Category: HIPAA

HIPAA provides guidance for the proper uses and disclosures of protected health information (PHI), how to secure PHI, and the response activities in case there is a breach. The HIPAA rules and regulations consists of five major components

• HIPAA Security Rule
• HIPAA Privacy Rule
• HIPAA Omnibus Rule
• HIPAA Breach Notification Rule
• HIPAA Enforcement Rule

A summary of these Rules is discussed below.

HIPAA Security Rule:
The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate technical, physical and administrative safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.

Technical Safeguards

Technical Safeguards concern the technology that is used to protect ePHI and provide access to the data. The only stipulation is that ePHI – whether at rest or in transit, it must be encrypted once it travels beyond an organization´s internal firewalled servers. This is so that any breach of confidential patient data renders the data unreadable, undecipherable, and unusable. Thereafter organizations are free to select whichever mechanisms are most appropriate to:

Physical Safeguards

Physical Safeguards focus on physical access to ePHI irrespective of its location. ePHI could be stored in a remote data center, in the cloud, or on servers which are located within the premises of the HIPAA covered entity. They also stipulate how workstations and mobile devices should be secured against unauthorized access:

HIPAA Administrative Safeguards

The Administrative Safeguards are the policies and procedures which bring the Privacy Rule and the Security Rule together. They are the pivotal elements of a HIPAA compliance checklist and require that a Security Officer and a Privacy Officer be assigned to put the measures in place to protect ePHI, while they also govern the conduct of the workforce.

HIPAA Privacy Rule

• The HIPAA Privacy Rule governs how ePHI can be used and disclosed. In force since 2003, the Privacy Rule applies to all healthcare organizations, the providers of health plans (including employers), healthcare clearing houses and – from 2013 – the Business Associates of covered entities.
• The Privacy Rule demands that appropriate safeguards are implemented to protect the privacy of Personal Health Information. It also sets limits and conditions on the use and disclosure of that information without patient authorization. The Rule also gives patients – or their nominated representatives – rights over their health information including the right to obtain a copy of their health records – or examine them – and the ability to request corrections if necessary.
• Under the Privacy Rule, covered entities are required to respond to patient access requests within 30 days. Notices of Privacy Practices (NPPs) must also be issued to advise patients and plan members of the circumstances under which their data will be used or shared.

HIPAA Omnibus Rule:

HHS enacted the  final Omnibus Rule  in 2013 to address policy gaps in earlier HIPAA rules. Most notably, the Omnibus Rule defines the role of business associates, which were not previously subject to HIPAA rules, and outlines the criteria for Business Associate Agreements (BAAs) which must be executed between organizations sharing PHI before any information is transferred, handled, or maintained.

HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule requires covered entities to notify patients when there is a breach of their ePHI. The Breach Notification Rule also requires entities to promptly notify the Department of Health and Human Services of such a breach of ePHI and issue a notice to the media if the breach affects more than five hundred patients.

There is also a requirement to report smaller breaches – those affecting fewer than 500 individuals – via the OCR web portal. These smaller breach reports should ideally be made once the initial investigation has been conducted. The OCR only requires these reports to be made annually.

Breach notifications should include the following information:

• The  nature of the ePHI involved, including the types of personal identifiers exposed.
• The unauthorized person who used the ePHI  or to whom the disclosure was made (if known).
• Whether the ePHI was actually  acquired or viewed  (if known).
• The extent to which the  risk of damage has been mitigated.

HIPAA Enforcement Rule

HIPAA Enforcement Rule governs the investigations that follow a breach of ePHI, the penalties that could be imposed on covered entities responsible for an avoidable breach of ePHI and the procedures for hearings. Although not part of a HIPAA compliance checklist, covered entities should be aware of the following penalties:

• A violation attributable to ignorance can attract a fine of $100 – $50,000.
• A violation which occurred despite reasonable vigilance can attract a fine of $1,000 – $50,000.
• A violation due to willful neglect which is corrected within thirty days will attract a fine of between $10,000 and $50,000.
• A violation due to willful neglect which is not corrected within thirty days will attract the maximum fine of $50,000.
• Fines are imposed per violation category and reflect the number of records exposed in a breach, risk posed by the exposure of that data and the level of negligence involved.
• Penalties can easily reach the maximum fine of $1,500,000 per year, per violation category. It should also be noted that the penalties for willful neglect can also lead to criminal charges being filed.
• Civil lawsuits for damages can also be filed by victims of a breach.

