What is required for HIPAA Compliance?
HIPAA regulation outlines a set of national standards that all covered entities and business associates must address.
- Self-Audits – HIPAA requires covered entities and business associates to conduct annual audits of their organization to assess Administrative, Technical, and Physical gaps in compliance with HIPAA Privacy and Security standards. Under HIPAA, a Security Risk Assessment is NOT ENOUGH to be compliant–it’s only one essential audit that HIPAA-beholden entities are required to perform in order to maintain their compliance year-over-year.
- Remediation Plans – Once covered entities and business associates have identified their gaps in compliance through these self-audits, they must implement remediation plans to reverse compliance violations. These remediation plans must be fully documented and include calendar dates by which gaps will be remedied.
- Policies, Procedures, Employee Training – Covered entities and business associates must develop Policies and Procedures corresponding to HIPAA regulatory standards as outlined by the HIPAA Rules. These policies and procedures must be regularly updated to account for changes to the organization. Annual staff training on these Policies and Procedures is required, along with documented employee attestation stating that staff has read and understood each of the organization’s policies and procedures.
- Documentation – HIPAA-beholden organizations must document ALL efforts they take to become HIPAA compliant. This documentation is critical during a HIPAA investigation with HHS OCR to pass strict HIPAA audits.
- Business Associate Management – Covered entities and business associates alike must document all vendors with whom they share PHI in any way, and execute Business Associate Agreements to ensure PHI is handled securely and mitigate liability. BAAs must be reviewed annually to account for changes to the nature of organizational relationships with vendors. BAAs must be executed before ANY PHI can be shared.
- Incident Management – If a covered entity or business associate has a data breach, they must have a process to document the breach and notify patients that their data has been compromised in accordance with the HIPAA Breach Notification Rule. Specific details about the HIPAA Breach Notification Rule and explored below.
What are the Seven Elements of an Effective Compliance Program?
The HHS Office of Inspector General (OIG) created the Seven Elements of an Effective Compliance Program in order to give guidance for organizations to vet compliance solutions or create their own compliance programs.
These are the barebones, absolute minimum requirements that an effective compliance program must address. In addition to addressing the full extent of mandated HIPAA Privacy and Security standards, an effective compliance program must have the capacity to handle each of the Seven Elements.
The Seven Elements of an Effective Compliance Program are as follows:
- Implementing written policies, procedures, and standards of conduct.
- Designating a compliance officer and compliance committee.
- Conducting effective training and education.
- Developing effective lines of communication.
- Conducting internal monitoring and auditing.
- Enforcing standards through well-publicized disciplinary guidelines.
- Responding promptly to detected offenses and undertaking corrective action.
Over the course of a HIPAA investigation carried out by OCR in response to a HIPAA violation, federal HIPAA auditors will compare your organization’s compliance program against the Seven Elements in order to judge its effectiveness.
What is a HIPAA violation?
A HIPAA violation is any breach in an organization’s compliance program that compromises the integrity of PHI or ePHI.
A HIPAA violation differs from a data breach. Not all data breaches are HIPAA violations. A data breach becomes a HIPAA violation when the breach is the result of an ineffective, incomplete, or outdated HIPAA compliance program or a direct violation of an organization’s HIPAA policies.
Here’s an example of the distinction:
A DATA BREACH occurs when one of your employees has an unencrypted company laptop with access to medical records stolen.
A HIPAA VIOLATION occurs when the company whose laptop has been stolen doesn’t have a policy in place barring laptops being taken offsite or requiring they be encrypted.
Under HIPAA regulation, there are specific protocols that must be followed in the event of a data breach. The HIPAA Breach Notification Rule differentiates between two different kinds of data breaches and outlines how covered entities and business associates must respond in the event of a breach.
A Minor Breach is a data breach that affects fewer than 500 individuals in a single jurisdiction. The HIPAA Breach Notification Rule requires HIPAA-beholden entities to gather data on all minor breaches that occur over the course of the year and report them to HHS OCR within 60 days of the end of the calendar year in which they occurred. Affected individuals must be notified that their data was involved in a Minor Breach within 60 days of the discovery of the breach.
A Meaningful Breach is a data breach that affects more than 500 individuals in a single jurisdiction. The HIPAA Breach Notification Rule requires that Meaningful Breaches be reported to HHS OCR within 60 days of the discovery of the breach. Additionally, any affected individuals must be notified upon discovery of the breach. Local law enforcement agencies should also be contacted immediately, in addition to local media agencies in order to alert potentially affected individuals within the necessary jurisdiction.
All Meaningful Breaches that are reported to the HHS are posted on the Breach Notification Portal, or “Wall of Shame.” The HHS Wall of Shame is a permanent archive of all HIPAA violations caused by Meaningful Breaches that have occurred in the US since 2009. This searchable database is a concrete consequence of a HIPAA violation that can permanently damage the reputation of health care organizations that experience a HIPAA violation or Meaningful Breach.
In 2017, OCR levied its first HIPAA settlement for a violation of the Breach Notification Rule. The $475,000 fine against Presence Health was the first in the history of HIPAA enforcement levied for failure to properly follow the HIPAA Breach Notification Rule.
Federal HIPAA auditors levy HIPAA fines on a sliding scale. Fines range between $100-$50,000 per incident depending on the level of perceived negligence. If auditors detect that the organization under investigation has neglected to perform a “good faith effort” toward HIPAA compliance, fines can become astronomical. With well over $40 million levied in fines since 2016, HIPAA compliance is more important now than ever before.
What are common HIPAA violations?
Some common causes of HIPAA violations and fines are listed here: