How to Achieve Healthcare App Compliance
As a healthcare app developer, you may be wondering what you need to do to ensure that your app is HIPAA compliant. It is easier to address HIPAA requirements as you are developing your app, rather than try to make your app compliant after the fact. Healthcare app compliance is similar to compliance for any other software that has access to patient’s protected health information (PHI). To give healthcare app developers a comprehensive overview of what they need to do to ensure HIPAA compliance, how to achieve healthcare app compliance is discussed below.
What Security Features Are Required for Healthcare App Compliance?
User Authentication
To prevent unauthorized access to PHI, you should implement multi-factor authentication (MFA) for users to gain access to your app. MFA requires users to enter multiple login credentials to access your app (i.e., username and password in combination with biometrics, one-time PIN, security questions). Or, alternatively, you can require users to implement passwords with a combination of lowercase and uppercase letters, numbers, and special characters. However, it is recommended that you utilize MFA for additional security.
Access Controls
Access controls allow different access levels to PHI to employees based on their job function.The HIPAA Privacy Rule states that employees should only have access to the PHI that they need. Healthcare app compliance requires developers to enable unique login credentials for each user so that no employee has more access to PHI than they need.
Audit Controls
To ensure that PHI access is in accordance with the HIPAA Privacy Rule, you must track access to PHI. Audit logs track which users access PHI, what they accessed, what they did (read, created, updated, or deleted), and how long it was accessed for. Audit logs also enable quick detection of unauthorized access to PHI, as normal access patterns are established for each employee. Therefore, if PHI is being accessed outside of the employee’s normal access patterns, it is likely to be an entity posing as the employee.
Automatic Logoff
Also preventing unauthorized access to PHI, automatic logoff logs a user out of your app after a period of inactivity. It is recommended that you set automatic logoff after 2 -3 minutes of inactivity for a mobile phone, and 10 -15 minutes of inactivity for a secure workstation (in a highly protected environment).
Transmission Security
To prevent unauthorized access to PHI being transmitted through your app, you should implement HTTPS for all of your communications. This is especially important for the sign in screen, as well as pages with PHI, and authorization cookies. This uses a special algorithm to encrypt data using SSL/TLS protocols. To implement HTTPS for your healthcare app, you can get an SSL certificate from a trusted provider to install in your app. You must also use SSH or FTPS protocol, rather than FTP, to send PHI files.
Encryption/Decryption
To prevent unauthorized access to data stored on your system, you must implement encryption. That way, if one of your software developers were to lose their laptop (or other portable electronic device) or have it stolen, an unauthorized user would be unable to view PHI. Several HIPAA breaches occur each year from the loss or theft of unencrypted devices, as such, any device that contains PHI must be encrypted.
PHI Disposal
When you no longer need PHI, you must properly dispose of the data (including backups). Proper methods of PHI disposal include degaussing, overwriting the data, shredding, burning, or pulverizing. With devices such as flash drives, PHI disposal can be difficult, and cannot be accomplished with regular data destruction software. To destroy PHI on a flash drive, you can use manufacturer utilities, or a good old fashioned hammer.
Data Backup and Storage
It is essential to keep offsite data backups. This way if your data is hacked, or in the event of a natural disaster, your data is not lost. As such, you should implement a data backup and disaster recovery plan, ensuring that data can be restored. Having a plan is well and good, but you should also test your plan so that you can make adjustments if necessary.
5 Steps for Becoming HIPAA Compliant
- Self-audits, gap analysis, and remediation. An essential part of HIPAA compliance is conducting self-audits. As an app developer, you are considered a business associate under the HIPAA regulation. HIPAA business associates must conduct five self-audits annually. The purpose of conducting these audits is to assess your physical, technical, and administrative safeguards (required by HIPAA to secure PHI). Once you have completed your self-audits, gaps in your safeguards are identified, allowing you to create remediation plans to address gaps.
- Develop policies and procedures. To ensure adherence to the HIPAA Privacy, Security, and Breach Notification Rules, you must develop policies and procedures. Policies and procedures create a framework for how your organization handles PHI (what safeguards you have in place, the proper uses and disclosures of PHI, procedures for how to report a breach, etc.). Each year, you must review your policies and procedures to make adjustments for any changes in your business practices.
- Train staff. Employee training is an important part of HIPAA compliance. All staff members that may have contact with PHI as part of their job function must be trained annually. Employee training should include HIPAA basics, your organization’s policies and procedures, cybersecurity training, and the proper use of social media. When staff members are not aware of their HIPAA obligations, your organization is at risk for accidental insider breaches.
- Sign business associate agreements. Business associate agreements (BAAs) protect you, your covered entity clients, and your business associates. Even as a business associate, you likely work with other business associates. These may be organizations such as your hosting provider, email provider, or any other entity that has the potential to view your covered entity’s PHI. To ensure that your business associates adequately secure your clients’ data, you must have a signed business associate agreement before you share PHI with them. You must also be willing to sign BAAs with your covered entity clients. BAAs are legal documents that dictate the safeguards required to protect PHI; mandates each of the signing parties to manage and maintain their HIPAA compliance; determines which of the signing parties are required to report a breach (should one occur). Without a signed BAA, both parties would be held liable should a breach occur.
- Incident management. If you experience a breach affecting PHI, you must report the incident. Incidents affecting 500 or more patients must be reported within 60 days of discovery to the Department of Health and Human Services (HHS), affected patients, and the media. Breaches affecting less than 500 patients must be reported within 60 days from the end of the calendar year in which the breach was discovered (March 1) to the HHS and affected patients. If your BAA states that your covered entity client is required to report the breach, you must inform them of the breach as soon as possible so that they may inform the proper entities.
