HIPAA

HIPAA Introduction

HIPAA stands for Health Insurance Portability and Accountability Act, passed by Congress in 1996. HIPAA aims to:

Provide the ability to transfer and continue health insurance coverage for American workers and their families when they change or lose their jobs.
Reduce healthcare fraud and abuse.
Mandate industry-wide standards for healthcare information on electronic billing and other processes.
Require the protection and confidential handling of protected health information (PHI).

HIPAA Rules

The Privacy Rule

Sets national standards for when PHI may be used and disclosed.

The Security Rule

Specifies safeguards that covered entities and their business associates must implement to protect the confidentiality, integrity, and availability of electronic PHI (ePHI).

The Breach Notification Rule

Requires covered entities to notify affected individuals, the U.S. Department of Health & Human Services (HHS), and in some cases, the media, of a breach of unsecured PHI.

Examples of HIPAA Rules in Practice

Do not discuss a patient's care with anyone not directly involved.
Do not discuss patient details with family, friends, etc.
Do not talk about patients in public areas.
Do not read patients' charts if you are not involved in their care.

HIPAA Compliance Audit Program

Initiated in 2011 by the Office for Civil Rights to assess how well healthcare providers were implementing HIPAA Privacy, Security, and Breach Notification Rules.
The first round of audits in 2012 revealed significant compliance issues, with numerous violations, especially related to the Security Rule.

HIPAA Privacy Rule

What is the HIPAA Privacy Rule?

Protects all forms of PHI, including computer and paper files, x-rays, physician appointment schedules, medical bills, dictated notes, conversations, and information entered into patient portals.

What is PHI?

PHI includes eighteen personal identifiers such as names, geographical data smaller than a state, dates related to an individual, telephone numbers, email addresses, Social Security numbers, medical record numbers, health insurance beneficiary numbers, and biometric identifiers.

Notice of Privacy Practices

An example can be found on the OCR’s website, detailing the use and disclosure of PHI, marketing and fundraising protocols, and patient access to medical records.

HIPAA Security Rule

What is the HIPAA Security Rule?

Establishes safeguards to protect ePHI.

Technical Safeguards

Includes access control, audit controls, integrity controls, transmission security, and more.

Physical Safeguards

Involves facility access controls, workstation use, workstation security, and device and media controls.

Administrative Safeguards

Policies, sanctions, and training for employees, as well as contingency and disaster recovery plans, risk analysis, and risk management.

HIPAA Requirements for a Website

Key Requirements

Transport Encryption: Encrypt data transmitted over the Internet.
Backup: Ensure data is backed up and recoverable.
Authorization: Ensure data is accessible only by authorized personnel using unique, audited access controls.
Integrity: Ensure data cannot be tampered with or altered.
Storage Encryption: Encrypt data when stored or archived.
Disposal: Permanently erase data when no longer needed.
Sharing: Ensure third parties comply with HIPAA regulations and have a Business Associate Agreement in place.

Assessment of Simple Websites

Transport Encryption: Fail
Backups: Uncertain
Authorization: Uncertain
Integrity: Fail
Storage Encryption: Fail
Disposal: Uncertain
Business Associates: Fail

Other Security Concerns

IT Network Security

Essential for protecting PHI and ePHI across the organization's network.

Text Messages and Replacing Pagers

Ensure secure communication methods are used in compliance with HIPAA standards.

Summary

Decide on Risk Management Methodology: Choose an approach for managing risks.
Determine Your Maturity Level: Assess the organization's current maturity in risk management.
Conduct Risk Assessment: Identify and evaluate risks.
Conduct Decision Support: Analyze and choose risk mitigation strategies.
Implement Controls & Measure Effectiveness: Put controls in place and monitor their effectiveness.

This structured approach ensures comprehensive protection of health information in compliance with HIPAA regulations.