A little housekeeping before we answer the question. This article is not a definitive list of what is required for HIPAA compliance; you should assign a Privacy Officer to review each rule in its entirety. This article is intended to point you in the right direction.
So you have determined that you are handling protected health information (PHI) and that you need to be HIPAA compliant. What’s next? What steps need to be taken in order to become HIPAA compliant?
The simple answer is that Covered Entities and their Business Associates need to protect the privacy and security of protected health information (PHI). But, it gets more complicated when you start to put together a to-do list.
There are 4 rules that you will need to dissect.
- HIPAA Privacy Rule
- HIPAA Security Rule
- HIPAA Enforcement Rule
- HIPAA Breach Notification Rule
As far as action items are concerned, you need to follow the HIPAA Privacy Rule and the HIPAA Security Rule. And, you need to provide notification following a breach of unsecured protected health information (the Breach Notification Rule).
If you’re a developer trying to understand the scope of the build, then you need to focus on the Technical and Physical Safeguards spelled out in the Security Rule; these two sections comprise the majority of your to-do list. Let’s start there.
Want to download a high-resolution copy of this checklist for your reference? Grab it here:
HIPAA Security Rule
The HIPAA Security Rule requires appropriate Administrative, Physical, and Technical Safeguards to ensure the confidentiality, integrity, and security of protected health information (PHI).
The Security Rule is made up of 3 parts.
- Technical Safeguards
- Physical Safeguards
- Administrative Safeguards
All 3 parts include implementation specifications. Some implementation specifications are “required” and others are “addressable.” Required implementation specifications must be implemented. Addressable implementation specifications must be implemented if it is reasonable and appropriate to do so; your choice must be documented. (see the HHS answer)
It is important to remember that an addressable implementation specification is not optional. When in doubt, you should just implement the addressable implementation specifications. Most of them are best practices anyway.
Technical Safeguards
The Technical Safeguards focus on the technology that protects PHI and controls access to it. The standards of the Security Rule do not require you to use specific technologies. The Security standards were designed to be "technology neutral.”
There are 5 standards listed under the Technical Safeguards section.
- Access Control
- Audit Controls
- Integrity
- Authentication
- Transmission Security
When you break down the 5 standards there are 9 things that you need to implement.
- Access Control - Unique User Identification (required): Assign a unique name and/or number for identifying and tracking user identity.
- Access Control - Emergency Access Procedure (required): Establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency.
- Access Control - Automatic Logoff (addressable): Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.
- Access Control - Encryption and Decryption (addressable): Implement a mechanism to encrypt and decrypt ePHI.
- Audit Controls (required): Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
- Integrity - Mechanism to Authenticate ePHI (addressable): Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.
- Authentication (required): Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.
- Transmission Security - Integrity Controls (addressable): Implement security measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of.
- Transmission Security - Encryption (addressable): Implement a mechanism to encrypt ePHI whenever deemed appropriate.
Security Standards: Technical Safeguards
HHS offers insight into the Security Rule and assistance with the implementation of the security standards.
Physical Safeguards
Physical Safeguards are a set of rules and guidelines that focus on the physical access to PHI.
TrueVault provides an in-depth analysis of the Physical Safeguards in a two-part blog post.
HIPAA Physical Safeguards Explained, Part 1
HIPAA Physical Safeguards Explained, Part 2
There are 4 standards in the Physical Safeguards section.
- Facility Access Controls
- Workstation Use
- Workstation Security
- Device and Media Controls
When you break down the 4 standards there are 10 things that you need to implement.
- Facility Access Controls - Contingency Operations (addressable): Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.
- Facility Access Controls - Facility Security Plan (addressable): Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.
- Facility Access Controls - Access Control and Validation Procedures (addressable): Implement procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.
- Facility Access Controls - Maintenance Records (addressable): Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (e.g. hardware, walls, doors, and locks).
- Workstation Use (required): Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI.
- Workstation Security (required): Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users.
- Device and Media Controls - Disposal (required): Implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored.
- Device and Media Controls - Media Re-Use (required): Implement procedures for removal of ePHI from electronic media before the media are made available for re-use.
- Device and Media Controls - Accountability (addressable): Maintain a record of the movements of hardware and electronic media and any person responsible therefore.
- Device and Media Controls - Data Backup and Storage (addressable): Create a retrievable, exact copy of ePHI, when needed, before movement of equipment.
Security Standards: Physical Safeguards
Administrative Safeguards
The Administrative Safeguards are a collection of policies and procedures that govern the conduct of the workforce, and the security measures put in place to protect ePHI.
The administrative components are really important when implementing a HIPAA compliance program; you are required to assign a privacy officer, complete a risk assessment annually, implement employee training, review policies and procedures, and execute Business Associate Agreements (BAAs) with all partners who handle protected health information (PHI).
There are 9 standards under the Administrative Safeguards section.
