What is HIPAA Compliance?

Are you looking to learn more about HIPAA compliance and how it impacts individuals and businesses alike? You’ve come to the right place. Let’s take a closer look at the HIPAA security rule and how to remain compliant.

What is the HIPAA Security Rule and HIPAA Compliance?

Defining the HIPAA Security Rule

The HIPAA Security Rule was created in order to set the standards for the management of electronic protected health information (ePHI), including how the information was created, received, maintained, and transmitted by a covered entity. It clearly defines the administrative, physical, and technical safeguards of HIPAA that qualified organizations must adopt and execute to ensure the integrity of obtained health information. Given the healthcare industry’s increasing reliance on electronic systems, the Security Rule is a standout component of HIPAA.

Defining HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) sets the national standard for patient data protection. Companies that handle protected health information (PHI) must incorporate data security measures that align with HIPAA regulation. These measures should effectively secure patient data – whether this data was obtained from a medical visit, data discovery, or a third party. Compliance is required of healthcare providers, health plans, healthcare clearinghouses, and business associates, or else the covered entities could face fines of up to $50,000 per violation. 

Related: What is HIPAA Compliance? Tips for Being Compliant 

Who does HIPAA Cover?

According to HHS.gov, the Security Rule applies to any health care provider who transmits health information in electronic form in connection with a transaction that has adopted HIPAA standards. 

Covered entities include:

• Healthcare Providers – hospitals, clinics, nursing homes, pharmacies, and physicians.
• Health Plans – health insurers, corporate health plans, HMOs, Medicaid, and Medicare.
• Healthcare Clearinghouses – public or private entities, such as a billing service or repricing company, that process nonstandard health data into a standard format.
• Business Associates – third-party individuals or entities that perform functions on behalf of a HIPAA covered entity involving protected health information. Accounting firms and attorney offices can fall into this category.

Simultaneously, HIPAA guides covered entities to compliance while granting patients access to their health information. Upon request, an individual can obtain a physical or electronic copy of their medical records or have their health information sent to a caregiver. They can also gain access to their PHI in mobile apps supported by encryption and personal logins. 

What types of information is protected under HIPAA?

PHI – Protected Health Information – relates to the health or condition of a specific person, and can potentially be used to identify, locate, or contact that person if leaked or hacked. 

The following qualifies as PHI:

• Diagnoses
• Medical test results
• Prescription information
• Social Security Numbers
• Birth dates
• Gender
• Ethnicity
• Emergency contact information

HIPAA is set in motion by PHI. Thus, if an organization has failed to protect PHI, it has failed to comply with HIPAA standards.

What are common HIPAA violations?

• Keeping unsecured records: The whereabouts of PHI should always be known, and only eligible healthcare professionals should be able to access it. Digital records should be encrypted and password-protected, and physical records should be kept in a locked desk or filing cabinet. 
• Unencrypted data: Hackers are always circling the waters for information exploitation, which should prompt your organization to encrypt all PHI for added security. Though HIPAA does not mandate data encryption, it is strongly encouraged.
• Loss or theft of devices: Unsecured records and unencrypted data lead to the loss or theft of devices. Taking the proper security measures with your data systems will keep sensitive information out of the wrong hands.
• Lack of employee training: As employees are responsible for protecting personal health information and executing compliance tactics, they must be adequately trained on the various HIPAA policies and stipulations. Poor training or a lack of training will risk non-compliance.

One instance of data security oversight could cost your company substantial financial loss as well as a tarnished reputation. HIPAA enforces ways to avoid the above violations. HIPAA IT compliance urges covered entities to protect ePHI with unique identifiers, passwords, and encryptions. The Act also pinpoints parameters for workforce training and management. Therefore, the responsibility is on the covered entity to fall in line with regulations and approach vulnerabilities with supreme discipline.

Checklist to become HIPAA compliant

When spearheading a compliance program, or updating one, it’s wise to take notes from the most reputable source. The Department of Health and Human Services published The Seven Fundamental Elements of an Effective Compliance Program. 

They read as follows: 

1. Implementing written policies, procedures, and standards of conduct.
2. Designating a compliance officer and compliance committee.
3. Conducting effective training and education.
4. Developing effective lines of communication.
5. Conducting internal monitoring and auditing.
6. Enforcing standards through well-publicized disciplinary guidelines.
7. Responding promptly to detected offenses and undertaking corrective action.

The appointment of a Designated Protection Officer (DPO), or compliance officer, is not required for covered entities per HIPAA, though the move is highly recommended. 

Your DPO and his or her assigned committee should have one goal: To remain compliant. They Will be responsible for conducting audits, monitoring and enforcing regulation updates, and creating training material. Compliance is a collective effort, so widespread HIPAA knowledge throughout your staff is imperative.

