Jan 2
2020
3 Ways to Ensure HIPAA Compliance with Patient Privacy
By Melanie Purkis, product leader, Liquid Web.
Overall, advancements in technology fueling this are a step in the right direction. That said, there are side effects to this trend that put sensitive patient data at risk.
Healthcare organizations are rife with sensitive personal data, ranging from health records to social security numbers, birth dates, and addresses. This makes them an appealing target for cybercriminals looking to steal and profit from that information. One recent survey reports that the majority of hospitals (82 percent) have had a significant security incident in the past year.
Healthcare organizations must protect sensitive patient data as mandated by the Health Insurance Portability and Accountability Act (HIPAA), the regulatory framework for the healthcare industry. As breaches continue to rise, healthcare providers and others in the industry must understand how to properly secure this sensitive data.
Here are three ways to ensure HIPAA compliance with patient privacy.
Ensure Technical Safeguards are in Place
Healthcare organizations must protect sensitive patient data from external and internal threats. While digital health records may improve efficiency, this electronically protected health information (ePHI) must be kept safe via technical safeguards.
This includes access and audit control requirements that determine access control capabilities for all information systems that have ePHI and ensuring that activity within these systems can be traced back to specific users. Organizations also need formal policies for access control.
Authentication and integrity are also critical, meaning that healthcare organizations must protect ePHI from being altered or destroyed and must also secure that data while stored at rest. Authentication can be accomplished via digital signatures, checksum technology, and error-correcting memory.
Data in motion must also be secured, especially with the proliferation of electronic medical records (EMR) and health information exchanges (HIEs). Healthcare organizations must be able to securely transmit patient medical records between facilities.
Apply Administrative Safeguards
Healthcare organizations bear responsibility for both Protected Health Information (PHI) and Personally Identifiable Information (PII), which requires the proper categorization of each type of data. Each type of data requires its own unique treatment, making it paramount that the information is properly classified.
Administrative safeguards break down into the following categories:
- Security management process
- Assigned security responsibility
- Workforce security
- Information access management
- Security awareness and training
- Security incident procedures
- Contingency plan
- Evaluation
These areas help organizations implement policies and procedures to guide employees in the proper care and use of ePHI. This may include security training requirements along with a delegation of security responsibilities within an organization.
Prepare for Compliance Audits
It may sound obvious, but preparing for and submitting to compliance audits on a regular basis can help healthcare organizations stay in check and avoid expensive HIPAA fines. By employing a feedback loop based on the results of reviews, organizations can inform future decisions regarding security. Organizations should be conducting internal reviews ahead of scheduled audits to go over daily logs and to seek out anomalies, errors, and other suspicious activity that could signal a threat.
More than simply scanning for these anomalies, organizations must also have an appropriate and measured response mechanism in place. The ability to quickly respond to security issues is incredibly important and requires documentation and training.
This new digital environment makes for exciting new opportunities in the healthcare space. Unfortunately, it also brings with it new threats and security concerns that must be addressed. HIPAA compliance requires a comprehensive strategy to protect PHI and PII, including the right technology, the right safeguards, and the right training.