The organizations most commonly subject to enforcement action are private medical practices (solo doctors or dentists, group practices, and so on), hospitals,  outpatient facilities such as pain clinics or rehabilitation centers, insurance groups, and pharmacies.

Need more insights ?  Get in touch  with our experts for any queries on HIPAA Assessment and Compliance.

All risk assessments, HIPAA – related policies and reasons why addressable safeguards have not been implemented must be chronicled in case a breach of PHI occurs and an investigation takes place to establish how the breach happened. Each of the HIPAA requirements is explained in further detail below. Business unsure of their obligation to comply with the HIPAA requirements should seek professional advice.

What should a Risk Assessment consist of?

Throughout the HIPAA regulations, there is a lack of guidance about what a HIPAA risk assessment should consist of. OCR explains the failure to provide a “specific risk analysis methodology” is due to Covered Entities and Business Associates being of different sizes, capabilities, and complexity.

However, OCR does provide guidance on the objectives of a HIPAA risk assessment:

1. Identify the PHI that your organization creates, receives, stores and transmits – including PHI shared with consultants, vendors and Business Associates.
2. Identify the human, natural and environmental threats to the integrity of PHI – human threats including those which are both intentional and unintentional.
3. Assess what measures are in place to protect against threats to the integrity of PHI, and the likelihood of a “reasonably anticipated” breach occurring.
4. Determine the potential impact of a PHI breach and assign each potential occurrence a risk level based on the average of the assigned likelihood and impact levels.
5. Document the findings and implement measures, procedures, and policies where necessary to tick the boxes on the HIPAA compliance checklist and ensure HIPAA compliance.
6. The HIPAA risk assessment, the rationale for the measures, procedures and policies subsequently implemented, and all policy documents must be kept for a minimum of six years.

As mentioned above, a HIPAA risk assessment is not a one-time requirement, but a regular task necessary to ensure continued compliance. The HIPAA risk assessment and an analysis of its findings will help organizations to comply with many other areas on our HIPAA compliance checklist and should be reviewed regularly when changes to the workforce, work practices or technology occur.

Depending on the size, capability, and complexity of a Covered Entity, compiling a fully comprehensive HIPAA risk assessment can be an extremely long-winded task. There are various online tools that can help organizations with the compilation of a HIPAA risk assessment although, due to the lack of a “specific risk analysis methodology”, there is no “one-size-fits-all solution.

The OCR pilot audits identified risk assessments as the major area of Security Rule non-compliance. Risk assessments are going to be checked thoroughly in the second phase of the audits not just to make sure that the organization in question has conducted one, but to ensure they are comprehensive and ongoing. A risk assessment is not a one-time requirement, but a regular task necessary to ensure continued compliance.

The difference between the “required” safeguards and the “addressable” safeguards on the HIPAA compliance checklist is that “required” safeguards must be implemented whereas there is a certain amount of flexibility with “addressable” safeguards. If it is not reasonable to implement an “addressable” safeguard as it appears on the HIPAA compliance checklist, covered entities have the option of introducing an appropriate alternative, or not introducing the safeguard at all.

That decision will depend on factors such as the entity’s risk analysis, risk mitigation strategy and what other security measures are already in place. The decision must be documented in writing and include the factors that were considered, as well as the results of the risk assessment, on which the decision was based.

Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law, mainly focused on protecting sensitive patient health information from being disclosed without the patient’s consent or knowledge. The law that provides baseline privacy and security standards for medical information of US citizens and included Administrative Simplification provisions that required HHS to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security

Healthcare information regulated by HIPAA is called protected health information (PHI). PHI is any demographic information that can be used to identify a patient. PHI can include a patient’s name, address, Social Security Number, insurance ID number, medical record, full facial photograph, and others.

