HIPAA Security Practices and Policies for Small Providers

Insert Name

CSIA 412Introduction

As of 2005, it is required that all health practitioners protect their security of their patients’ electronic records through the use of practices and procedures that protect the confidentiality, integrity, and availability of information (AMA, 2015). In addition to protecting the security of electronic records stored within their own system network, practitioners must also ensure that any information shared through electronic submission with outside sources is also secure. Such a task can seem daunting to a new health professional who has never before ensured compliance with such standards and if the 2013 audit performed by the U.S. Department of Health and Human Services’(HHS) Office for Civil Rights (OCR) is any indication, many small healthcare practitioners have struggled in all three safeguard areas addressed by HIPAA’s security standards (Medical Economics, 2013).

Assisting the physician

HIPAA’s Security Rule has three safeguard requirements: administrative safeguards, physical safeguards, and technical safeguards. In addition to the safeguards there are also policy and procedure standards as well as organizational requirements. Beneath each of these components of security, there are required and addressable standards and according to HHS (2007), required entities are standards with which providers must comply while addressable requirements are vetted through an assessment to determine whether the requirements are reasonable and appropriate given the size of the practice and the size, cost, and technical requirements of the security program needed. I would provide him with an outline of the security rule written in laymen’s terms, including a detailed outline of the five major components of security and after providing the physician with these outlines, I would then perform a risk management analysis in order to identify the current weaknesses and strengths in their system.

The risk analysis is a standard that is required under the administrative safeguards and is the first action I would take within the company’s network in order to not only ensure the presence of an electronic health record system but also to ensure that it is appropriately encrypted and secured. Performing a risk analysis helps to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI) and assists in establishing risks that decrease the opportunity for these records to be attacked by malware (HealthIT, 2014). Each risk analysis must include the potential risks and vulnerabilities to all forms of ePHI the company creates, receives, maintains, or transmits and applies to all forms of media that is in office or accessed off-site (HealthIT, 2014). The risk analysis vets all access points as well as any information that pertains to the health services provided including appointment times and dates. After vetting the computer system network, employees, and previous record-keeping methods, I would then provide the physician with a detailed report of my findings and suggestions for addressing potential risks and threats.

Advising the physician

Providing the physician with the Security Rule in laymen’s terms in order to increase their understanding and performing a risk analysis are simple first steps to ensuring that the physician is not only aware of what is required, but also that they are aware of how they currently measure up. In order to advise the physician on how to become compliant with HIPAA’s security rule, I would take them through the results of their risk analysis standard-by-standard and provide them with solution suggestions along the way. I would ensure that my advice was given in laymen’s terms while also providing the physician with a graphic organizer/table that would enable them to follow along, ask questions, and strengthen their understanding of where their business currently stands and the steps they can take to improve their standing.

Three most important requirements

The three most important requirements I would bring to the physician’s attention are the sanction policy, data backup plan, and facility security plan. I believe that these three are the most important requirements because they not only ensure the security of ePHI but they also create a culture of privacy for patient records. By ensuring that the staff complies to rules set in place and that they are aware of their personal responsibility through sanctions, companies ensure that a higher level of detail and care is placed upon the handling and maintenance of patient records. In addition, a data backup plan ensures that all data is accessible even in case of outside harm inflicted upon the primary data source while ensuring that the facility is secure lessens the opportunity that hardware will be tampered with or stolen. The first line of defense is always a good offense and so by ensuring that primary security is in place and maintained, companies provide fewer opportunities for security breaches.

Conclusion

The first steps to ensuring compliance is ensuring understanding and knowledge of the standards addressed by HIPAA’s security standards, knowing that it applies to any entity using electronic records, and knowing the five components that should make up the company’s security infrastructure. By ensuring a knowledge and understanding of the rule itself, practitioners can then create in house documents and policies that ensure compliance by outlining in detail the part that each team members plays. The risk analysis and the actions that result aid the health practice in not only being compliant but also in securing their networking and providing continued access to their consumers. Finally, by instituting a culture that values privacy and security, health practitioners create a system that allows for peace of mind and efficient operations.

References

American Medical Association. (2015). Security standards and risk analysis. Retrieved from: http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/security-standards.page?

HealthIT. (2014 February 20). Security risk analysis. Retrieved from: http://www.healthit.gov/providers-professionals/video/security-risk-analysis

Providers stumble after recent HIPAA audits. (2013). Medical Economics, (11), 14.

U.S. Department of Health and Human Services. (2007). Security standards: Implementation for the small provider. HIPAA Security Series. Retrieved from: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/smallprovider.pdf