WIXLIB

HIPAA Compliance Checklist:Security, Privacy, and Breach Notification Rules

Table of Contents2An Introduction to the Security, Privacy, and Breach Notification Rules3Security Checklist7Privacy Rule Checklist11 Breach Notification Checklist13 Ready for HIPAA Compliance?ACT

An Introduction to the Security, Privacy, andBreach Notification RulesThe Health Insurance Portability and Accountability Act (HIPAA) sets a national standard for theprotection of consumers’ Protected Health Information (PHI) and electronic Protected HealthInformation (ePHI) by mandating risk management best practices and physical, administrative, andtechnical safeguards. HIPAA was established to provide greater transparency for individuals whoseinformation may be at risk, and the Department of Health and Human Services’ Office for Civil Rights(OCR) enforces compliance with the HIPAA Privacy, Security, and Breach Notification Rules.The goal of the Security Rule is to create security for ePHI by ensuring the confidentiality, integrity,and availability of ePHI, protecting against threats, protecting against unpermitted disclosures, andensuring workforce compliance. When learning the basics of the Security Rule, it is vital to learnabout the three types of safeguards: administrative, technical, and physical. As you will see in thischecklist, administrative safeguards cover personnel, training, access, and process while technicalsafeguards cover access, audits, integrity, and transmission. Physical safeguards cover facilityaccess, workstations, and devices.The Privacy Rule regulates things like appropriate use and disclosure of PHI, patient access to PHI,and patient rights. The Privacy Rule is crucial for HIPAA because without it, healthcare organizationscould disclose and distribute protected health information without the consent of the individual. If thissensitive data were to end up in the wrong hands, it could negatively impact the individual. There arefive main areas of the Privacy Rule according to 45 CFR Part 160 and Subparts A and E of Part 164.A Privacy Rule assessment evaluates policy and procedure documentation relating to these areas,which include Notice of Privacy Practices, patient rights, minimum necessarystandards, administrative requirements, and uses and disclosures.The Breach Notification Rule requires covered entities and business associates to providenotification following a breach of unprotected PHI or ePHI. Covered entities have three parties thatthey need to notify of a breach: patients, HHS, and potentially the media. When you have a breach,you will always need to notify affected patients and HSS – no exceptions. If over 500 individuals havebeen affected, your covered entity will need to alert the media. Business associates always need tonotify their covered entity of a breach. In order to properly comply with the BreachNotification Rule, there are several aspects of the breach your organization needs to communicate tothe affected parties: what happened, what kind of PHI was disclosed in the breach, what patientsshould do to mitigate harm, what you are doing to investigate and mitigate future harm, and how theycan contact you.This checklist will walk you through the requirements of the HIPAA Security, Privacy, and BreachNotification Rules to give you an understanding of what could be assessed. We will outline therequirements of each rule, a description of the requirement, and what policies and procedures yourorganization needs to have to comply with the requirement.2An Introduction to the Security, Privacy, and Breach Notification Rules

Security ChecklistAdministrative SafeguardRequirementsDescriptionPolicies and ProceduresSecurity Management ProcessPolicies and procedures to prevent,detect, contain, and correctsecurity violations Information SecurityPolicy Manual Incident Reporting Business Associate Agreements Training Curriculum Internal Auditing Policy Compliance Manual Employee SanctionsRisk AnalysisConduct a risk analysis of ePHIsystems to identify threats,vulnerabilities, impact of risk,likelihood of occurrence, andexisting risk mitigation controls Risk Analysis Risk ManagementRisk ManagementPolicies and procedures to reducerisks and vulnerabilities to anappropriate level by prioritizing andimplementing risk managementcontrols Risk ManagementAssigned Security Responsibilitydevelop and implement policiesand procedures Information Security PolicyManual Compliance ManualWorkforce Security –Appropriate AccessPolicies and procedures to governinitial and ongoing access to PHI;reviews of access for continuedappropriateness Information Security PolicyManual (Logical Access) Human Resources PoliciesWorkforce Security –Terminating AccessPolicies and procedures toterminate employee access to PHI Information Security PolicyManual (Logical Access) Human Resources Policies3Security Checklist

Workforce Security –Security Awareness TrainingTrain all employees on securityawareness upon hire andcontinually Information Security PolicyManual (Information SecurityPolicy Acknowledgment andTraining) HIPAA TrainingIncident Response ProceduresDesignate appropriate individualsand procedures for securityincidents, including response,mitigation, documentation, andcorrective actions Information Security PolicyManual Incident Response ProcedureNetwork Security – MaliciousSoftware ProtectionPolicies and procedures to protectagainst, identify and reportmalicious software Information Security PolicyManual (Network Security)Business ContinuityPolicies, procedures and training toaddress interruptions to businessactivity Business Continuity Plan Disaster and Recovery PlanBusiness Associate ContractsAgreements with businessassociates to ensure proper Business Associate Agreement Vendor Questionnaires Information Security PolicyManual (Vendor Management)4Security Checklist

