USA introduced "Health Insurance Portability and Accountability Act" (HIPAA)
USA introduced "Health Insurance Portability and Accountability Act" (HIPAA)
The Health Insurance Portability and Accountability Act (HIPAA) and the requirements for HIPAA compliance in Data Protection.
A Definition of HIPAA Compliance:
The Health Insurance Portability and Accountability Act (HIPAA) sets the
standard for sensitive patient data protection. Companies that deal with
protected health information (PHI) must have physical, network, and process
security measures in place and follow them to ensure HIPAA Compliance. Covered
entities (anyone providing treatment, payment, and operations in healthcare)
and business associates (anyone who has access to patient information and
provides support in treatment, payment, or operations) must meet HIPAA
Compliance. Other entities, such as subcontractors and any other related
business associates must also be in compliance.
The HIPAA Privacy and HIPAA Security Rules
According to the U.S. Department of Health and
Human Services (HHS), the HIPAA Privacy Rule, or Standards for Privacy of
Individually Identifiable Health Information, establishes national standards
for the protection of certain health information. Additionally, the Security Rule establishes a national set
of security standards for protecting specific health information that is held
or transferred in electronic form.
The Security Rule operationalizes the Privacy Rule’s protections by
addressing the technical and nontechnical safeguards that covered entities must
put in place to secure individuals’ electronic PHI (e-PHI). Within HHS, the
Office for Civil Rights (OCR) is responsible for enforcing the Privacy and
Security Rules with voluntary compliance activities and civil money penalties.
The Need for HIPAA Compliance
HHS points out that as health
care providers and other entities dealing with PHI move to computerized
operations, including computerized physician order entry (CPOE) systems,
electronic health records (EHR), and radiology, pharmacy, and laboratory systems, HIPAA compliance is more important than
ever. Similarly, health plans provide access to claims as well as care
management and self-service applications. While all of these electronic methods
provide increased efficiency and mobility, they also drastically increase the
security risks facing healthcare data.
The Security Rule is in place to protect the privacy of individuals’
health information, while at the same time allowing covered entities to adopt
new technologies to improve the quality and efficiency of patient care. The
Security Rule, by design, is flexible enough to allow a covered entity to
implement policies, procedures, and technologies that are suited to the
entity’s size, organizational structure, and risks to patients’ and consumers’
e-PHI.
Physical and Technical Safeguards, Policies, and HIPAA Compliance
The HHS requires physical and technical
safeguards for organizations hosting sensitive patient data. These physical
safeguards include…
- Limited
facility access and control with authorized access in place
- Policies
about use and access to workstations and electronic media
- Restrictions
for transferring, removing, disposing, and re-using electronic media and
ePHI
Along the same lines, the technical safeguards of HIPAA require access
control allowing only for authorized personnel to access ePHI. Access control
includes…
- Using
unique user IDS, emergency access procedures, automatic log off, and
encryption and decryption
- Audit
reports or tracking logs that record activity on hardware and software
Other technical policies for HIPAA compliance need to cover integrity
controls, or measures put in place to confirm that ePHI is not altered or
destroyed. IT disaster recovery and offsite backup are key components that
ensure that electronic media errors and failures are quickly remedied so that
patient health information is recovered accurately and intact. One final
technical safeguard is network, or transmission security that ensures HIPAA
compliant hosts protect against unauthorized access to ePHI. This safeguard
addresses all methods of data transmission, including email, internet, or
private networks, such as a private cloud.
To help ensure HIPAA compliance, the U.S. government passed a
supplemental act, The Health Information Technology for Economic and Clinical
Health (HITECH) Act, which raises penalties for health
organizations that violate HIPAA Privacy and Security Rules. The HITECH Act was
put into place due to the development of health technology and the increased
use, storage, and transmission of electronic health information.
Data Protection for Healthcare Organizations and Meeting HIPAA
Compliance
The need for data security has grown with the increase in the use and
sharing of electronic patient data. Today, high-quality care requires
healthcare organizations to meet this accelerated demand for data while complying with HIPAA regulations and protecting PHI. Having
a data protection strategy in place allows healthcare
organizations to:
- Ensure
the security and availability of PHI to maintain the trust of
practitioners and patients
- Meet
HIPAA and HITECH regulations for access, audit, integrity controls, data
transmission, and device security
- Maintain
greater visibility and control of sensitive data throughout the
organization
The best data protection solutions recognize and protect
patient data in all forms, including structured and unstructured data, emails, documents, and scans,
while allowing healthcare providers to share data securely to ensure the best
possible patient care. Patients entrust their data to healthcare organizations,
and it is the duty of these organizations to take care of their protected
health information. To learn more about best practices for healthcare data
protection, read our guide to healthcare
cybersecurity.
