Adopted in 1996, the Health Insurance Portability and Accountability Act (HIPAA) was designed in part to facilitate the transfer of health insurance for citizens after leaving an employer, and to address the growing need for regulation and oversight of electronic protected health information (ePHI), also called individually identifiable health information, via the Privacy Rule. HIPAA is a substantive and often confusing piece of legislation, leading many companies to wonder if it applies to their business, what’s expected of them and how regulatory standards are enforced. Here’s a rundown of key HIPAA expectations and why they matter to your organization.
First step? Determine if you’re subject to HIPAA regulations. As noted by the CDC, there are two key groups defined by the law: covered entities and business associates. Covered entities (CEs) consist of health plans, health-care clearinghouses and health-care providers. These CEs are responsible for appropriately handling ePHI by ensuring that an accurate record of all use and transmission exists, that all data is properly encrypted and that access is restricted to specific individuals such as patients, doctors or insurance providers.
The second group, business associates (BAs), are third-parties that work with CEs and occasionally handle health data. These may include lawyers, accountants, billing companies or IT developers, and are required to sign a written agreement with CEs stating that they will properly handle health data, use the information only for stated purposes and help the CE comply with certain aspects of the Privacy Rule.
If your company is considered a CE or BA, how do you ensure HIPAA standards are being met? The Privacy Rule lays out several obligations, including:
• Notification of patients regarding their privacy rights and the specific use or disclosure of their ePHI.
• Adoption of internal privacy policies and procedures to prevent misuse.
• Training of employees to ensure they understand their role in using and transmitting ePHI.
• Creating contracts with BAs which specify their use and responsibility in safeguarding information.
• Establishing administrative, technical and physical safeguards—such as data access policies, data encryption and long-term storage in secure facilities—to ensure information privacy.
Worth noting is that willful ignorance of the rule does not constitute an acceptable reason for compliance failure. For example, this means BAs using unencrypted data cannot claim that the relevant CE did not mandate this procedure—companies are expected to know and follow the rules if they handle health data.
HIPAA requirements are now being enforced with greater regularity and rigor by the Office of Civil Rights (OCR). Through 2016 and into 2017 the agency’s focus has centered around audits, both to evaluate the use of health documents and ensure companies can produce the necessary records to demonstrate the transmission and encryption of relevant data. Expect more in-depth audits to continue over the next few years.
The OCR has also been levying more fines for non-compliance. For example, a “Did Not Know” violation can cost between $100 and $50,000 for the first offense, while “Willful Neglect” (subsequently corrected) starts at $10,000. More worrisome are identical violations in the same calendar year: For any subsequent offense, the fine is set at $1.5 million.
Why does HIPAA matter to your business? If you’re a CE or BA under the law, you’re responsible for the security, storage and use of personal health information as described by Privacy Rule stipulations. Audits are becoming more common, and steep fines are the outcome if compliance standards are not met. Best bet? Leverage the expertise of trusted HIPAA security partners who can help you meet obligations and adapt to evolving HIPAA regulations.