Physical SafeguardRequirementsDescriptionPolicies and ProceduresFacility Access ControlsPolicies and procedures to grant,monitor, and terminate access tophysical facilities Information Security PolicyManual (Physical Security) Human Resources ProceduresFacility – Emergency PlanningPolicies and procedures to restoredata in the event of emergency Business Continuity Plan Disaster and Recovery PlanFacility Procedures –Unauthorized AccessPolicies and procedures foridentifying and responding tounauthorized access to physicalfacilities Information Security PolicyManual (Physical Security)Policies and procedures to monitorand document repairs and changesto physical physicality that impactsecurity Information Security PolicyManual (Inventory) Risk AssessmentWorkstation SecurityPolicies and procedures to controlaccess to, changes to, and use ofemployee workstations Information Security PolicyManual (WorkstationManagement)Device and Media ControlsPolicies and procedures to addressuse of, storage, transmission,reuse, tracking, and destruction ofremovable media that store ePHI Information Security PolicyManual (Acceptable Use,Inventory) Remote Work PoliciesFacility5Security Checklist

Technical SafeguardRequirementsDescriptionPolicies and ProceduresUnique Name for User IdentityPolicies and procedures to assign Information Security (LogicalAccess)to track usageComputer Session InactivityPolicies and procedures toterminate electronic sessions basedon a predetermined time of inactivity Information Security (WorkstationManagement)Transmission of ePHIPolicies, procedures, audit controls,hardware, and software to encrypt,monitor, and record the transmissionof ePHI Information Security (Cryptology) Information Security (PHITransmission)6Security Checklist

Privacy Rule ChecklistRequirementsDescriptionPolicies and ProceduresPHI Uses and Disclosures forTreatment, Payment, or OperationsPatient authorization for thedisclosure of PHI for treatment,payment, and healthcare operationsis implied Standard Disclosure of PHI Notice of Privacy PracticesPHI Uses and Disclosures thatRequire AuthorizationPatient authorization is required todisclose psychotherapy notes, PHIfor marketing, the sale of PHI;elements of valid authorization Notice of Privacy Practices Patient AuthorizationPHI Uses and DisclosuresRequiring Notice and Opportunityto ObjectCertain disclosures require priorpatient notice and opportunity toobject: disclosures to family, facilitydirectories, emergencies, andothers Notice of Privacy Practices Patient AuthorizationsPHI Uses and Disclosures WithoutAuthorizationCertain disclosures do not requireprior patient notice: court orders,law enforcement investigations,public health activities, and others Notice of Privacy PracticesPHI Uses and Disclosures: FundRaisingDisclosure of patient PHI for fundraising purposes requiresauthorization in most cases Notice of Privacy Practices Patient AuthorizationsPHI Uses and Disclosures:ResearchDisclosure of patient PHI forresearch purposes requiresauthorization in most cases Notice of Privacy Practices Patient AuthorizationsPHI Uses and Disclosures:Personal Representatives andFamilyDisclosure of patient PHI to patientfamily members/representatives isgenerally permitted, with exceptions Notice of Privacy Practices Patient AuthorizationsPHI Uses and Disclosures: AfterDeathPatient privacy rights to PHIdisclosure continue 50 years afterdeath Notice of Privacy Practices Patient Authorizations7Privacy Rule Checklist

PHI Uses and Disclosures:Prior to PHI disclosure, entities mustverify the identify and authority ofthe requesting party Patient Authorizations Standard Disclosure of PHIPHI Uses and Disclosures:De-IdentificationPrivacy Rule restrictions related toPHI disclosures do not apply to PHI Uses and Disclosures:Safeguards for PHI CommunicationEntities should ensure that channelsof communication are appropriatefor transmission of PHI Standard Disclosure of PHIPHI Uses and Disclosures:Minimum Necessary StandardPHI disclosures and requestsshould be limited to the minimumPHI necessary for the treatment,payment, or operational requirement Standard Disclosures of PHI Minimum Necessary PolicyMinimum Necessary Standard:Workforce AccessMinimum Necessary Standard:Routine DisclosuresEmployee access should berestricted to the minimumnecessary, defined by entity policiesof minimum necessary for routinedisclosures of PHI Minimum Necessary Policy Standard Disclosures of PHI Minimum Necessary PolicyMinimum Necessary Standard:Non-Routine DisclosuresEntities should establish criteria forindividual disclosures and review ofsuch disclosures Minimum Necessary Policy Individual Disclosures of PHIPatient Rights:Disclosure RestrictionsPatients may request certainrestrictions on PHI disclosure anduse; entity agreement to restrictionsis not comprehensive Notice of Privacy Practices Patient Authorizations Disclosure Restriction FormPatient Rights:Alternative CommunicationPatients may request alternativelocations and means ofcommunication Notice of Privacy Practices Patient Authorizations Standard Disclosures of PHI