HIPAA compliance involves fulfilling the requirements of the HIPAA of 1996, it’s subsequent amendments, and any related legislation such as the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Applicability of HIPAA

Under HIPAA regulation, there are two classes of healthcare organizations that must be HIPAA compliant. These are:-

Covered Entity– A covered entity is a health care provider, a health insurance plan or a health care clearing houses whose activity is to creates, maintains or transmits PHI. Most health care providers employed by a hospital are not covered entities. The hospital is the covered entity and responsible for implementing and enforcing HIPAA complaint policies. Examples like

Business Associate– Person or business that provides a service to or performs a certain function or activity for a covered entity when that service, function or activity involves the business associate having access to PHI maintained by the covered entity. Examples like IT Managed Services, Hosting providers, Medical Transcription Services, Billing Services etc.,

HIPAA Rules:

Since HIPAA legislation passed in 1996, Department of Health and Human Services (HHS) added multiple Rules to protect patients Privacy and Security of the patients data.

HIPAA rules that require healthcare organizations — and their business associates — to protect patient privacy and secure patient data by ensuring technical, physical, and administrative safeguards are in place and adhered to, that they comply with the HIPAA Privacy Rule in order to protect the integrity of PHI, and that – should a breach of PHI occur – they follow the procedure in the HIPAA Breach Notification Rule.

HIPAA Compliance required on the following rules.

1. Security Rule
   – Technical Safeguards
   – Physical Safeguards
   – Administrative Safeguards
2. Privacy Rule
3. Breach Notification Rule
4. Omnibus Rule
5. Enforcement Rule

The Security Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information.

The HIPAA Privacy Rule governs how ePHI can be used and disclosed. In force since 2003, the Privacy Rule applies to all healthcare organizations, the providers of health plans (including employers), healthcare clearing houses and – from 2013 – the Business Associates of covered entities.

The Privacy Rule demands that appropriate safeguards are implemented to protect the privacy of Personal Health Information. It also sets limits and conditions on the use and disclosure of that information without patient authorization. The Rule also gives patients – or their nominated representatives – rights over their health information including the right to obtain a copy of their health records – or examine them – and the ability to request corrections if necessary.

Breach Notification Rule:

The HIPAA Breach Notification Rule sets standards for the process that covered entities and business associates must follow in the event of a breach. The HIPAA Breach Notification Rule requires covered entities to notify patients when there is a breach of their ePHI. The Breach Notification Rule also requires entities to promptly notify the Department of Health and Human Services of such a breach of ePHI and issue a notice to the media if the breach affects more than five hundred patients.

Omnibus Rule:

HHS enacted the  final Omnibus Rule  in 2013 to address policy gaps in earlier HIPAA rules. Most notably, the Omnibus Rule defines the role of business associates, which were not previously subject to HIPAA rules, and outlines the criteria for Business Associate Agreements (BAAs) which must be executed between organizations sharing PHI before any information is transferred, handled, or maintained.

Enforcement Rule:

The  Enforcement Rule  empowers HHS to enforce the Privacy and Security Rules. It gives OCR the authority to investigate HIPAA complaints, conduct compliance reviews, perform education and outreach, and  levy fines  of up to $1.5 million. OCR also works with the Department of Justice to refer possible criminal violations of HIPAA.  Read more about HIPAA Rules

Steps to became HIPAA Compliant:

1. Implementing written policies, procedures, and standards of conduct.
2. Designating a compliance officer and compliance committee.
3. Conducting effective training and education.
4. Developing effective lines of communication.
5. Conducting internal monitoring and auditing.
6. Enforcing standards through well-publicized disciplinary guidelines.
7. Responding promptly to detected offenses and undertaking corrective action.

Need more insights ? Get in touch with our experts for any queries on HIPAA Assessment and Compliance.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law in the United States that was created to ensure the privacy and security of health data. The Privacy Rule, also known as the Standards for Privacy of Individually Identifiable Health Information, is one of the most important parts of HIPAA. It defines how healthcare providers, health plans, health care clearinghouses  and other entities covered by HIPAA can use and disclose an individual’s protected health information (PHI). 

