The U.S. Department of Health and Human Services has reported that in 2023 alone more than 540 organizations have breached HIPAA compliance, impacting 112+ million individuals. 77% of these violations were caused by cybersecurity breaches, with hacking, unauthorized access, and theft being the top three reasons. Besides impacting individuals, organizations paid millions of dollars in non-compliance, with the most expensive fine being $1.3 million.
These numbers bring up an important question – how can you protect your organization from these breaches? More importantly, how to avoid non-compliance?
Read on, as we talk about HIPAA, its coverage, compliance, and the IT checklist that can safeguard your data and help with compliance.
What is HIPAA?
The Health Insurance Portability and Accountability Act or HIPAA, in short, is a framework for safeguarding Protected Health Information (PHI) in healthcare organizations. This regulation ensures the safety and integrity of patient data, thereby enhancing trust in the operations of healthcare providers.
Specifically, HIPAA lays down guidelines on how critical patient data must be stored, accessed, and shared to protect the fundamental rights of Americans. These national guidelines provide patients more control over their data while restricting its access to unauthorized persons. Violations of these guidelines can result in hefty fines for organizations.
Who Should Comply With HIPAA?
HIPAA applies to healthcare companies that operate in the United States of America or organizations operating outside the U.S. but handling the records of U.S. citizens.
According to HIPAA, the organizations that must comply with its regulations are called “covered entities”, and they are
- Health plans, HMOs, company health plans, and certain government programs like Medicare and Medicaid.
- Health insurance providers.
- All healthcare providers, including doctors, clinics, hospitals, psychologists, chiropractors, dentists, and pharmacists.
- Every healthcare organization that offers healthcare electronically and bills a healthcare insurance provider.
- Healthcare clearinghouses that process the nonstandard health data received from others into standard formats, or vice versa.
Besides the entities mentioned above, the following business associates who handle transactions with the covered entities also come under HIPAA.
- Companies that process or help with payments for doctors.
- Any company that processes healthcare claims or billing.
- Organizations that administer health plans.
- Lawyers, IT specialists, accountants, and others who handle patient data.
- Companies that are responsible for storing or destroying patient data.
If your organization falls in any of these categories, you must follow HIPAA guidelines to avoid facing fines later. These regulations apply to your employees, interns, volunteers, students, and contractors who are under the direct control of the organization, regardless of whether they are paid or not.
Next, let’s see what kind of information is covered by HIPAA, so you can formulate policies and processes only for this data, especially if you handle data from multiple sources.
Information Protection Under HIPAA
Below are the kinds of data that are covered by HIPAA.
- Any information added by doctors, nurses, and healthcare providers that becomes a part of a patient’s medical record.
- Patients’ conversations with doctors and nurses about their health condition and the possible treatment and care.
- Any personal information about a patient that’s stored in the health insurance providers’ systems.
- Billing information at the clinic.
- Any health information that’s identifiable or specific to an individual.
Besides protecting them, you must also exercise caution while sharing it with third parties, including the family and friends of the patient. HIPAA allows you to share information only with the following entities and for specific purposes only.
- Any data that’s required for a patient’s treatment or care.
- Information to pay doctors, nurses, and healthcare providers for the services offered and to enable them to continue running their business.
- Family, friends, and relatives of the patient, provided the patient approves their access or if the patient explicitly declares that they are involved in the patient’s care.
- Police, provided they have to be reported like gunshot wounds.
- Public health authorities to help them understand outbreaks in your area.
- Nursing homes to ensure good and timely care.
- Researchers provided the patient explicitly authorized to provide information after understanding that it would be used for research purposes.
Besides sharing data with the above entities, you must ensure that patient data is always accessible to the respective patients when they request it.
Now that you know what data is covered under HIPAA, let’s discuss how you comply with them.
How to Comply with HIPAA?
Complying with HIPAA is complex and tedious, and this is why there’s a growing number of non-compliance cases. Below are the broad steps that can help with HIPAA compliance.
Step 1: Understand the Provisions
As a first step, know if HIPAA applies to your business, and if yes, to what parts or data. Based on this understanding, you can formulate appropriate policies and guidelines. Also, understand which HIPAA provisions apply to your organization, so you can focus on just their implementation.
