Electronic Health Reporter

By Ken Lynch, founder, Reciprocity.

The HIPAA outlines the standard security practices that organizations handling protected health information (PHI) need to adhere to. Whether your business is compliant with the HIPAA or not can have a huge impact on how you handle your business. If you are non-compliant, you risk being involved in data breaches, which results in a domino effect. A single breach can lead to the loss of valuable customer data, expensive lawsuits, PR nightmares, and even the loss of your business. 

Even without a data breach affecting your business, you still need to be compliant to be competitive in the health industry. Security-conscious businesses in the industry will only agree to do business with you as long as you are compliant. Lastly, compliance will help you evade fines from regulatory bodies as well as appearing on the wall of shame, which is a site that lists health-related organizations that have undergone data breaches. Lucky for you, as long as you commit to understanding HIPAA compliance, it will typically be quite easy for you to know what to do. 

Here are some insights on managing HIPAA compliance for your business:

What To Expect?

If you are supposed to be HIPAA compliant, you will either be a covered entity or business associate. Covered entities are organizations that have direct access to the customer and their PHI (doctors, insurance companies, and pharmacies). Business associates, on the other hand, work with the covered entities in a non-healthcare capacity, and they have access to PHI. These can be lawyers, IT personnel, accountants, and administrators. Regardless of where you fall, you need to adhere to four HIPAA rules:

1. The Privacy Rule

This rule looks to protect the privacy of PHI. It outlines how and when actors in the health industry can and cannot use health data. The data it protects includes past, present, and future health information of protected individuals, payment data, the details of the care any individual was provided with, contact information, identifying numbers (ID and social security numbers), and even fingerprints. 

2. The Omnibus Rule

The Omnibus rule outlines how business associates should carry themselves out and how they interact with the covered entity. Recent updates to this rule expanded the omnibus rule to storage companies, sub-contractors, and even consultants. It prohibits actors from using PHI for the wrong reasons such as marketing or using genetic information to underwrite insurance policies. 

3. The Security Rule

The security rule is meant to control how businesses handle electronic Protected Health Information (ePHI). It requires businesses to have the right safeguards for protecting the confidentiality security and integrity of ePHI. These safeguards are divided into three, including:

• Physical safeguards– which protect data access physically. This will apply when the electronic data needs to be accessed through an office, a building, or even on the devices of employees at home. You will be required to implement safeguards that limit physical access to areas that house data, such as through using security padlocks and fingerprints to limit access to data centers
• Technical safeguards– these are meant to protect ePHI in the digital world. You will need to invest in tools and software that will give you control over who has access to what. Under the HIPAA, access should be limited to only when an actor needs to use health data. 
• Administrative safeguards– these are policies and procedures you need to create and apply for data access control purposes, as well as protecting the integrity of the data. You should use these safeguards to limit access by employees, business associates, and customers. The safeguard should also include a Business Associate Agreement that you will hold with third-party vendors. This agreement should outline how your vendors can interact with your data and business in relation to the HIPAA.  

The HIPAA Enforcement Rule

The enforcement rule outlines how you should handle HIPAA violations, as well as the process for reporting them. In case of a violation that led to a data breach, you will need to report this with the OCR (Office of Civil Rights). You will need to fix the security issue and try to mitigate the effects of the data breach to the satisfaction of the OCR. If the response to the breach wasn’t good enough, the OCR can fine you depending on the number of violations your organization was involved in.

Train Your Workforce Accordingly

Implementing all the necessary security controls will be worthless if you don’t train employees on HIPAA compliance and how their daily operations tie into it. It can be pretty easy for employees to make mistakes that lead to a violation. Even worse, insider threat is big in the healthcare industry, and training employee can help limit it. 

In fact, the healthcare industry is the only one that has more data breaches arising from internal threats than external attacks. Be sure to craft training models that will spread security awareness. You should also track the effectiveness of the training to make the necessary changes in areas where it falls short. Lastly, keep tabs on updates in the HIPAA to ensure that your workforce is always updated.

HIPAA is meant for the good of the entire health sector. Since keeping tabs on all the requirements isn’t easy, you should consider using compliance software to do so. Follow the above tips to avoid being involved in HIPAA violations.