HIPAA Compliance Checklist

This HIPAA compliance checklist was designed to help organizations understand their obligations under the law. The checklist items are not a complete list, just a starting point for your compliance program. HIPAA requires a yearly risk analysis to identify new vulnerabilities. Any business process change or new technology usage introduces new risk into an organization’s security program, so it’s important to review the standards regularly.

Who Does HIPAA Apply To?

First, recall that HIPAA regulations only apply to covered entities and their business associates. Individuals (unless they fall into one on of the following categories) do not have responsibilities under HIPAA. It is okay for a patient to disclose information about their medical conditions and treatments to others in whatever format they choose.

Covered Entities

Covered entities are organizations that provide health care, process medical information, or manage health insurance plans. There are three main categories of covered entities that include:

1. Health care providers: Individuals or organizations that provide care, services, or supplies related to the health of an individual. This category also includes those who sell or dispense pharmaceuticals, medical devices, and equipment in accordance with a prescription.
2. Health plans: An individual or group plan that provides or pays the cost of medical care.
3. Health care clearinghouses: An entity that processes medical claims submitted by health care providers to insurance companies.

Business Associates

The HITECH Act extended HIPAA compliance requirements to the business associates of covered entities. A business associate is a company that collects, processes, or stores protected health information (PHI) on behalf of a covered entity. A few examples of business associates include marketing agencies, IT companies, financial services, or legal offices. LuxSci is a business associate. We store and transmit PHI on our servers and networks, and we have a responsibility to our customers to keep that data safe under the law.

Furthermore, the Omnibus rule requires business associates of business associates to also follow HIPAA regulations if they handle ePHI. An example of this scenario would be if a marketing agency working for a hospital contracted LuxSci for web hosting or online form services. Even though we don’t directly work with the hospital in this instance, we must still sign a business associates agreement that outlines how we will secure sensitive information.

Understanding PHI

Before diving into the HIPAA compliance checklist, it’s important to understand what data needs to be secured. HIPAA regulations safeguard protected health information. Otherwise known as PHI, it is simply defined as individually identifiable health-related information. Health-related information includes information about past, present, or future medical conditions, treatments, provisioning, and payments.

To fall under the PHI category, health-related information must be linked to an individual identifier. Some of the most common personal identifiers include: names, email addresses, phone numbers, medical record numbers, photos, and driver’s license numbers. When PHI is electronically stored or transmitted, it is called ePHI.

Medical records are an obvious example of PHI. However, even less sensitive items like email or text appointment reminders can infer medical information about a patient and also need to be properly secured. Think about it- something like an appointment reminder may mention the doctor’s name and the place of treatment in combination with an individual’s name and email address. Depending on the message content, it may be ePHI.

For more details, see: What exactly is ePHI? Who has to worry about it? Where can it be safely located?

It is crucial that organizations understand exactly what PHI they are responsible for protecting. Even seemingly innocuous text messages or email communications can land an organization in trouble if not properly secured.

Understanding the HIPAA Compliance Checklist

HIPAA uses the terms ‘required’ and ‘addressable’ to describe standards within the law. Required (R) means that the standard is mandatory. Addressable (A) means that the standard must be implemented by the organization unless a risk analysis concludes that implementation is not reasonable and appropriate. Important Note: Addressable does not mean optional.

The HIPAA Security Standard reflects a technology-neutral approach. This means that there are no specific technological systems to implement. Organizations must decide and document how they plan to meet each standard.

Which standards should be addressed?

One general rule is that any time there is risk, it should be addressed. If an organization decides to send unencrypted ePHI over the Internet, then there is a major risk of disclosure. An organization could be considered willfully negligent if an unauthorized user gained access to unencrypted ePHI. However, if the organization only sends ePHI between two machines over a private/closed network segment, then there may be no need to encrypt the data flow because the risk of a breach is much lower. If the organization chooses not to encrypt the data, they should fully document and outline their reasoning for why they are choosing not to implement the standard.

Ignoring HIPAA requirements, addressable or required, is “willful negligence.” If there is a breach or violation, the penalties in cases of willful negligence are severe. Ignorance is no excuse.

HIPAA Compliance Checklist

HIPAA standards fall into four categories. Standards denoted with a (R) are required, while those with an (A) are addressable.

Administrative Requirements

Administrative requirements pertain to employee training. Organizations must implement security measures to reduce systemic risks and safeguard electronic and physical information.