The act also covers health care providers that conduct certain health care transactions electronically. 

The Privacy Rule limits uses and disclosures to certain circumstances: 

–  To provide treatment, 
–  For payment, 
–  For healthcare operations, 
–  For public health activities, 
–  In specialized government functions such as military or intelligence purposes, 
–  For research purposes with consent, or 
–  If required by law. 

The Privacy Rule requires covered entities to provide individuals with notice about their privacy practices, including how they use and disclose their personal health information. It also limits certain uses and disclosures of this information without an individual’s written authorization. The key standards outlined by the HIPAA Privacy Rule cover:

– Patients’ rights to access PHI
– Health care providers’ rights to deny access to PHI,
– Contents of Use and Disclosure  HIPAA release forms
– Notices of Privacy Practices, and more. 

The Privacy Rule gives individuals rights over their protected health information, including the right to examine and obtain a copy. The Rule also gives individuals the right to request in writing that an organization restrict uses or disclosures of their protected health information.  

The regulatory standards must be documented in the organization’s HIPAA Policies and Procedures. 

The healthcare industry has seen rapid changes in the past few years, especially with the advent of IoT devices that have been evolving at a faster pace. We have seen considerable development, even having a long way to go. The pandemic fueled rapid adoption, revealing the vulnerabilities, and inefficiencies in this sector.

While major IoT healthcare initiatives currently revolve around telemedicine and remote monitoring, the upcoming phase had a broader scope like tracking, monitoring and maintaining medical equipment and healthcare assets etc. Applications like personal healthcare, biosensors, smart beds, smart pills, the health insurance industry, robotics, and other specializations have just expanded the scope of IoT, and we haven’t talked about the pharma industry yet.

Benefits of IoT Healthcare

The ongoing pandemic clearly paved the way for faster adoption of the IoT devices and tele healthcare services. The key advantages of having IoT in healthcare are :

• Medical Mobility :  When more patients need urgent assistance, it becomes necessary for the medical staff to track and maintain records of even hundreds of patients, serving in real time. IoT helps in tracking and getting alert when any critical change in a patient’s parameter occurs, aiding in locating and providing direct assistance asap.
• Patient Data Processing :  Medical professionals tend to spend hours processing different kinds of medical information, Coupled with ML, IoT can excessively reduce these efforts to a few minutes, additionally offering possible treatment options.
• Enhanced preventive medicine, by better understanding conditions (courtesy of IoT data) and providing timely diagnosis without awaiting for obvious symptoms.
• Mass reduction in risk of error and miscalculation due to  human factors.
• Medical Apps  for monitoring critical health issues, aid healthcare professionals in finding out whether the  patient has taken the prescribed medication else, the therapists can call and remind a patient. The whole process can be automated.
• Under secure practices,the personal data can be directly transferred to the doctor, maintaining  confidentiality,  as the information is moved from one device to another.

The IoT devices collect and transfer health data like the blood pressure, oxygen and blood sugar levels, weight, and ECG readings etc. With the increase in consumer engagements and consciousness regarding their health and better quality of life, there is a surging demand for remote healthcare services aiming to provide a better quality of life. While industries are approaching to provide a more integrated and IoT enabled healthcare solution, these industries have their own set of challenges, a larger amount of which is considering the security threat and privacy challenges.

IoT / IoMT Threats and security challenges

With the increasing market share of the IoT devices in the healthcare field, it has offered a simple door for cyber criminals trying to misuse and profit from device vulnerabilities. Ransomware tops the list of cyberthreats for healthcare organizations.

IoT Device security challenge 

The IoT concerns a wide range of modules like the data acquisition,communication, sensors etc. Owing to the lack of consideration of cybersecurity threats, they have an inherent technical debt which results in compromised medical devices with unpredictable behavior.

Network Segmentation
Most of the healthcare organizations  lack network segmentation  and  access control  of IoT, owing to this any new device introduced will have global organization access, especially to lateral moving sensitive patient information in the network channels. Lack of NATing, allows a IoT device with default configurations to be discover able on the internet.