HIPAA Compliance with Digital
Guardian
See how Digital Guardian for HIPAA compliance
locates and protect sensitive patient data throughout the integrated delivery
network.
HIPAA Compliance in the COVID-19 Landscape
It’s an understatement to say the world is different due to the
pandemic. Healthcare is, almost undoubtedly, set to change the most over the
next several years. Maintaining privacy compliance is also more difficult.
Factors increasing the risk of private health information include:
- Telehealth
Visits: The number of healthcare provider visits conducted over the web
has skyrocketed. Patients who typically make short trips to the clinic or
office decide to stay home and see their physician virtually, unless an
in-person visit is absolutely necessary. Data protection over the Internet
is difficult if proper precautions are overlooked.
- Increased
Patient Count (post-lockdown): Now that many states allow most procedures
and visits to occur, there has been an onslaught of appointments. When
paired with physical distancing guidelines, offices are often short on
staff when schedules are maxed out. This situation creates an opportunity
for HIPAA compliance mistakes.
- Multiple
Care Providers: Patients often see multiple doctors. However, increased
testing and varied result times make things cloudy. Primary care
physicians receiving updates from multiple testing labs, patients, or
hospitals means data is moving in and out at a faster pace (if dealing
with potential virus cases).
Stay Up-to-Date to Avoid Issues
The Department of Health and Human Services (HHS) has proactively
updated those who fall under HIPAA coverage (aka, “covered entities”). Here’s
what the HHS has to say about the increase in telehealth options:
“A covered health care provider that wants to use audio or video
communication technology to provide telehealth to patients during the COVID-19
nationwide public health emergency can use any non-public facing remote
communication product that is available to communicate with patients. OCR
is exercising its enforcement discretion to not impose penalties for
noncompliance with the HIPAA Rules in connection with the good faith provision
of telehealth using such non-public facing audio or video communication
products during the COVID-19 nationwide public health emergency. This
exercise of discretion applies to telehealth provided for any reason,
regardless of whether the telehealth service is related to the diagnosis and
treatment of health conditions related to COVID-19.” (Source: HHS)
Make sure to follow these updates from those who monitor and enforce
HIPAA compliance in order to ensure the safest environment. Communications are
likely to provide guidance on the most prominent issues caused by the pandemic,
such as increased appointments, data threats, and mitigation techniques.
The Most Recent HIPAA Updates
A number of changes and updates to HIPAA are
being considered and may become either guidance or parts of the law within the
coming months.
Updated Penalties for HIPAA Violations
Potential fines and penalties were updated earlier in 2019. (The official documentation was scheduled to be
published on April 30th.) Details outlined in the document included a tiered
structure for violations with corresponding “caps” now starting from $25,000
for Tier 1.
Better Enforcement and Accountability of Violations
2019 was a big year for enforcement. According to HIPAA Journal, the average financial penalty was more than $1.2 million.
Enforcement was increased in 2018 and obviously wasn’t slowed this past year.
The Health & Human Services Office for Civil Rights
(HHS OCR) did tighten enforcement efforts in 2018, obviously continuing
through last year. However, due to the current world situation, enforcement may
take a backseat for most of 2020.
Potential Permanent Audit Program
The HHS has long spoken of a permanent audit program. When the organization launched “Phase 2” of the HIPAA audit program, it
mentioned a permanent audit structure in the future. While, at the time of this
writing, the audit program has not been changed to a permanent structure.
Additional Guidance or Regulations Regarding Opioids
The status of opioid addiction and overuse in America has been
prominently labeled as a “crisis” and an “epidemic”. New legislation has been
promised and debated to battle the issues surrounding the controversial drug.
However, it may cause further changes to HIPAA. These changes could range from
further guidance or potential compliance issues.
---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----
For inquiries or to schedule a consultation, please visit Anuja Chaturvedi www.anujachaturvedi.com or www.feelandhealfze.com
PEOPLE THRIVES AND FEEL WELLNESS
Comments
Post a Comment