The Seven Elements will certainly get your compliance program off to a promising start. If your organization can treat them as a priority, and with constant discipline and effort, then HIPAA compliance should result. 

Furthermore, the administrative, physical, and technical safeguards referred to by the Security Rule can help mold your compliance program. 

Administrative safeguards consist of:

• Risk analysis – analyze current systems, processes, and protocols to determine risk. Then, make the necessary adjustments to eliminate risk and sure up security measures.
• Incident Reporting – establish a foolproof incident reporting procedure and communicate it across pertinent departments. Explain the procedure, in addition to the steps following the report. 
• Staff training – employees need to be trained on how to handle ePHI, from processing to securing. They should also be trained on how to detect cybersecurity threats. 
• Access control – ensure only authorized staff members have access to PHI – through passwords, codes, unique identifiers, and keys (if data is stored physically). Also, ensure unauthorized individuals have no way of gaining access.

Physical safeguards consist of: 

• Workstation policy – inform staff how they are to manage their workstations. Set expectations on screen protection, desk visits, and procedures for when an employee steps away from his or her workstation. 
• Monitor servers – know precisely what information is being stored in servers, and ensure all information is accounted for and copied before moving servers.

Technical safeguards consist of: 

• Audit reports – log any attempts of cybersecurity attacks and allow access to the reports for necessary security adjustments to be made.
• Encryption – networks, devices, and any other data-handling sources should be encrypted to protect ePHI.
• Control access – assign unique logins and PINs to allow only authorized access into databases. 

The Role of Data Discovery 

Covered entities are met with the great challenge of leveraging significant amounts of user data while also securing it and keeping it accessible. That’s where data discovery comes into play. 

Data discovery organizes data platforms through the precise processing, managing, and allocating of obtained online information. In a split second, you’ll be able to find PHI requested by a healthcare professional or patient. Also, your organization and its clients, or third party contributors, will benefit from a secure transfer of data.

Effective data discovery software will:

• Trace all forms and sources of data – structured, unstructured, in the cloud, on servers.
• Operate in accordance with data privacy regulations, including HIPAA, GDPR, CCPA, and more.
• Find and discover an infinite amount of sensitive information while categorizing it and calibrating it for keyword searches.

Ultimately, your organization will advance its control of essential data and have the processes in place to ensure HIPAA compliance.

What happens if businesses don’t comply?

Non-compliance can result in a range of penalties. Fines can be as low as $100 per incident and as high as $50,000 per incident. Organizations that violate HIPAA through willful neglect and fail to take corrective measures may face an annual fine of $1.5 million. 

The degree of monetary punishment is based on four determinants:

1. The violation was unknown. In other words, the offender was completely oblivious to their action, or inaction. Fines span $100 to $50,000 per violation.
2. The violation was a result of reasonable cause. The offender should have been aware of the violation, though it couldn’t have been avoided even with reasonable effort. Fines span $1,000 to $50,000.
3. The violation was a result of willful neglect, but the error was corrected within the required time period. Fines span $10,000 to $50,000.
4. The violation was a result of willful neglect, plus the error was not corrected. Maximum fine of $50,000.

Jail time is possible. Covered entities whose violations fall under the “willful neglect” category could be charged criminally, and a year in jail may ensue. It’s also worth noting that repeat violations typically result in fines two-to-four times the initial amount. 

Other Common HIPAA Compliance FAQs

What are the guidelines for HIPAA?

The U.S. Department of Health and Human Services (HHS) outlines four general rules for covered entities:

1. Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain, or transmit. 
2. Identify and protect against reasonably anticipated threats to the security or integrity of the information. 
3. Protect against reasonably anticipated, impermissible uses or disclosures.
4. Ensure compliance by a covered entity’s workforce. 

What is a “Business Associate”?

Business associates fall under HIPAA compliance if performing activities or functions that involve PHI and are on behalf of or as a service to a covered entity. The covered entity must gain assurance that the business associate can properly handle PHI. This is typically done through a written contract between the two parties. 

Is there a HIPAA compliance certification?

There are organizations that will review a covered entity for compliance, and perhaps issue a certification for affirmation. However, there is no “official” HIPAA compliance certification. Neither the Department of Health and Human Services (HHS) nor the Office for Civil Rights (OCR) issue certificates.

Related articles

• HIPAA Compliance
• What is HIPAA Compliance? Tips for Being Compliant
• Personally Identifiable Information: HIPAA Facts and Best Practices 

Guarantee your data protection by contacting Ground Labs, a data solutions company entirely devoted to helping organizations fulfill compliance standards. On servers, on desktops, or in the cloud, we’ll keep your ePHI secure.