Originally posted on https://www.astutetm.com/2019/08/three-important-steps-to-stronger-hipaa-compliance/

 

Healthcare organizations in Ohio are now under greater scrutiny by HIPAA regulators, demanding a thorough, comprehensive approach.

The Health Insurance Portability and Accountability Act (HIPAA) can be a challenge for healthcare providers of all sizes, especially small and midsize ones that lack the in-house resources to dedicate to enforcing consistent HIPAA compliance.  However, as cyber crime targeting healthcare providers continues to grow at unprecedented levels, HIPAA regulators have greatly increased their efforts to enforce compliance at smaller offices and clinics, distributing more HIPAA non-compliance penalties in 2018 than in any year in recorded history. With the increase in HIPAA penalties and the devastating financial losses that a data breach can cause, now is the best time to make sure that your compliance program is on the right track. Narrowing down the important steps to maintain compliance can be difficult. Below are three steps to maintain HIPAA compliance for your medical practice.

What Does Strong HIPAA Compliance Require?

There’s no great HIPAA compliance mystery, in fact anyone can browse the full text of the HIPAA regulation here. But understanding HIPAA controls isn’t the problem that we see most often in the Ohio healthcare community. Instead, it’s the inability to stay consistent with HIPAA compliance efforts over the long-term that gives providers the most trouble.

HIPAA, like many other compliance programs, is not a one-off initiative. It’s an effort that requires ongoing monitoring and maintenance to succeed. Even one new application or alteration in your network can knock a system out of compliance. While HIPAA can get lost in the daily list of to-do’s, even a small oversight can lead to major fines, which means that the only realistic approach for healthcare providers that want to avoid regulatory trouble is sustained, strategic effort.

Staying HIPAA compliant isn’t a one-time process, it requires ongoing vigilance and proactive strategy.

Step 1 – Start with a Thorough Risk Assessment

All effective HIPAA programs begin with a risk assessment. Risk assessments analyze your systems for potential weaknesses and vulnerabilities, so that your technology team can spend their time and budget addressing only the most relevant threats. While in the rush to win the HIPAA compliance race, some organizations may skip this important step to maintaining HIPAA compliance. It’s very difficult to achieve reliable, long-term compliance or cyber security without a risk assessment.

To help make sure that your risk assessment is comprehensive, you may wish to deploy resources like the National Institute for Standards and Technology (NIST) Cybersecurity Framework. Originally developed to help government agencies secure the country’s infrastructure, the NIST Cybersecurity Framework is now widely adopted by healthcare organizations to help in the work of creating strong HIPAA compliance.

The NIST Cybersecurity Framework Risk Assessment is Composed of FIVE Action Items: Identify, protect, detect, respond and recover. 

Step 2 – Safeguard Electronic Protected Health Information

Organizations that handle electronic protected health information (ePHI) — no matter how much or how often — are known as covered entities in HIPAA regulation, and are responsible for implementing the most appropriate HIPAA requirements for their unique situation.

But what does most appropriate mean? HIPAA wasn’t designed to be a one-size-fits all regulation. Rather, it gives organizations a bit of leeway to determine how they should best protect their systems and data. While there’s room for flexibility and interpretation, any healthcare organization that stores and manages ePHI should be ready to protect that information with the three major classification of HIPAA safeguards, technical, physical, and administrative.

Technical Safeguards

 

These controls and processes include the implementation of centrally-managed access controls, the encryption and decryption of all ePHI, controls for user authentication, and others.

Administrative Safeguards

 

Administrative safeguards make up over half of the HIPAA text. This broad category includes processes for risk analysis and management, security incident detection and response, and more.

Physical Safeguards

 

HIPAA demands that your office and network are secured against physical tampering and intrusion. IT managers can help secure servers and workstations with the latest best practices for physical security, including the management and disposal of hard drives and other network equipment.

The Astute Technology Management Team has been helping Ohio healthcare organizations implement HIPAA safeguards for over 20 years.

Step 3 – HIPAA Compliance Requires Proper Vendor Management

In HIPAA, a business associate is any person or organization who interacts with your ePHI. HIPAA requires that you have a business associate agreement, a legally binding document that outlines how a business associate will protect and use your ePHI, with each of those vendors. Some of the organizations that you must have a business associate agreement for include:

• Medical billing service providers
• Disaster recovery and business continuity service providers
• Software-as-a-service (SaaS) and cloud service providers

For even a small healthcare provider, this can lead to the maintenance of dozens of different vendor relationships and agreements, the management of which can easily get overlooked in favor of more pressing issues.

All healthcare organizations should have a system for the management of business associate agreements. Because vendor management plays such a central role in strong HIPAA compliance, we’ve made it a central part of the HIPAA consulting services here at Astute Technology Management. For healthcare providers that would like to learn more, we’d be happy to explain in detail what a comprehensive vendor audit and management process looks like, feel free to contact our team with your questions.

HIPAA Compliance – Your Reputation is At Risk

Though the monetary penalties for HIPAA violation can easily reach hundreds of thousands of dollars, they’re not the only concern. Another important factor to consider is the reputational harm that comes with publicly acknowledging that you’ve let irreplaceable client data fall into the hands of cyber criminals.

The healthcare industry experiences 34% of all recorded data breaches, higher than any other industry. But, according to the Data Security Risk Report by law firm BakerHostetler, 31% of consumers cut ties with an entity following a data breach. How would your patient’s attitude toward your organization change if you experienced a major data breach?

While that reputational loss can be difficult to express in terms of dollars and cents, research from the Reputation Institute shows that intangible factors like reputation could make up as much as 81% of an organization’s market value. Do you want to risk hurting your reputation with a publicly disclosed HIPAA violation? Certainly not.

Reliable HIPAA Expertise for Ohio’s Healthcare Community

Having a trusted HIPAA partner at your side can radically improve the efficiency and reliability of your HIPAA compliance program. If you’re a healthcare organization in Ohio that wants an expert to develop or strengthen your HIPAA compliance program, the friendly experts at Astute Technology Management are here to help.