)
Security and Compliance Solutions for IBM i
Learn more about how Fortra can help with HIPAA Security Rule compliance
Fortra is the single provider you need to implement the technical safeguards healthcare organizations require to feel confident in their ability to meet stringent HIPAA Security Rule compliance mandates.