Transcription
Seaicpa.org/soc4soreOrganiz at i o n s S e r vSecure Cloud ServicesManaged & Compliant Infrastructureatiof orvicn undamentalsYou Need to Knowice888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know \\ Table of ContentsTable of ContentsBasics of HIPAA and HITECH4What exactly is HIPAA?Covered entities v. business associatesThe HIPAA Omnibus RuleHITECHHIPAA Compliance Simplified567Five security-thought-leader tips for HIPAA ComplianceThree specific HIPAA tips you need to know post-omnibus8811Checklist: How to Make Sure You’re Compliant13Get Help with HIPAA Compliance18Atlantic.Net HIPAA Hosting Features18References19HIPAA Security Rule to-doHIPAA Privacy Rule to-doHIPAA Breach Notification Rule to-doHIPAA Omnibus Rule to-doSecure Cloud ServicesManaged & Compliant Infrastructure13151516888-618-DATA (3282)sales@atlantic.netwww.atlantic.net4
HIPAA Compliance: Important Fundamentals You Need to Know \\ ForewordThis e-book is essentially a Mega-Guide onHIPAA, the Health Insurance Portability andAccountability Act of 1996. First, we take abroad look at the basics of HIPAA; the roles ofcovered entities and business associates; andthe related issue of HITECH compliance.Second, we discuss actionable steps to achievecompliance – closing with a straightforwardand practical checklist.Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know4Basics of HIPAA and HITECHWhat exactly is HIPAA?The Health Insurance Portabilityand Accountability Act of 1996 is aUS law that was passed to safeguarddata and keep it from getting intothe wrong hands. HIPAA became lawwhen President Bill Clinton signed itin August 1996. Whether you agreewith the regulations of HIPAA or not,well, they exist – and it can beexpensive to your pocketbook andreputation to neglect them.HIPAA (no, not HIPPA) is often discussed in tech circles for the obviousreason that hardware and softwaremust keep digital patient information secured.Here are the five components of thismajor healthcare act: HIPAA Title I makes it possible tomaintain coverage when your employment changes and you’re on agroup plan. It also makes it unlawfulfor group insurance plans to turndown people they don’t want tocover or to build lifetime maximumsinto contracts. HIPAA Title II “directs the U.S. Department of Health and Human Services to establish national standardsfor processing electronic healthcaretransactions,” explained JacquelineBiscobing in TechTarget1. “It alsorequires healthcare organizations toimplement secure electronic accessto health data and to remain in compliance with privacy regulations setby HHS.” HIPAA Title III introduces new taxrules related to healthcare treatment. HIPAA Title IV includes additionaldetails on reform of insurance law,with protections for those who havepre-existing conditions and individuals who want to maintain their insurance. HIPAA Title V gives guidelines forlife insurance policies that areowned by businesses and how tohandle income tax specifics whenSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowsomeone has their US citizenshiprevoked.As you can see, the relevant sectionof HIPAA for IT providers, and forthoseprocessing,transferring,and/or storing health data, is Title II.This part of the law is often calledsimply the “Administrative Simplification provisions.”It establishes and describes thesefive elements: National Provider Identifier Standard – 10-digit NPI (national provider identifier) numbers must beassigned to all healthcare entities. Transactions and Code Sets Standards – An objectively approvedprotocol must be used in electronicdata interchange (EDI). HIPAA Privacy Rule – Patienthealth information must be protected. “Privacy Rule” is actually shorthand for the “Standards for Privacyof Individually Identifiable HealthInformation.”5 HIPAA Security Rule – This ruledelineates expectations for the safeguarding of patient data. “SecurityRule” is short for the “Security Standards for the Protection of Electronic Protected Health Information.” HIPAA Enforcement Rule – Thissubsection of the law providesparameters with which companiesshould be investigated for potentialor alleged violations.Covered entities versus business associatesOne of the most important elementsof HIPAA is defining exactly whattype of party is responsible for all itsparameters – and that involvesgroups it describes as covered entities and business associates. Keep inmind that the distinction betweenthese two parties is now less significant to healthcare law because theHIPAA Final Omnibus Rule moved totreat business associates as directlyresponsible for meeting all HIPAArequirements.Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to KnowNonetheless, by definition, a HIPAAcovered entity is a healthcare plan,healthcare provider, or healthcaredata clearinghouse that electronically sends and/or receives protectedhealthinformation(PHI)asdescribed by HIPAA and HHS standards. The transmission of PHI – orePHI (electronic PHI) often occursfor one of two reasons: healthcare-related financial transactionsand insurance processing, accordingto the HHS’s National Institutes ofHealth (NIH). “For example, hospitals,academic medical centers, physicians, and other health care providers who electronically transmitclaimstransactioninformationdirectly or through an intermediaryto a health plan are covered entities,”said the NIH. “Covered entities canbe institutions, organizations, orpersons.”2A HIPAA business associate is aperson or organization that is notemployed by a healthcare plan, provider, or clearinghouse, but thatcompletes tasks related to individu-6ally identifiable health information,as governed by the HIPAA Administrative Simplification Rules (i.e. TitleII, the crux of HIPAA compliance inan IT setting – see above), whichincludes the all-important PrivacyRule and Security Rule.The HIPAA Omnibus RuleA major change to the HIPAA rulescame in January 20133, when theHHS announced its Omnibus Rulefor HIPAA. This rule required thathealthcare providers meet certainadditional security requirements bySeptember 23 of that same year4.(So that’s been a few years agowhenever you’re reading this, provided you don’t have a time machine.)A major specific change was to hithealthcare providers harder withpenalties, raising the maximum finefor a single violation to 1.5 million(keeping in mind that’s the maximum, depending on the degree ofnegligence).Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to KnowHHS Secretary Kathleen Sebeliusdescribed the new rule in the agency’s official announcement. “Muchhas changed in health care sinceHIPAA was enacted over fifteenyears ago,” she said. “The new rulewill help protect patient privacy andsafeguard patients’ health information in an ever-expanding digitalage.”Bear in mind that the specifics of therule are beyond the scope of thise-book but are built into the tips andchecklist for compliance below.HITECHHITECH is the acronym behind theHealth Information Technology forEconomic and Clinical Health Act of2009. The legislation, signed into lawby President Obama on February 17,was intended to accelerate the transition to electronic health records(EHR). It was actually included withinthe American Recovery and Reinvestment Act of 2009 (ARRA), whichwas geared toward stimulating theeconomy.7Another result of HITECH has to dowith the Office of the National Coordinator for Health Information Technology (ONC), which has been partof the HHS Department since 2004.The ONC became responsible foradministration and creation of standards related to HITECH.“HITECH stipulated that, beginningin 2011, healthcare providers wouldbe offered financial incentives fordemonstrating ‘meaningful use’ ofEHRs until 2015,” noted Scot Petersen in TechTarget5, “after which timepenalties may be levied for failing todemonstrate such use.”As you can see, the HITECH law isgeared more toward the adoption ofelectronic health records itself than itis toward specific security rules fordigital data. That’s why HIPAA is typically more a point of focus whenlooking for digital systems. However,many hosting providers and similarentities get certified for compliancewith HITECH as well as HIPAA todemonstrate their knowledge of andSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know8HIPAA Compliance Simplifiedadherence to all federal healthcarelaw.As you can imagine, there is overlapbetween these two laws. However,HITECH serves as somewhat of anaddendum to HIPAA. It mandatesthat any standards for technologyarising from HITECH must meet theHIPAA Privacy and Security Rules(described above).Additionally, HIPAA states thathealthcare providers must submittheir systems to a HIPAA risk assessment in order to complete theirmeaningful use attestation – whichis the healthcare provider confirmingthat they meaningfully use an EHRsystem.Now that we know basically whatwe’re talking about, let’s go throughimportant tips for compliance andactionable strategies – closing outwith a HIPAA compliance checklist.Five security-thought-leadertips for HIPAA complianceLet’s look first at some primary“legacy” advice on HIPAA in this section. The next section will get intosome of the more recent rule changes. Then we’ll provide a checklistthat incorporates this advice intoactionable steps so you can managecompliance simply and effectively.Here are five core pieces of advicethat relate to HIPAA before FinalOmnibus, from Raj Chaudhary, wholeads the security and privacy services group at consultancy CroweHorwath6: Keep data in the appropriatehands by strengthening securitywith logins. “[L]et's make sure thatwhen we assign user accounts toindividuals that their role matchesthe access they are provided to thesystems,” said Chaudhary. “That isdefinitely one of the key elements ofHIPAA – to make sure that only thepeople that need access to thatinformation