HIPAA risk assessment & data compliance guide

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, remains the driving force behind compliance practices in the management of patient information.

This article will demystify HIPAA, explain why it is important, and share several steps every healthcare provider and human resources (HR) representative can take to protect employee and patient data confidentiality.

What is HIPAA?

HIPAA is a federal law that gives patients certain rights over their personal healthcare history and information. It sets limits on who can access their health records and prevents sensitive data from being disclosed without patient consent. Healthcare providers must adhere to federal standards to protect patient electronic health records (EHR) from theft, destruction, or alteration by employees as well as external threats.

This information not only applies to clinical data and medications – which are nobody’s business – but also to other aspects of patient profiles such as insurance and billing information, social security number, and date of birth. Violations can result in penalties and fines to the provider, and possible termination for employees who leak patient data.

In essence, HIPAA can be boiled down to three rules:

1. The Privacy Rule. Establishes which healthcare providers must follow HIPAA standards, defines protected patient healthcare information (PHI), and how that data may be used, shared, and disclosed.

2. The Security Rule. Sets standards for how patient data entered, stored, and moved in electronic format is safeguarded. This refers to data encryption, passwords, malware, and other cybersecurity measures to protect the healthcare provider’s IT environment from breaches.

3. The Breach Notification Rule. When a security breach does occur, this rule covers the actions and timeframes healthcare providers need to take, such as alerting affected individuals, IT partners, and the Department of Health and Human Services (HHS).

Related content

Article: What every business needs to know about compliance

What is a HIPAA Security Risk Assessment?

A HIPAA security risk assessment is an appraisal of a healthcare provider’s level of compliance with the three HIPAA rules discussed above. It analyses current security measures, identifies potential threats and vulnerabilities of information systems and employees that might be exploited, determines the likelihood of a breach, and makes recommendations to close any gaps.

A HIPAA security risk assessment looks at an organization’s preparedness for preventing and addressing a security breach through three lenses, administrative, physical, and technical.

1. Administrative safeguards ensure patient information is correct and accessible only by authorized employees.

2. Physical safeguards are best practices to prevent device loss and document theft.

3. Technical safeguards are the cybersecurity measures put in place to guard access to electronic data.

Protecting Healthcare Data 101

Even if your healthcare organization has yet to perform a HIPAA security risk assessment, there are some simple steps every entity can take to reduce the chance of information mismanagement and resulting penalties, including:

• Harden user authentication steps. Employ strong user password standards and/or two-factor authentication for system access. Implement secure printing solutions that will not output a document until a PIN is entered at the device.

• Encrypt data. Make data undecipherable to all but authorized users through encryption/decryption technology.

• Train employees. Make sure staff knows the basics of HIPAA compliance, like no chatting about patients’ conditions in public and how to spot a phishing email.

• Destroy confidential data. Perform periodic disk wiping or use data overwrite technology to make it nearly impossible to reconstruct the original file.

• Create an audit trail. Capture user login data to track and trace who accesses devices and files in the event of a breach.

• Erase storage devices before disposal. Never just throw away old hard drives or disks; break, smash, or pass them under a magnet. Always assume someone will go through your digital trash looking for valuable data.

• Maintain physical safeguards. Install card-key access to sensitive areas and IT rooms. Activate password-enabled screen savers on PCs in examination rooms. Even something as simple as positioning a monitor out of the line of sight of patients in the reception area can reduce risk.

Related content

Article: 6 steps to protect your healthcare data 

Find a trusted partner to support HIPAA compliance

When is the last time your organization took a hard look at your HIPAA compliance risk profile? Are you doing everything you can to ensure the privacy of patient information and protect your bottom line?

Solutions like our Patient Information Management services automate billing, correspondence, and claims processing. Create and mail accurate patient packets, transform prescriptions into a paperless process with cloud faxing, and manage referrals faster – all while maintaining the strictest levels of privacy for worry-free HIPAA compliance.