The HIPAA Safe Harbor Bill has Passed the Senate
Tuesday, December 22nd, 2020The HIPAA Safe Harbor bill has passed the Senate without amendment and with unanimous consent. Known formally as H.R. 7898, the HIPAA Safe Harbor Bill amends the HITECH Act to direct the Department of Health and Human Services (HHS) to recognize organizations that follow security best practices, such as those that have HITRUST CSF Certifications.
It’s hoped that allowing HHS to take these cybersecurity practices into account when determining its rulings will encourage companies to adopt suitable security measures and certifications, while also reducing unfair punishments for those that had appropriate mitigation tactics in place.
What Is the HIPAA Safe Harbor Bill?
The HIPAA Safe Harbor bill grants HHS new considerations when auditing covered entities and business associates in situations that may result in fines. The changes incentivize organizations to adopt security best practices, because they will not face heightened scrutiny from regulators or need to be burdened by additional proof of compliance measures.
More specifically, the legislation amends the HITECH Act to require HHS to take on new considerations when determining enforcement actions or other regulatory compliance activities. The HIPAA Safe Harbor bill’s changes mean that HHS will have to consider whether business associates or covered entities have met recognized security standards in these situations.
Under the new bill, HHS will have to take an organization’s cybersecurity into account when calculating fines that result from data breaches and other security incidents. If the organization is recognized to have followed ‘recognized security practices’ for more than the past 12 months, then fines may be mitigated.
The bill also allows HHS to reduce the extent and length of its audits once it has determined that a provider meets cybersecurity best practice requirements. A history of following these requirements may also mitigate the remedies needed after violations of the HIPAA Security Rule.
The HIPAA Safe Harbor bill’s changes mean that organizations with HITRUST CSF Certifications can meet their compliance obligations under HIPAA’s Security Rule. The HIPAA Safe Harbor bill’s recognition of companies with HITRUST CSF Certifications should also serve to encourage other entities to proactively demonstrate their compliance.
The bill also recognizes the security standards, guidelines and practices developed by NIST and other similar authorities. The HIPAA Safe Harbor legislation’s incentives for covered entities and business associates aim to improve overall protections for health data.
The HIPAA Safe Harbor Bill: LuxSci Is HITRUST CSF Certified
The core of LuxSci’s business relies on high levels of security and compliance, so we are proud to be HITRUST CSF Certified. Our systems and services have been independently verified to conform with the HITRUST CSF Assurance Program. This includes security controls for Massachusetts Privacy Law, the GDPR and HIPAA.
The certification covers all of our services at the time of the assessment, from our secure web forms to our email and web hosting. It covers our systems at the time as well, such as firewalls, load balancers, email servers, backup servers and more.
The comprehensive nature of the HITRUST CSF Certification program, along with LuxSci’s constant commitment to the best in security and compliance, ensure that our clients are always in trusted hands.