have a user ID or a useraccount.” Also, for secure passwords,Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowrequire that new users have toswitch any default ones and meetstrictcomplexityguidelines.No-brainer, right? Monitor controls and make surelogging is working correctly. A keyaspect of the HIPAA Security Rule isthat you pay close attention toaccess of PHI. Simply put, you wantto log everything. IT personnelshould make sure that the loggingfeature is active within all systemsaround-the-clock. In addition to logging, you want to directly monitor viaa system of rules, so you can examine your data accumulation processand be certain that everything iscontinually meeting your access controls. Assess your access controls at alllayers, including the network andyour software. At the level of thenetwork, you have user IDs andstrong passwords. This level of security is usually less problematicbecause it’s managed directly by IT.The other critical layer, though, is thesoftware, when anyone uses it. You9need to maintain control of thatlayer.Plus, although it’s annoying to usersto get locked out of their accounts,Chaudhary noted that it’s a lesserevil to getting hacked. “[A]s an example, if somebody externally breaks inthrough your firewall to get to yoursystems and is now trying to guessthe password, you've got to makesure that you have some sort of alock-out after a few of theseattempts,” he said. “I typically recommend that after 10 failed attempts,one should be locked out.” Pay careful attention to your business associates who are handlingany PHI, aka protected health information. Chaudhury recommendedcarefully reviewing your businessassociate agreement (BAA) that controls your data relationship with eachvendor who is handling your data.Note that as of the effective date ofthe Omnibus Rule (September 23,2013), business associates now aredirectly responsible for meeting theparameters of HIPAA – in otherSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowwords, you are now less exposed bythe law since the vendors carry someof the burden. Nonetheless, due diligence is still necessary.His four step plan is:1. Carefully read and sign a businessassociate agreement with thevendor.2. Make sure you are in compliancewith the “minimum necessary” protection. To be clear, “minimum necessary” means that you only disclose theamount of information that you absolutely have to. It’s an expectation setforth in the HIPAA Privacy Rule.73. Conduct a performance assessment of the vendor.4. Every year, reassess whether ornot the business associate is in compliance with the BAA.According to Chaudhary, coveredentities (the healthcare plans, providers, and clearinghouses describedabove) often don’t keep ongoing andupdated records on their businessassociate agreements. “The agreements are not all consistent and notupdated on a regular basis,” he said.10“And most likely, people don't applythe ‘minimum necessary’ rule andthey provide more information thanis necessary to perform that series oftasks that they were hired to do.” Createall-encompassing,step-by-step procedures for incident response and business continuity. Basically, you need businesscontinuity planning to be robust, andincident response planning needs tobe fully described within your finaldocuments. To manage businesscontinuity, it’s essential to conduct abusiness impact assessment, leadinginto a business continuity plan, andfinishing out with a disaster recoveryplan.Chaudhary commented that one element of business continuity that isoften neglected is the people. Youneed to know the people who areultimately responsible to lead theresponse in the event of a disaster.Also, when you are putting togetherthe business impact assessment,keep in mind that your goal is to haveSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowa reasonably good gauge of mission-critical systems – telling you therecovery time objectives that mustbe met in order to keep any expenses arising from a loss of businesscontinuity to a minimum.Three specific HIPAA tips youneed to know post-omnibusThe Office for Civil Rights (OCR) ofthe HHS Department started performing HIPAA compliance auditsmore aggressively in 2016. Businesses are understandably concernedabout audits because they don’twant to end up in a publicity nightmare, with their competence andcredibility called into question.Prior to 2016, audits only occurredfollowing a complaint or news reporton problematic activity at a particular covered entity or business associate. A 2015 report found that theOCR was not doing enough tomanage compliance with HIPAA. In2016, the OCR “strengthen[ed] itsreview efforts by implementing asecond phase of audits that was11scheduled to occur in 2014, butencountered a number of delays,”noted Clyde Bennett in Help NetSecurity8. For the assessments thattook place in 2016, “providers withfewer than 15 physicians and healthcare