What is the HIPAA Security Rule? Three safeguards to have in place

The past year has catalyzed a new era of healthcare, one where telehealth visits increased as we relied on online communication to keep ourselves informed and healthy. With these adoptions also comes new challenges and considerations, and in this case, more online healthcare data. This influx calls for us to re-examine the HIPAA Security Rule to ensure healthcare entities are protecting patient information.

An introduction to the HIPAA Security Rule

In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA) to improve the efficiency and effectiveness of the US healthcare system as well as patient privacy. In the following years, several additional rules were added to ensure patients’ protected health information (PHI).

Two notable rules were added to HIPAA: the Privacy Rule, to help cover the physical security of PHI, and the Security Rule, to safeguard electronic protected health information (ePHI).

In short, the HIPAA Privacy Rule explains what data needs to be protected and who should abide by those rules, whereas the Security Rule was conceived as a national standard to protect patients and explains how to protect ePHI.

The law requires healthcare providers, plans and other entities to uphold patient confidentiality, privacy and security, and calls for three types of safeguards: administrative, physical, and technical.

Administrative safeguards

Covered entities are required to implement administrative safeguards: policies and procedures that describe how the organization intends to protect ePHI and ensure compliance to the Security Rule. Examples include preparing a data backup plan and password management processes (among other things). These standards are laid out in §164.308 of the Security Rule.

These processes include (but are not limited to) implementing the following major standards:

• Security management: This includes conducting a HIPAA risk assessment. This risk assessment can most easily be done with a compliance solution provider. A full company scan can reveal gaps and do so more efficiently and thoroughly than a manual assessment. This precaution is mandatory.
• Security personnel: Appoint a privacy officer who is responsible for enforcing policies and procedures.
• Information access management: Restrict unnecessary access to ePHI. This intersects with physical and technical safeguards. Information access management limits who can monitor and view certain files and its copies, regardless of where it resides (on servers, cloud, etc.)
• Workplace training and security awareness: Require employees to complete an annual HIPAA training and educate themselves on their organization’s specific security procedures. You may ask why this is so important. While most assume hackers are not present within our organizations, mistakes and human error such as falling for a phishing attack are increasingly common. Arming employees with the knowledge to handle data in a secure manner, identify unusual emails or eliminate insecure habits is crucial to maintaining a strong defense.
• Contingency plan: Ensure that processes are in place for unknown future circumstances related to ePHI. This is valuable in the case of an emergency or malicious attack. This rule (§ 164.308(a)(7)(ii)(A)) requires covered entities to “establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.”

Physical safeguards

These safeguards refer to both the physical structure of an organization and its electronic equipment.

Policies and procedures include monitoring and remediating:

• Access control: Limit access to facilities that contain computers and servers. This may include implementing procedures that physically protect equipment and facilities from unauthorized personnel. It also means that organizations should have a policy in place to log and keep track of maintenance records and reports that may impact physical security of a premise.
• Workstation use and security: Safeguard workstations including any computer, as well as the information within it including controls such as screen saver lock and privacy screen protectors to prevent “eavesdropping”.
• Device and media controls: Implement policies for how devices containing ePHI can be removed from a facility if necessary. This rule also requires procedures to be enacted to handle the disposal of hardware that hold ePHI.

Technical safeguards

This component includes the policies and procedures that determine how technology protects ePHI, as well as who controls access to that data. Typically, due to the level of technical literacy needed to understand this regulation, it is the most difficult for entities to understand.

Technical safeguards include the following:

• Access controls: Implement technical policies and procedures that allow only authorized persons to access ePHI. This standard also requires individuals to use a unique user identification to view ePHI, have modes in place to allow emergency access, and have technical controls to force automatic log-off after a given amount of inactivity.
• Audit controls: Introduce hardware, software, or procedural mechanisms to record and inspect access in information systems that contain or use ePHI.
• Integrity controls: Enforce policies and procedures to ensure that ePHI has not been, and will not be, improperly altered or destroyed.
• Transmission security: Take technical security measures that guard against unauthorized access to ePHI that is transmitted over an electronic network, this includes a call for encryption.

Safeguard your ePHI

At this time, the US Department of Health and Human Services has hundreds of logged cases of entities who did not protect health information and experienced a data breach, highlighting the severity one mishap can have by impacting hundreds to tens of thousands of patients. Health care information is highly sensitive and needs the utmost protection. The three components of the HIPAA Security Rule may seem difficult to implement and enforce, but with the right partners and procedures, it is feasible.

Compliance is never a one-and-done event. You and your organization must take a stance to address compliance on an ongoing basis, as the risks of not doing so are far too great. Beyond the heavy fines and penalties, data breaches can also dissolve patient, customer, and client trust — an even costlier consequence.