Step 2: Appoint Officers
To ease your job and reduce non-compliance, consider hiring officers to oversee operations. For example, if the privacy laws of HIPAA apply to your organization, hire a Privacy Officer. Similarly, if the security aspects apply, hire a Security Officer.
Note that HIPAA’s policies are evolving, and this is why it helps to have dedicated officers who can stay on top of these changes and ensure your organization’s compliance with them.
Step 3: Know the Data Types to Protect
Earlier, we discussed what data you must protect. Understand what constitutes Protected Healthcare Information (PHI) from the above data. Typically, the following information is considered as PHI.
- Name
- Social Security Number
- Health plan beneficiary number or other data that identifies the plan to an individual.
- IP addresses that can point to the patient’s location.
- Current and past addresses of a patient.
- Medical history of the patient.
- Account numbers of banks.
- Birth date.
- Medical record number.
- Any kind of biometric identifier.
- Names of relatives.
- Contact information, including phone numbers, email addresses, and other personal information.
- The results of any test or diagnosis.
- Patient photos.
- Doctor’s notes, conversations with doctors or nurses, and other discussions related to a patient’s healthcare.
- Any information that has unique identifiers or can be traced to a patient.
Know which of the above PHI is handled by your organization and the processes around its storage, transmission, and usage. Ideally, establish clear guidelines for these types of PHI to ensure they never violate HIPAA’s regulations.
Step 4: Audit your Processes
Do a thorough audit regularly to understand how your PHI is stored, handled, processed, and transmitted, so you can determine if they meet the established guidelines of HIPAA. More importantly, check how it is shared with business associates and third parties, as this is one of the critical areas that could lead to potential non-compliance.
Step 5: Simplify PHI
Based on your audit, minimize the number of records that handle PHI. You can consolidate them to simplify their handling and management. In turn, this will reduce the security controls and processes you must implement and monitor.
Step 6: Understand the Security Rule
The Security Rule of HIPAA requires you to put in place appropriate administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and security of patient data. You can view this rule in 45 CFR part 160. Map this Security rule to the controls in your organization’s operations.
Step 7: Create Processes for Reporting Breaches
Despite the best-laid efforts, breaches can happen. However, you have the option to minimize its impact and reduce your non-compliance rates. Create processes and a well-defined procedure for reporting any data breaches. Back it up with a remediation plan to minimize exposure and protect patient data.
Also, covered entities of HIPAA must report violations and breaches to the State Attorneys General. Check if your organization has this exemption. Otherwise, understand the reporting process and structure and inform the State Attorney General as soon as possible.
Step 8: Stay Updated
As with any regulation, HIPAA is constantly changing to meet the growing security threats. Make sure you are updated on these changes. Create a process or appoint specific individuals who can monitor these changes and translate them to your organization’s operations.
All the above steps are continuous. Depending on your HIPAA coverage levels, you may even have to appoint dedicated resources to oversee the above processes.
In today’s digital environment, where all records are digitally stored and processed, organizations require a separate IT checklist to ensure that their systems are protected to avoid cyberattacks.
IT Checklist for HIPAA
The IT department of organizations has a central role to play in ensuring HIPAA compliance. This department is responsible for establishing and monitoring security controls that ensure the safety, protection, and integrity of patient records while providing access to authorized entities. This balancing act is not easy given the growing sophistication of cyberattackers.
Moreover, there are no specific IT requirements from HIPAA. Only the Security Rule we discussed earlier must apply to electronic PHI (ePHI) and safeguard it. Also, resource availability and scope of operations can vary among organizations, with typically smaller organizations having limited resources and smaller budgets when compared to large organizations. Due to these variances, there is no standard policy and it’s up to the individual organizations to formulate and implement an IT checklist that will safeguard data.
Below is a sample IT checklist that you can implement to meet HIPAA’s compliance requirements. Note that this is not fixed and you can modify these checklist guidelines to suit your organization’s HIPAA requirements.
Consolidate Regulations
As a first step, consolidate all applicable federal, state, and local laws to your business, including HIPAA. Also, include any specific standards or frameworks that your organization must comply with. Identify the commonalities in these laws and regulations and create standard processes that will help your organization adhere to their provisions.