business associates will be subject to audits,” he added.It’s important to update your procedures and related documents so thatyou are up-to-date with HIPAA compliance following the adjustmentsmade within the Final Omnibus Rule.Here are three basic considerations: BAA 2.0 - You want your businessassociate agreement to reflect theOmnibus Rule, which broadenedresponsibility for HIPAA complianceto include business associates. It isnow legally necessary for businessassociates to directly follow allHIPAA law. Next-gen privacy policy - Anotherbig part of the Omnibus Rule wasrevisions of privacy parameters.Changes were made in treatment ofdeceased patients, patient accessSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know12rights, response to ePHI requests,disclosure to insurance and Medicare, data distribution, immunizations, and how to handle data formarketing, fundraising, and researchpurposes. Forward-focused training - Yourstaff needs to know how this criticalhealthcare law is changing, as indicated by the Omnibus Rule. Providetraining to keep your business free offines and lawsuits. Business associates need to train as well. Documentthis effort so you're audit-ready.Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
ImportantComplianceFundamentalsYou YouNeedto Know\\ The GoodsHIPAA HIPAACompliance:ImportantFundamentalsNeedto Know8 13Checklist: How to Make Sure You’re Compliant(Must-do) Authenticate ePHI. You mustauthenticate because it protectsdata from corruption and incorrectThe team at HIPAA Journal9 wentthrough the HIPAA Security, Privacy,and Breach Notification Rules; andthe HIPAA Omnibus Rule to createthis up-to-date checklist. Whatfollows is a summary of the checklist,which is organized according to thevarious rules of HIPAA:HIPAA Security Rule To-DoTechnical protections Scramble. Encrypt any ePHI tomeet NIST parameters any time it isoutside the firm’s firewalled hardware. (Must-do)destruction. (Or alternatives) Become scramble-ready. All devices that access the system should beable to encrypt and decrypt messages. (Or alternatives) Control activity audits. You wantto log any access efforts and howdata is manipulated. (Must-do) Enable automatic logoff. You logpeople out after a certain set timeframe. (Or alternatives)Physical protections Control access. “This not onlymeans assigning a centrally-controlled unique username and PINcode for each user,” notes HIPAAJournal, “but also establishing procedures to govern the release or disclosure of ePHI during an emergency.” Control facility access. You wantto carefully track the specific individuals who have physical access todata storage – not just engineers,but also repair people and even custodians. You must also take reason-Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowable steps to block unauthorizedentry. (Or alternatives) Manage workstations. Writepolicy that limits which workstationscan access health data, describeshow a screen should be guardedfrom parties at a distance, and delineates proper workstation use.(Must-do) Protect mobile. You want a mobiledevice policy that removes databefore a device is circulated toanother user. (Must-do) Track servers. You want all yourinfrastructure in an inventory, alongwith information pertaining to whereit’s located. Copy all data completelybefore you move servers. (Or alternatives)Administrative protections Assess your risk. Perform a comprehensive risk assessment for allhealth data. (Must-do) Systematize risk management.14“The risk assessment must berepeated at regular intervals withmeasures introduced to reduce therisks to an appropriate level,” advisesHIPAA Journal. “A sanctions policy foremployees who fail to comply withHIPAA regulations must also beintroduced.” (Must-do) Train your staff. You need to trainon all ePHI access protocols and howto recognize potential hacking.Record all these sessions. (Or alternatives) Build contingencies. You must beable to achieve ongoing businesscontinuity, responding to disasterswith a prepared process that keepsdata safe. (Must-do) Test your contingencies. You musttest your contingency plan on a regular basis, with relation to all key software. A backup system and restoration policy should be adopted. (Oralternatives) Block unauthorized access. Becertain that parties that haven’t beenSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowgranted access, such as subcontractors or parent companies, can’t viewePHI. Sign business associate agreements with all partners. (Must-do) Document all security incidents.Note that this step is separate fromthe Breach Notification Rule, whichhas to do with actual successfulhacks. A security incident can bestopped internally before data isbreached. Staff should recognize andreport these occurrences. (Or alternatives)HIPAA Privacy Rule To-Do Respond promptly. HIPAA givesyou 30 days to get back to patientaccess requests. (Must-do) Get down with NPP. Put togetheraNotice of Privacy Practices (NPP) toofficially inform patients and subscribers of data sharing policies.