- Security Management Process
- Assigned Security Responsibility
- Workforce Security
- Information Access Management
- Security Awareness and Training
- Security Incident Procedures
- Contingency Plan
- Evaluation
- Business Associate Contracts and Other Arrangements
As with all the standards in this rule, compliance with the Administrative Safeguards standards will require an evaluation of the security controls already in place, an accurate and thorough risk analysis, and a series of documented solutions.
When you break down the 9 standards there are 18 things that you need to do.
- Security Management Process - Risk Analysis (required): Perform and document a risk analysis to see where PHI is being used and stored in order to determine all the ways that HIPAA could be violated.
- Security Management Process - Risk Management (required): Implement sufficient measures to reduce these risks to an appropriate level.
- Security Management Process - Sanction Policy (required): Implement sanction policies for employees who fail to comply.
- Security Management Process - Information Systems Activity Reviews (required): Regularly review system activity, logs, audit trails, etc.
- Assigned Security Responsibility - Officers (required): Designate HIPAA Security and Privacy Officers.
- Workforce Security - Employee Oversight (addressable): Implement procedures to authorize and supervise employees who work with PHI, and for granting and removing PHI access to employees. Ensure that an employee’s access to PHI ends with termination of employment.
- Information Access Management - Multiple Organizations (required): Ensure that PHI is not accessed by parent or partner organizations or subcontractors that are not authorized for access.
- Information Access Management - ePHI Access (addressable): Implement procedures for granting access to ePHI that document access to ePHI or to services and systems that grant access to ePHI.
- Security Awareness and Training - Security Reminders (addressable): Periodically send updates and reminders about security and privacy policies to employees.
- Security Awareness and Training - Protection Against Malware (addressable): Have procedures for guarding against, detecting, and reporting malicious software.
- Security Awareness and Training - Login Monitoring (addressable): Institute monitoring of logins to systems and reporting of discrepancies.
- Security Awareness and Training - Password Management (addressable): Ensure that there are procedures for creating, changing, and protecting passwords.
- Security Incident Procedures - Response and Reporting (required): Identify, document, and respond to security incidents.
- Contingency Plan - Contingency Plans (required): Ensure that there are accessible backups of ePHI and that there are procedures for restore any lost data.
- Contingency Plan - Contingency Plans Updates and Analysis (addressable): Have procedures for periodic testing and revision of contingency plans. Assess the relative criticality of specific applications and data in support of other contingency plan components.
- Contingency Plan - Emergency Mode (required): Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of ePHI while operating in emergency mode.
- Evaluations (required): Perform periodic evaluations to see if any changes in your business or the law require changes to your HIPAA compliance procedures.
- Business Associate Agreements (required): Have special contracts with business partners who will have access to your PHI in order to ensure that they will be compliant. Choose partners that have similar agreements with any of their partners to which they are also extending access.
Building a HIPAA Compliant app?
Security Standards: Administrative Safeguards
HIPAA Privacy Rule
The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, healthcare clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.
Business Associates are directly liable for uses and disclosures of PHI that are not covered under their BAA or the HIPAA Privacy Rule itself.
The Privacy Rule requires Business Associates to do the following:
- Do not allow any impermissible uses or disclosures of PHI.
- Provide breach notification to the Covered Entity.
- Provide either the individual or the Covered Entity access to PHI.
- Disclose PHI to the Secretary of HHS, if compelled to do so.
- Provide an accounting of disclosures.
- Comply with the requirements of the HIPAA Security Rule.
HHS, Privacy Rule:
http://www.hhs.gov/hipaa/for-professionals/privacy/index.html
HIPAA Enforcement Rule
The HIPAA Enforcement Rule spells out investigations, penalties, and procedures for hearings.
What's the penalty for a HIPAA violation? Read our blog post the subject.
HHS, Enforcement Rule:
http://www.hhs.gov/hipaa/for-professionals/special-topics/enforcement-rule/index.html
HIPAA Breach Notification Rule
The Breach Notification Rule requires most healthcare providers to notify patients when there is a breach of unsecured PHI. The Breach Notification Rule also requires the entities to promptly notify HHS if there is any breach of unsecured PHI, and notify the media and public if the breach affects more than 500 patients.
HHS, Breach Notification Rule:
Summary
When you boil it down, HIPAA is really asking you to do 4 things:
- Put safeguards in place to protect patient health information.
- Reasonably limit uses and sharing to the minimum necessary to accomplish your intended purpose.
- Have agreements in place with any service providers that perform covered functions or activities for you. These agreements (BAAs) are to ensure that these services providers (Business Associates) only use and disclose patient health information properly and safeguard it appropriately.
- Have procedures in place to limit who can access patient health information, and implement a training program for you and your employees about how to protect your patient health information.
That’s a lot to digest. If this list created more questions than it answered please email us at blog@truevault.com. We’re here to help.