Health Insurance Portability and Accountability Act (HIPAA)

HIPAA-mandated entities need to enact robust and comprehensive healthcare data security measures, including a solid identity governance solution to address security and compliance requirements proactively. Keeping up with the challenges of managing third-party business associates requires a modern Identity Governance and Administration (IGA) platform that handles a rapidly changing workforce and aligns with HIPAA’s stringent privacy requirements.

Legacy solutions that utilize high-level or coarse-grained access controls fall short of the challenge as they do not fully meet nuanced HIPAA privacy restrictions. These solutions often provide high-level application restrictions without any in-depth visibility, rarely address the needs of a multi-cloud ecosystem, and too often lack detailed analytics. Legacy systems must be replaced or supplemented otherwise, healthcare organizations risk potential disclosure of patient health data and regardless of whether the breach is malicious or accidental, the result remains the same.

Let’s break down some of the requirements for HIPAA compliance.

Policy Creation

HIPAA requires that both healthcare providers and their business associates create and maintain privacy and security policies that prove they are adhering to HIPAA regulations. These policies must be communicated and taught to staff, and staff must sign agreements confirming their knowledge of the policies. Patients are also required to sign privacy agreements that inform them on how their PHI is managed and shared and provide options for how they may access their data.

Assigning Officers

HIPAA compliance requires that providers specify a Privacy Compliance Officer who manages the creation of privacy policies and keeps up with the latest HIPAA regulations. HHS also suggests larger organizations form a committee that oversees this officer and ensures that the organization remains in compliance. The Privacy Compliance Officer is also responsible for ensuring that policies are communicated and agreed to by staff and patients.

Organizations are also required to have a HIPAA Security Officer whose responsibility is to detect, manage, and respond to potential PHI security breaches. This officer should conduct risk analysis and audits to ensure breaches are predictable and detectable.

Security Controls

HHS has developed robust guidelines for the security controls that should be in place to ensure HIPAA compliance. In order to secure EHR, the security rule outlines three areas of focus:

1. Administrative – governs the documentation of security policies, the specifications for Identity and Access Management (IAM) systems, guidelines for staff training, and the assessment of security controls.
2. Physical – governs the requirements for physical access to EHR via workstations and other mediums.
3. Technical – governs the technical requirements for access control to EHR ensuring employees of providers and business associates only have least-privilege access to the data required for their specified role. Technical requirements also include the encryption of PHI, the transmission of data, and controls for the hardware and software that store and manage EHR.

Internal Audits

HIPAA requires that healthcare providers conduct annual internal audits and risk assessments to ensure they remain in compliance.

Agreements with Third-Party Business Associates

Healthcare providers must ensure that any business associates who interact with PHI are HIPAA compliant. Agreements must be established that confirm their status.

Notification of Breaches

In the event of a security breach of PHI, providers are required to report the breach and notify patients whose data was compromised. Failure to report the breach appropriately may result in significant fines.

Documentation

Organizations are required to document all HIPAA policies, internal audits, risk assessments, training, and processes. During an HHS audit, all this documentation will be reviewed to ensure the organization has taken the necessary steps to achieve compliance.