Complying with HIPAA is more complex than ever and threats to healthcare data are growing. Attack both problems with a robust compliance solution.
The Health Insurance Portability and Accountability Act (HIPAA) was initiated in 1996 to develop regulations protecting the privacy and security of healthcare data. As a result of this work, the Federal Department of Health and Human Services (HHS) published the following privacy protection standards:
Hand-in-hand with HIPAA is the HITECH Act (Health Information Technology for Economic and Clinical Health Act), which passed in 2009 and urges health providers to:
Both HIPAA and HITECH address ePHI security, but measures within HITECH support the enforcement of HIPAA through the Breach Notification Rule and the HIPAA Enforcement Rule.
The need to share health data is there – by hospitals, clinics, insurers, research facilities, pharmacies, and public health organizations. However, very specific guidelines around how this information can be stored and shared are needed to ensure patient privacy. Breaching the trust of individuals who’ve entrusted their data comes with consequences.
According to HIPAA security laws and regulations for professionals, the Office for Civil Rights (OCR) within the HSS is responsible for enforcing Privacy and Security Rules, establishing compliance requirements as well as for levying civil monetary penalties.
Organizations that fail to comply with HIPAA regulations can see substantial fines levied against them, even if no actual PHI breach occurs. In addition, criminal charges and even civil action lawsuits can be filed following a breach. And it should be noted: ignorance of HIPAA compliance requirements doesn’t pass muster as a defense against violations sanctions. The OCR issues fines whether a violation is inadvertent or is the result of willful neglect.
Ensuring your administrative policies and procedures, physical protection, as well as technical solutions as a Covered Entity or Business Associate are in place can go a long way in keeping off the OCR’s radar.
A Covered Entity is any health care provider, health plan, or health care clearinghouse who, as part of their day-to-day business, creates, maintains, or transmits PHI. There are a few exceptions, including:
A Business Associate is defined as any person or business that provides a service to, or performs a function or activity for, a Covered Entity when that action involves accessing PHI maintained by the Covered Entity. Accountants, IT contractors, lawyers, billing companies, cloud storage services, email encryption services are all examples of Business Associates.
To be in HIPAA compliance, Business Associates must sign a Business Associate Agreement with the Covered Entity before gaining access to PHI which details what PHI they can access, how they plan to use it, and that the PHI will be returned or destroyed once the need for it or task is completed. The Business Associate is under the same HIPAA compliance obligations as the Covered Entity while they are in possession of the PHI.
There are three categories of safeguards to help ensure the HIPAA Security Rule is adhered to by covered Entities and Business Associates – administrative, physical, and technical.
Putting robust technical safeguards in place is not only necessary it also makes complying with HIPAA regulations easier, especially when data security solutions are coupled with automation to help reduce the risks of human error and reduce the compliance burden of a Covered Entity’s IT staff.
Both HIPAA and HITECH address ePHI security, but measures within HITECH support the enforcement of HIPAA through the Breach Notification Rule and the HIPAA Enforcement Rule.
Detect, inspect, and secure your critical healthcare data across email, web, and the cloud with Clearswift, Fortra’s DLP solution. End-point protection ensures data flagged to be protected by HIPAA is secured throughout its entire journey or lifecycle. And adaptive redaction allows for content that would be considered a HIPAA breach to be dynamically modified (redacted or sanitized), allowing the rest of the communication to be delivered unhindered to help ensure secure but continuous collaboration.
The foundation of a solid data security strategy begins with data classification from Fortra’s Data Classification solutions, which support compliance with HIPAA by allowing users to identify valuable data with classification labels or tags. This enables critical decisions to be made about how healthcare data is stored and transmitted. Note: An organization’s investment in, and application of, such a classification system may itself constitute a “reasonable measures” defense, should there be a HIPAA breach charge.
A multi-layered HIPAA-compliant defense structure that includes managed file transfer, such as Fortra’s GoAnywhere MFT helps secure and automate the exchange of ePHI, protecting healthcare information, encrypting data at rest and in motion and providing comprehensive audit and reporting logs, required for HIPAA compliance. GoAnywhere surrounds sensitive healthcare data at all points in time, wherever it resides. Covered Entities can streamline and secure the exchange of data between systems, Business Associates, employees, patients, insurers, and other authorized recipients for secure collaboration, automation of vital business processes, and complete information control.
Fortra’s digital rights management solution, Vera, allows healthcare entities to share their files securely by ensuring that the security policy sticks to the data, anywhere it goes. So, when patient data needs to be shared externally, they can share with the confidence that the data can only be accessed by those they choose, even after it’s open.
If your healthcare organization has IBMi systems in your environment, Fortra’s Powertech solutions can help you meet HIPAA’s Security Rule technical safeguard requirements by acting as an automatic security control to hardening your system security and providing visibility to your database access. These automated, simplified security solutions can help healthcare entities more easily meet auditor demands and protect healthcare data.
Meet with one of our experts to assess your needs, and we'll walk you through our solution.
Request a DemoJoin us on Monday, August 32nd where we talk about this, that, and the other thing.
Details + register