Trust us with HIPAA compliance so your clients can trust you.

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It’s a collection of medical privacy regulations for health-care organizations handling sensitive personal health information (PHI). HIPAA sets the standard for security, privacy, and integrity of patient data.

Any organization that collects, processes, stores, or shares protected health information is considered a covered entity under HIPAA. Covered entities include hospitals, academic medical centers, physicians, and other healthcare providers. Even if your business is not specifically a covered entity, you are subject to HIPAA rules if you enter into a business associate contract with a covered entity.

The Privacy Rule sets national standards to protect patients' medical records and other personal health information. The HIPAA Privacy Rule applies to covered entities like healthcare clearinghouses, health plans, and other healthcare providers that conduct transactions electronically. The rule does not apply to business associates. The rule requires reliable measures to protect the privacy of personal health information (PHI). The rule establishes authorized actions and the required disclosures that apply to such data. In addition, the HIPAA Privacy Rule gives individuals rights over their health information, including rights to access and review a copy of their records and request modifications.

The Security Standards for protecting electronic personal health information (ePHI) are a national set of standards establishing the protective protocols for health information that covered entities hold or transfer.The US Department of Health and Human Services (HHS) states that "the Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards" that covered entities must implement to secure ePHI. Both covered entities and business associates are subject to the Security Rule. The Office for Civil Rights (OCR) mandates the enforcement of both the Privacy and Security Rules with voluntary compliance activities and civil money penalties.

Your organization can become HIPAA compliant, but there is no official HIPAA certification endorsed by the US Department of Health and Human Services (HHS). In fact, HHS specifically explains that no "standard or implementation specification requires a covered entity to 'certify' compliance in HIPAA."

Organizations subject to HIPAA — covered entities — and their business associates are required to perform periodic technical and non-technical evaluations that establish the extent to which an entity's security policies and procedures meet HIPAA security requirements. These assessments can be performed internally or contracted through an external organization that provides certification services.

Organizations that determine they are covered entities must abide by the Privacy Rule, Breach Notification Rule, and Security Rule. Business associates are only required to meet the requirements of the Security Rule.

These basic steps are necessary to reach HIPAA compliance:

• Develop privacy and security policies.
• Develop an in-house team of HIPAA experts with a designated Privacy Compliance Office as required by the HIPAA Security Rule.
• Implement necessary security controls, including administrative, physical, and technical safeguards as recommended by the HIPAA Security Rule.
• Conduct regular risk assessment and self-audits to identify HIPAA compliance gaps.
• Obtain satisfactory assurances that business associates meet HIPAA requirements and can safeguard shared PHI.
• Develop a breach notification protocol.
• Document the process for future HIPAA audits and incident investigations.

Organizations can follow these steps to maintain HIPAA compliance and avoid HIPAA violations or penalties:

• Partner with an expert who understands HIPAA requirements.
• Conduct an annual risk assessment.
• Perform frequent vulnerability assessments and penetration testing.
• Enhance security posture by implementing assessment recommendations.
• Maintain continuous employee awareness of HIPAA compliance requirements.
• Review business-associate contracts regularly for HIPAA compliance.