Streamline Password Policy and Management
Passwords are the first line of defense in a digital environment. Put in place a secure and stringent password policy that could require users to change their passwords frequently, create complex passwords, avoid password reuse, and other provisions. Such measures can reduce cyberattacks like brute force that criminals use to guess a password and gain access to the system.
Conduct Regular Training
Conduct regular training for employees to keep them aware of social engineering attacks like phishing and whaling. Provide a clear set of guidelines and processes they must follow when they receive phishing emails, including instructions on how to identify them.
Create Disaster Recovery Plans
Create disaster recovery plans and send them to all the relevant stakeholders, so everyone knows what must be done when a data breach occurs. Also, assign responsibilities to specific individuals or roles to take remediation steps
In general, prepare for the possibility of attacks, and know what steps are required including the shutting down of compromised systems when needed. Test these disaster recovery plans and refine them as needed.
Automate Monitoring and Reporting
Monitoring IT systems is difficult and even impossible in large organizations. Consider automating the monitoring and reporting processes using a robust monitoring tool. Also, understand what kind of reports you need and look for templates that your tool can auto-fill.
Document Everything
Documentation is an overlooked aspect of compliance. However, you need a record of what happened and how a situation was handled. This is where documentation comes in handy, and you can even use it for training and analysis purposes. At the same time, make sure your documents are secure, especially if they contain any PHI.
Create Visualizations like Maps
Sometimes, understanding the link between the HIPAA compliance process and your organization’s operations is not easy. This is where mapping the controls helps. Make sure to map each process with the controls that it can impact to simplify and visualize this complex process.
Build Scalable Processes
As your organization grows, the complexity of compliance is only going to increase. Consider building scalable processes upfront to ensure that they can cover a wide range of scenarios and use cases to meet the growing needs of your business.
Thus, these are some IT checklist suggestions that you can implement to protect ePHI from unauthorized access and the resultant non-compliance with HIPAA.
Implementing the above suggestions is only one side of the coin. How do you measure their effectiveness? That’s where audits are necessary.
HIPAA Audit
Audits are an important way for organizations to continuously identify gaps in compliance and address them with the right measures. You can appoint specialist HIPAA auditors or use automated platforms to identify the areas of improvement.
Note that the Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) is the regulatory authority for checking compliance with HIPAA privacy and security rules. OCR has released a report that provides insights into how it checks for compliance, and you can use this report as a guideline for creating a customized audit.
Alternatively, you can leverage tools that check for compliance and use them to audit your security and IT processes. In case of identified vulnerabilities or gaps, make sure to prioritize and fix them.
Tips and Tricks for HIPAA Compliance
As mentioned in this article, there’s no specific process or checklist for compliance. Only the end goals of the compliance are laid down, and the steps to achieve them depend on the organization’s resources, the level of compliance required, and the existing guidelines in place. S is where the skills and experience of the privacy and security officers will come in handy to create a checklist and processes for compliance.
Nevertheless, here are some tips and tricks for meeting HIPAA compliance.
- Secure all remote access to data, especially if your organization supports a remote working environment.
- Conduct regular audits of devices.
- Check for IP addresses and have a firewall or Intrusion Prevention System in place to block malicious IP addresses.
- Evaluate your security awareness program and make sure it covers the latest threats.
- Create programs that promote behavioral change in employees from a security standpoint.
- Monitor social media use within the organization.
- Double-check the security provisions of your vendors.
- Keep your software and devices up-to-date. Also, avoid end-of-support software.
These tips can help you create a custom checklist that will ensure compliance with HIPAA’s provisions.
Final Thoughts
In summary, HIPAA is a U.S. federal law and one of the most stringent regulations available today because it deals with patient data. Since privacy and security are enshrined in the U.S. Constitution, any violation of these fundamental rights is dealt with seriously. HIPAA also levies hefty fines, sometimes even more than a million dollars, for discrepancies and non-compliance with its Security and Privacy rules.
In this article, we discussed in detail what HIPAA is and who is covered under it. We also talked about the broad compliance steps and the specific things you can do from an IT standpoint. The latter is important because most records are stored digitally and with the growing proliferation of cyberattacks, organizations find it increasingly hard to meet HIPAA’s guidelines. We hope the checklist suggestions and tips help create custom processes that align with your organization’s operations.