The HIPAA Security Rule, without the legal fog.

Who it applies to

HIPAA applies to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to their business associates: vendors that create, receive, maintain or transmit protected health information (PHI) on their behalf. If you sell software or services to healthcare organisations and touch PHI, you are likely a business associate.

The rules that matter here

The three kinds of safeguards

Administrative

• A documented risk analysis and risk management plan
• A named security official
• Workforce security, training and sanctions
• Contingency planning: backups, disaster recovery, emergency mode

Physical

• Facility access controls
• Workstation use and security
• Device and media controls, including disposal

Technical

• Unique user identification and access control
• Audit controls that record activity
• Integrity controls for ePHI
• Person or entity authentication
• Transmission security

The risk analysis

A risk analysis is required, and it is the document regulators most often find missing or out of date. It identifies where ePHI lives, the threats to it, the controls in place and the remaining risk. Review it regularly and whenever systems change.

Business associate agreements

A covered entity and its business associate must have a business associate agreement (BAA) that sets out how PHI is protected. Business associates need BAAs with their own subcontractors that handle PHI. Keep every BAA on file with its dates.

Breach notification

After a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Notices may also be owed to the Department of Health and Human Services and, for larger breaches, the media. Business associates must notify the covered entity.

How Doniastack helps

Map the safeguards to the controls you run, keep the risk analysis and policies current, assign and track staff training, and hold BAAs with their expiry dates in the vendor register. Incidents are logged with their reporting clocks.