HIPAA, or the Health Insurance Portability and Accountability Act, is a standard of information protection. Typically, it is used to govern any company who deals with and uses protected health information. Doctor’s offices, medical facilities, legal offices and many more who have access to patient records must be HIPAA compliant, by law.

The Rules to be HIPAA Compliant

The US Department of Health and Human Services is responsible for establishing a clear set of national standards to protect certain health information. This is the HIPPA Privacy Rule. Additionally, a national set of standards is also set for records in holding or available for transfer in electronic form. This is the Security Rule.  The Privacy Rule and Security Rule together list technical and non-technical rules that must be put in place in order to ensure individual data security. Furthermore, the Office of Civil Rights must monitor and enforce compliance with civil monetary fines.

Physical and Technical Requirements

In order to remain HIPAA compliant, a company must adhere to the following rules, physically.

1. Limit building access and control with security in place

2. Keep electronic media in check while within work areas

3. Restrict the removal, disposal and transfer of PHI

Additionally, technical safeguards and access control are a requirement and only allow appropriate personnel to have access to PHI. Access Control includes the following demands.

1. Personnel must use unique user logins, auto logoff and proper encryption and description

2. Trackable logs that list all activity both on hardware and software

Along with these, technical rules ensure that PHI remains as original and unaltered. Off-site backup and recovery measures are fail-safes in the event of any sort of electronic issue.  Network security is the final piece and must protect against outside access to ePHI. This includes all areas of data transfer; email, private cloud and internet networks.

In order to promote these rules, the HITECH Act is in place and penalties for violations are high. (The Health Information Technology for Economic and Clinical Health Act). This Act is there because of the increase in usage, transmission and storage of electronic health information.

Why Should I Be HIPAA Compliant

As a HIPPA compliant organization, a company allows a greater trust to form from the patient to the practice. Additionally, visibility and understanding is key when it comes to overall control and better use of the information. Adhering to these simple regulations keeps PHI and ePHI secure while still providing patients with the best care possible.  Trust is important and it’s the responsibility of the healthcare organization to secure protected health information.