Achieve HIPAA compliance with Strike Graph

HIPAA: The Essentials

Is your organization a HIPAA-covered entity?

HIPAA covered entities include organizations that collect, process, store, or share protected health information. HIPAA rules define covered entities as health plans, healthcare clearinghouses, and healthcare providers who electronically transmit any healthcare information connected to transactions that The U.S. Department of Health and Human Services (HHS) has adopted standards for. Entities required to comply with HIPAA include hospitals, academic medical centers, physicians, and other healthcare providers. Even if your business is not specifically a covered entity, you are subject to HIPAA rules if you enter into a business associate contract with a covered entity.

HIPAA Privacy Rule

The Privacy Rule sets national standards to protect patients' medical records and other personal health information. The HIPAA Privacy Rule applies to healthcare clearinghouses, health plans, and other healthcare providers that conduct transactions electronically. The rule requires reliable measures to protect the privacy of PHI.  The rule establishes authorized actions and the required disclosures that apply to such data. In addition, the HIPAA Privacy Rule gives individuals rights over their health information, including rights to access and review a copy of their records and request modifications.

HIPAA Security Rule

The Security Standards for protecting ePHI are a national set of standards establishing the protective protocols for health information that covered entities hold or transfer. HHS states that "the Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards" that covered entities must implement to secure ePHI. The Office for Civil Rights (OCR) mandates the enforcement of both the Privacy and Security Rules with voluntary compliance activities and civil money penalties.

Becoming HIPAA Compliant

The U.S. Department of Health and Human Services explains  that no "standard or implementation specification requires a covered entity to 'certify' compliance in HIPAA." However, covered entities are required to perform a periodic technical and non-technical evaluation that establishes the extent to which an entity's security policies and procedures meet the security requirements. Covered entities can perform the assessment internally or contract with an external organization that provides certification services. It is essential to point out that HHS does not endorse or recognize private organizations' 'certifications' regarding HIPAA Security Rule.  

After establishing that the organization is a covered entity or a business associate to a covered entity, organizations can follow these steps to comply with HIPAA requirements:

• Develop privacy and security policies for a covered entity
• Develop an inhouse team of HIPAA experts with a designated Privacy Compliance Office as required by the HIPAA Security Rule  
• Implement necessary security controls, including administrative, physical, and technical safeguards as recommended by the HIPAA Security Rule
• Conduct regular risk assessment and self-audits to identify HIPAA compliance gaps
• Obtain satisfactory assurances that business associates meet HIPAA requirements and can safeguard shared PHI
• Develop a breach notification protocol
• Document the process for future HIPAA audits and incident investigations

Staying HIPAA Compliant

Organizations can follow these steps to stay HIPAA compliant and avoid HIPAA violations or penalties:

• Partnering with an expert who understands HIPAA requirements
• Conducting an annual risk assessment
• Performing frequent vulnerability assessments and penetration testing
• Enhancing security posture by implementing assessment recommendations  
• Continuous employee awareness on HIPAA compliance requirements
• Regular reviews of business associate contracts for compliance