(Must-do) Train your staff. Beyond the training described above, make sure your15personnel understand what data canand cannot be shared “beyond thefirewall.” (Or alternatives) Don’t succumb to corruption.“Ensure appropriate steps are takento maintain the integrity of ePHI andthe individual personal identifiers ofpatients,” instructs HIPAA Journal.(Must-do) Get authority. To have the authority to use ePHI for research, fundraising, or marketing, get permissionfrom the patient. (Must-do) Update your copy. Your authorization forms should now include reference to changes in treatment ofschool immunizations, ePHI restriction in disclosure to health plans, andthe right of patients to their electronic records. (Must-do)HIPAA Breach Notification RuleTo-Do Let ‘em know. When a breach ofePHI occurs, you have to let bothyour patients and the HHS Depart-Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Knowment know. If more than 500 people’s records are involved, you alsomust notify the media. (Sound likefun?) Do you think you’re off thehook if it’s under 500 patients?Sorry, but no. You have to submitsmall-scale hacks through the OCRwebsite. “These smaller breachreports should ideally be made oncethe initial investigation has beenconducted,” said HIPAA Journal. “TheOCR only requires these reports tobe made annually.” All of the immediate notifications must be completedwithin 60 days post-discovery.(Must-do) Check twice for four. Make surethat your breach notification message contains these four elements:1.) description of the ePHI and personal identifiers involved; 2.) whatunauthorized party accessed it orrelated information; 3.) whetherdetails were simply seen or taken –viewing vs. acquirement (if youknow); and, 4.) the degree to whichrisk mitigation has succeeded.(Must-do)16HIPAA Omnibus Rule To-DoNote: For space, this section will beabbreviated because it is covered,for the most part, above. Refresh your BAA. Update yourBusiness Associate Agreements toreflect the language of the OmnibusRule. (Must-do) Send new BAA copies. You have toget signed copies of a new BAA (withthe Omnibus information incorporated) to stay compliant. (Must-do) Revitalize your privacy policy. Privacy policies must also reflect Omnibus changes. (Must-do) Modernize your NPP. “NPPs mustbe updated to cover the types ofinformation that require an authorization, the right to opt out of correspondence for fundraising purposesand must factor in the new breachnotification requirements,” advisedHIPAA Journal. (Must-do) Finalize your training. Make sureSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know17that everyone on your staff is awareof all Omnibus Rule adjustments byconducting thorough training. (Oralternatives)Our advice on the above steps, interms of whatever you need to perform in-house, is it’s a good idea tojust do everything that’s on the list –regardless of whether it’s marked“Must-do” or “Or alternatives.” Afterall, these designations are a bitunhelpful because you do still needto perform the step or a very similaralternative in order to be compliant.In the HIPAA Journal article, theseitems were called “Required” and“Addressable.” “Even though privacyand security measures are referredto as ‘addressable,’ this does notmean they are optional,” explainedthe publication. “Each of the criteriain our HIPAA compliance checklisthas to be adhered to if your organization is to achieve full HIPAA compliance.”Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
HIPAA Compliance: Important Fundamentals You Need to Know18Get Help with HIPAA ComplianceHopefully the information and resources have been helpful. If you need help withHIPAA compliance, Atlantic.Net is here to help!Atlantic.Net has been independently audited to meet all HIPAA compliance standards and requirements. Get a free consultation at 1.800.521.5881 or sales@atlantic.net. Visit tlantic.Net HIPAA Compliance FeaturesBusiness AssociateAgreementIntrusion PreventionSystemFully ManagedFirewallVulnerabilityScansLog ManagementSystemHighly AvailableBandwidthLinux & WindowsServersEncrypted BackupFile IntegrityMonitoringAntimalwareProtectionEncrypted VPNEncrypted StorageSecure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
ndamentalsFundamentalsYouYouNeedNeedto Knowto Know\\ The Goods8 arch.nih.gov/pr m/hipaa-compliance-checklist/Secure Cloud ServicesManaged & Compliant Infrastructure888-618-DATA (3282)sales@atlantic.netwww.atlantic.net
Get Help with HIPAA Compliance 18 Atlantic.Net HIPAA Hosting Features 18 References 19 Table of Contents HIPAA Compliance: Important Fundamentals You Need to Know \\ Table of Contents What exactly is HIPAA? The Health Insurance Portability and Accountability Act of 1996 is a US lawthat was passed to safeguard data and keep it from getting into .
