HIPAA Compliance Check-Up for 2020—What You Need to Know

For any business in the healthcare industry, it’s crucial to remain compliant with all HIPAA (Health Insurance Portability and Accountability) guidelines. Failure to comply not only brings potential violation fines and penalties by the Office of Civil Rights, but patients’ health information is put at risk.

HIPAA compliance means fulfilling the requirements of the act, including any amendments and related legislation. Maintaining security and compliance is a growing challenge, especially as organizations move data to the cloud. There’s also the threat of increasingly sophisticated attacks and threats. With 2020 here, it’s important to ensure your business operations are compliant with HIPAA. To do so, start by asking yourself these questions:

• Have you conducted the required self-audits?
• Are you using those audits to identify gaps?
• Have you created a plan to remedy the gaps?
• Have all of your employees completed the annual HIPAA training?
• Do your policies and procedures lineup with HIPAA privacy, security, and breach notification rules?
• Have you identified all your vendors?
• Do you have a response plan in the event of a breach?

In conjunction with answering those questions, it’s important to also take a look at your company’s safeguards and make sure they’re where they need to be.

Implementing HIPAA 2020 Safeguards

The HIPAA Security Rule contains requirements regarding how businesses need to protect patient data. The three parts of the Security Rule include technical safeguards, physical safeguards, and administrative safeguards.

Technical Safeguards

Technical safeguards are the technology you implement to access and protect patient data. To remain compliant, the data has to be encrypted to NIST standards once it travels past an organization’s internal firewall. In the event of a breach, the information is then unreadable and unusable. Businesses can implement encryption and decryption tools, introduce activity logs and audit controls, or implement a means of access control.  

Physical Safeguards

Physical safeguards focus on access to ePHI (electronic protected health information). This information could be stored in a remote data center, in the cloud, or on servers located on a business’s premises. To remain compliant, your business must have facility access controls in place, an inventory of hardware, and policies for the use of workstations and mobile devices.

Administrative Safeguards

Administrative safeguards are the policies and procedures that bring the technical and physical safeguards together. This includes conducting risk assessments, introducing a risk management policy, training employees to be secure, developing and testing a contingency plan, and reporting security incidents. These are not one-time events. Any time HIPAA policies change, administrative safeguards need to be updated. When you work with a managed services provider like Concept Technology, we can handle implementing and maintaining many of your administrative safeguards.

A number of our managed services help healthcare businesses remain compliant with HIPAA. Not only do we provide business with enhanced endpoint security solutions and protections, but we’re available 24/7 to ensure your data is protected and all patient information remains confidential. If you’re looking to improve your company’s data security, contact us today.

You can also find us on LinkedIn, Facebook at @concepttechnologyinc, and check in for Nashville’s happenings on Twitter at @ConceptTechInc.