1. Risk Analysis: (R) Perform a risk analysis to understand where PHI is stored to determine what data is at risk.
2. Risk Management: (R) Implement measures to reduce identified risks to an appropriate level.
3. Sanction Policy: (R) Implement sanction policies for employees who fail to comply.
4. Information Systems Activity Reviews: (R) Regularly review system activity, logs, audit trails, etc.
5. Officers: (R) Designate HIPAA Security and Privacy Officers.
6. Employee Oversight: (A) Create procedures to authorize and supervise employees who work with PHI, and for granting and removing PHI access to employees. Ensure that an employee’s access to PHI ends with termination of employment.
7. Multiple Organizations: (R) Protect PHI from unauthorized parent or partner organizations or by unauthorized subcontractors.
8. ePHI Access: (A) Implement procedures for granting access to ePHI. Document access to ePHI or to services and systems which grant ePHI access.
9. Security Reminders: (A) Periodically send updates and reminders of security and privacy policies to employees.
10. Protection Against Malware: (A) Implement procedures to guard against and detect malicious software.
11. Login Monitoring: (A) Monitor logins to systems and report discrepancies.
12. Password Management: (A) Ensure there are procedures for creating, changing, and protecting passwords.
13. Response and Reporting: (R) Identify, document, and respond to security incidents.
14. Contingency Plans: (R) Ensure that there are accessible backups of ePHI and procedures to restore lost data.
15. Contingency Plans Updates and Analysis: (A) Periodically test and revise contingency plans.
16. Emergency Mode: (R) Establish procedures to enable continuation of critical business operations. These procedures include securing electronic protected health information while operating in emergency mode.
17. Evaluations: (R) Perform periodic evaluations to see if any changes in business operations or the law require changes to HIPAA compliance procedures.

HIPAA Organizational Requirements

Organizational Requirements include the development, documentation, and implementation of security policies and procedures and the management business associate agreements.

1. Business Associate Agreements: (R) Create and manage contracts with business partners who will have access the organization’s PHI to ensure that they will adequately safeguard data.

2. Policies, Procedures and Documentation Requirements: (R) A covered entity must implement reasonable and appropriate policies and procedures to comply with the standards and implementation specifications.

HIPAA Physical Requirements

Physical Safeguards concern physical access to buildings, workstations, computer servers, and networks. Only allow authorized access to ePHI and monitor access through established policies to prevent violations.

1. Contingency Operations: (A) Establish procedures that allow facility access in emergency situations to support the restoration of lost data.
2. Facility Security: (A) Implement policies and procedures to safeguard the facility and equipment from unauthorized physical access, tampering, and theft.
3. Access Control and Validation: (A) Institute procedures to control and validate an individual’s access to facilities based on their role or function. Log visitors and control access to software programs.
4. Maintenance Records: (A) Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security.
5. Workstations: (R) Establish policies to govern software usage. Set up procedures for proper configuration on systems that provide access to ePHI. Safeguard all workstations the provide access to ePHI and restrict access to only authorized users.
6. Devices and Media Disposal and Re-use: (R) Create procedures to securely dispose of media that contains ePHI. Put policies in place for the reuse of devices and media that formerly stored ePHI.
7. Media Movement: (A) Record movements of hardware and media associated with ePHI storage. Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.

HIPAA Technical Requirements

Technical Safeguards ensure the security of data at rest and in transmission. Controlling access to ePHI provides a reviewable log of users in case of a security incident.

1. Unique User Identification: (R) Assign a unique name or number for identifying and tracking user identities.
2. Emergency Access: (R) Establish procedures for obtaining necessary electronic protected health information during an emergency.
3. Automatic Logoff: (A) Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.
4. Encryption and Decryption: (A) Institute a mechanism to encrypt and decrypt electronic protected health information when deemed appropriate.
5. Audit Controls: (R) Establish hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
6. ePHI Integrity: (A) Create policies and procedures to secure electronic protected health information from improper alteration or destruction.
7. Authentication: (R) Implement procedures to verify the identities of people or entities seeking access to electronic protected health information.
8. Transmission Security: (A) Institute technical security measures to guard against unauthorized access to electronically transmitted protected health information.

What Else should I know about HIPAA compliance?

Compliance is an ongoing process, not a one-time event. This HIPAA compliance checklist represents only an overview of the major points. Each organization will need to complete their own risk assessment to understand what data is at risk and the steps they need to take to secure it. It’s easy to see why many organizations choose to work with third parties to secure their technology. If your company needs help with HIPAA-compliant email and web services, reach out to LuxSci today.