The goal of the Health Insurance Portability and Accountability Act (HIPAA) is to simplify the administrative processes of the healthcare system and to protect patients’ privacy. Information security considerations are involved throughout the guidelines and play a major role in complying with the Privacy Rule. The purpose of this rule is to protect personally identifiable information (PII) as it moves through the healthcare system. Healthcare organizations, including providers, payers and clearinghouses, must comply with the Privacy Rule.
To help healthcare organizations comply with the Privacy Rule, Security Standards have been created to help organizations protect PII. These standards encompass administrative procedures, technical security mechanisms and services, and physical safeguards. Compliance with HIPAA and the Security Standards outlined by the Act is imperative to the ongoing business operations of healthcare companies. Failure to comply may not only result in regulatory actions, such as fines, but also direct business loss from lawsuits, damage to reputation and degradation of the public’s trust.
Administrative Procedures
Administrative Safeguards
| Standard | Summary of Requirements | Solutions |
| Security Management Process | Implement policies and procedures to prevent, detect, contain and correct security violations;Specifications include:
|
|
| Workforce Security | Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information (EPHI) and to prevent those workforce members who do not have access from obtaining access to electronic protected health information;Specifications include:
|
|
| Information Access Management | Implement policies and procedures for authorizing access to EPHI;
Specifications include:
|
|
| Security Awareness and Training | Implement a security awareness and training program for all members of its workforce including management;Specifications include:
|
|
| Security Incident Procedure | Implement policies and procedures to address security incidents;Specifications include:
|
|
| Contingency Plan | Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems that contain EPHI;Specifications include:
|
|
| Evaluation | Perform a periodic technical and non-technical evaluation that establishes the extent to which an entity’s security policies and procedures meet the above administrative safeguard requirements |
|
Physical Safeguards |
||
| Standard | Summary of Requirements | Solutions |
| Facility Access Controls | Implement policies and procedures to limit physical access to its electronic information systems while ensuring that properly authorized access is allowed;Specifications include:
|
|
| Workstation Use | Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access EPHI |
|
| Workstation Security | Implement physical safeguards for all workstations that access EPHI, to restrict access to authorized users |
|
| Device and Media Controls | Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain EPHI into and out of a facility, and the movement of these items within the facility;Specifications include:
|
|
Technical Safeguards |
||
| Standard | Summary of Requirements | Solutions |
| Access Control | Implement technical policies and procedures for electronic information systems that maintain EPHI to allow access only to those persons or software programs that have been granted access rights;Specifications include:
|
|
| Audit Controls | Implement hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use EPHI |
|
| Transmission Security | Implement technical security mechanisms to guard against unauthorized access to EPHI that is being transmitted over an electronic communications network;This includes both:
The appropriate control should be determined through a risk analysis to ensure that EPHI is protected in a manner commensurate with the associated risk when it is transmitted from one place to another. With regard to unsolicited EPHI - e.g., in e-mail from patients -- protection must subsequently be afforded once that information is in the possession of the covered entity. |
|
<< Back to top
