Who must comply with HIPAA?
HIPAA applies to covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically. It also applies to business associates, the vendors that create, receive, maintain or transmit protected health information on a covered entity's behalf.
That second group is wide. Cloud and IT providers, billing companies, software vendors and consultants can all be business associates, and they carry their own direct obligations under the Security Rule.
What does the Security Rule require?
The Security Rule requires administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of ePHI. Everything starts with an accurate and thorough risk analysis, followed by risk management to bring those risks down to a reasonable level.
Missing or outdated risk analyses are among the issues OCR raises most often in its enforcement actions. The analysis should be reviewed periodically and whenever your environment changes. HHS has also proposed updates to the Security Rule, and we track that rulemaking for our clients.
What we do
We perform a NIST-based, HIPAA-focused risk analysis that identifies where ePHI lives, the threats to it and the controls in place. We then test your environment against the Security Rule's standards and implementation specifications to find gaps.
From there we write the security plan and policies you need and give you a remediation plan ranked by risk, so your team knows what to fix first. Our approach is designed to fit around clinical and business operations, not interrupt them.
