--
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 and created to ensure that sensitive patient information remains protected. Organizations must secure Protected health information (PHI) through administrative, physical, and technical safeguards.
By establishing an industry standard for healthcare organizations and vendors alike, those working in every capacity of healthcare must be HIPAA compliant or face significant penalties.
If your company does business within the healthcare industry, you must follow specific requirements to be HIPAA Compliant.
The HIPAA Act determines how organizations can store, share, manage, and record PHI. If you are a company providing treatment, payment, or healthcare operations, you are considered a Covered Entity (CE).
If you are a company providing a third-party service and use PHI to do business with a CE, you are considered a Business Associate (BA). Under HIPAA, both CE and BA organizations must be compliant with the law.
The HIPAA Privacy Rule and Covered Entities (CE) as Business Associates (BA)
HIPAA implementation and enforcement remains a top priority, and the stakes are high. CEs and BAs need to understand the HIPAA act clearly and adhere to standards to ensure PHI security by completing annual self-audits and vetting their vendors.
In order to limit risks from a data breach, healthcare organizations and those who support them have an obligation to implement "reasonably appropriate" protections to secure a patient's PHI.
Since BAs don't work directly with PHI, the HIPAA Privacy Rule applies only to CEs. This rule outlines policies and procedures for organizations that are required and explicitly developed to reflect current business practices ensuring that PHI gets appropriately managed and administered. Internal staff must be trained on these policies and procedures as well as HIPAA standards overall.
To demonstrate that all employees are properly trained, annual training must be documented and signed off on with employee attestations as a binding legal acknowledgment that the employee has undergone HIPAA training and will follow the presented policies and procedures.
CEs must adhere to the "minimum necessary rule" which states that organizations should access only the PHI they need to perform their job functions.
The HIPAA Security Rule applies to both CEs and BAs as the industry standard for handling, maintaining, and transmitting PHI.
To ensure the confidentiality, integrity, and availability of PHI, CE and BA organizations must implement administrative, physical, and technical safeguards.
A recent HIPAA Journal article indicates some surprising discoveries regarding the top HIPAA threats. Making the point that the top HIPAA and cybersecurity threats are not external hackers or nefarious organizations but in fact employees. The article specifically refers to a Threat Intelligence Report showing an unexpected statistic: 71% of healthcare industry data breaches are attributed to employee errors and actions.
HIPAA violations fall under three categories:
The majority of data breaches occur in this category due to stolen or lost data that was not appropriately encrypted. Encrypting information is a safeguard that comes into play if a PHI device is breached or hacked. Encryption is not a strict HIPAA requirement, but you can still receive penalties if PHI is compromised due to unencrypted data, so it is strongly recommended.
Self-explanatory, this category involves losing a device that has PHI on it. No organization can eliminate the risk of theft, so encrypting the data and protecting the device with strong passcodes is a safeguard against unauthorized data access.
These are breaches that occur due to ill-trained employees that can include when a staff member:
Staff who handle and manage PHI are required to be properly trained on HIPAA regulations so these breaches occur less often.
HIPAA compliance is challenging and comes at a cost. Whether you are a Covered Entity or a Business Associate, the Health & Human Services (HHS) impose stiff penalties for HIPAA violations.
CEs have a more complex compliance task because their HIPAA implementation depends not only on their own actions but also on their BA vendors.
The cost of noncompliance to HIPAA is based on the perceived level of negligence and ranges from $100 to $50,000 per individual violation, with a maximum penalty of $1.5 million per calendar year of infringements. Even worse, violations can result in jail time for the individuals responsible if the level of negligence warrants.
HIPAA noncompliance penalties are categorized into four tiers:
If the HHS decides that deliberate, malicious activity has occurred, the Department of Justice (DOJ) can and will get involved with criminal penalties possible.
eTrepid is a Compliancy Group HIPAA Verified IT MSSP focused on healthcare and defense agencies who need to safeguard patient information while completing their mission. We work with medical and DoD organizations, covered entities, and business associates who need to comply with HIPAA.
As a certified HIPAA Seal of Compliance holder, eTrepid verifies that your organization's policies and procedures are compliant based on the evidence collected and monitors your data to ensure it remains compliant.
We perform a gap analysis to identify where you are in your compliance journey and provide a roadmap to become compliant (POAM/mitigation plan). We have certified compliance methods that monitor and verify your processes so that we can immediately mitigate any issues that occur and reduce your threat exposure.
Verify our Seal of Compliance!
Find out what it truly takes to secure privacy in the midst of the COVID-19 pandemic as work environments change and healthcare workers are inundated with requests. Join Paul Redding, VP Partner Engagement & Cybersecurity from the Compliancy Group, on Tuesday, November 17th at 11:00 AM as he discusses:
Grab your favorite coffee cup and meet us online for an informative mid-day pick me up during Coffee and Conversation with eTrepid. Limited seating is available so RSVP today and claim your spot.
RSVP to this upcoming webinar and receive a $10 Starbucks gift card when you attend and remain on for the entire event.