Use of Legacy systems
Legacy systems cannot be patched or updated as this interferes with the provision of patient care that’s essential 24/7. As these systems are devoid of any new security updates, they greatly facilitate the work of attackers in formulating IoT security breaches,

Mediajacking

Security threats that are owing to the implementation of malicious media to gain access to the medical device fall under the category of media jacking. Once the software is accessed, the attacker can vary the injection quantity to potentially cause lethal damage to the patient, additionally stealing confidential information.

User Impersonation

IoT devices capture data in real time and are a treasure trove of patient data for cybercriminals. Most of the devices lack a data protocol or standard, also the use of open source softwares. The data can be misused to create fake ID using the sensitive information like medical history and social security number, to buy drugs or equipments to sell later or file a fraudulent insurance claim

For any IoT device or environment implementation, apart from  side-channel attacks, following are the key vulnerable areas in IoT device :

1. Traffic Interception
   Use of legacy systems and network segmentation increase the chances of data drain of confidential data from a secure network while transmitting information to a healthcare’s IoT system.
2. Debug Port
   Physical devices essentially come with a debug port used for development or debugging purposes. But they can also provide access to attackers to read, high jack or modify the firmware.
3. Authentication and Authorization
   Secure authentication and authorization mechanisms are necessary to ensure the protection of data against any hacking attempts.Most of the IoT devices come with a device with a default password, which are necessary to be updated to avoid ease of access to malicious hackers.

Considering security as an ‘add-on’ feature in device acquisition
Most of the activities in the device acquisition and implementation phase consider security just an add-on feature, leading to an increase in the risk of human error and poor system configuration. Even the unregulated practice of BYOD, especially by physicians belonging to independent medical groups.

Security concerns while developing IoT apps
While lightweight, developer friendly APIs are the need of the hour, the advent of IoT devices has brought a whole new challenge for IoT security developers. The following are few risks associated with the IoT app development, seen over recent years.

Understanding the costs that are linked with delivering great service levels in the IT industry is extremely important in the healthcare industry today. Among all aspects of the IT industry, data security probably ranks as #1 in the priority list. The simplest way to keep your data safe in the IT industry is by following  HIPAA compliance  – The Health Insurance Portability and Accountability act sets the standard for sensitive patient data protection and ensures that companies which have protected health information secure their physical network and keep all possible security measure.

Any entity that provides treatment, payment or any form of operation in healthcare have to meet this compliance as a mandate in the USA. Over the last few years, we have seen how cyber security has been the strongest point of threat for several businesses and any form of leakage or damage can be critical. It can in fact bring the entire business down permanently.

What are the right measures you can take to protect data?

The information that you possess are stored as emails, databases, library files etc and can there maybe several data access points for this. The biggest threat lies in the fact that this data is to be backed up and stored. Now, most of these companies do not protect their SaaS data with a backup or a recovery solution leaving them prone to troubles in case of a server failure or hacking or even malware. This is a huge threat – as  the data can be hacked into easily.

When you follow HIPAA compliance– you are completely sure of having this data protected by having your data backed up. Some of the most common practices to follow   in  HIPAA certification  are

• Create policies on using and accessing workstations, electronic media as well as data access points.
• Having a policy in place to ensure there are restrictions for transferring, deleting or adding data using any form of electronic media.
• Ensuring there is no transferable data devices that could be used in the premises.
• Having access control lines across the floor as well as towards the data that is present via the network.
• Enabling unique user Ids, emergency access procedures, auto log off sessions, encryption and decryption of data.
• Tracking those who access was granted to and random checks of the details looked at. Auditing or tracking logs on hardware as well as software platforms.

It is also mandatory to have integrity controls and measures to make sure that the data is destroyed. Having an IT disaster recovery team will ensure that any failures this kind can be rectified immediately and that patient health information is recovered accurately. Many outsourcing companies put these compliances as a mandate for all their projects as a security guideline. So, if you are in the space that looks at getting work from corridors in the healthcare industry, it makes perfect sense to have this compliance instilled in your organisation.