Security isn’t a “once and done” activity.
Likewise, HIPAA compliance is an ongoing process and not a one-off exercise.
Building a solid healthcare practice requires mechanisms to prevent shortcuts and workarounds from being the mainstay of your culture. Workarounds breed non-compliance as well as security risks.
In medical practices, data security is critical as patient privacy protection hinges on HIPAA compliance. HIPAA sets the baseline for patient data protection with its Security Rules. The two work together - to ignore one compromises the other.
While there isn’t a one-size checklist to ensure you’re in compliance, there are steps to consider as you work to create a secure, compliant environment within your practice.
What is the HIPAA Security Rule?
The HIPAA Security Rule is set to provide national standards to protect individuals’ electronic personal health data. It requires administrative, physical and technical safeguards to ensure confidentiality, integrity, security, and availability of all electronic personal health information. It also requires organizations to identify and protect against reasonably anticipated threats to the security or integrity of the data.
The Security Rule provides minimum measures with which organizations must comply. The key is in the term “reasonably anticipated threats or hazards.” Organizations are responsible for developing and implementing additional measures if something exists that is not covered by the Security Rule’s minimum standards but is reasonably anticipated.
This is an ongoing task. Just like HIPAA rules change yearly, so should an organization's approach as they grow and discover new vulnerabilities. This is where “flexibility” comes into play.
Defining Safeguards
Administrative safeguards require a security officer to be designated and responsible for conducting risk analysis, implementing measures to reduce vulnerabilities and risks, providing training and oversight, and ensuring compliance with any and all Business Associate Agreements.
Physical safeguards focus on the accessibility of electronic personal health information. Whether stored in a remote data center, in the cloud, or on servers within the organization itself, it must be fully protected and secured against unauthorized access.
Technical safeguards are created to ensure every person accessing the data is who they claim to be, and does what they are supposed to do. If a breach occurs, the situation is identified and rectified as quickly as possible.
Creating your internal checklist
Although there isn’t a set security checklist and HIPAA is flexible in its approach, every organization should have a few essential components in place to remain compliant.
- Create a HIPAA security officer position. This ensures someone on your team remains up-to-date on all requirements.
- Inventory all devices that access electronic personal health information. Ensure they have proper protection.
- Identify all systems that create, receive, maintain, or transmit electronic personal health information. This gives you a roadmap to use when developing and maintaining security measures.
- Implement measures that mitigate threats from risks such as malware or phishing.
- Implement security awareness training programs for all staff members.
- Develop a contingency plan for “what if” scenarios. Test and plan workarounds for every potential risk.
- Review Business Associate Agreements regularly to ensure those you partner with remain compliant.
Are there more? Of course. But this list is a good starting point.
Remember, flexibility is vital. Being prepared means utilizing the tools and resources you have today to better prepare for tomorrow. It’s the best way to stay on top of whatever might come your way.
For IT Strategy, Cloud Conversion, or Help Desk Services reach out to us at Silver Linings Technology 360-450-4759.
