A cheat sheet of everything your organization must know about HIPAA compliance can serve as a quick reference guide should you have questions or clarifications regarding HIPAA rules. It helps ensure that your organization follows the necessary protocols to safeguard protected health information (PHI) and avoid violations that could lead to serious penalties.
Here’s a quick cheat sheet to help you ensure compliance with HIPAA.
Table of Contents
What Is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) sets the national standards to protect the privacy and security of individuals’ health information. HIPAA addresses the proper handling of identifiable protected health information, patients’ rights to access their data, and the security of electronic healthcare transactions.
Who Is Covered by HIPAA?
Let’s start this HIPAA compliance cheat sheet with the basics. HIPAA covers various healthcare entities, both individuals and organizations:
1. Covered entities
Healthcare providers
This includes doctors, hospitals, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
Health plans
This includes health insurance companies, health maintenance organizations (HMOs), and company health plans. Government programs such as Medicare and Medicaid also fall under this category.
Healthcare clearinghouses
Entities that process nonstandard health information into standard electronic formats (e.g., billing services, community health management systems, repricing companies)
2. Business associates
These are individuals, organizations, or vendors that perform tasks or provide a service that involves PHI use and disclosure on behalf of a covered entity. They include legal services, Software as a Service (SaaS) providers, shredding services, and medical transcriptionists.
3. Subcontractors
Business associates engage subcontractors to assist them in carrying out their PHI-related tasks. For instance, a medical billing company (business associate) that handles claims processing for a covered entity may ask a third-party IT service provider (subcontractor) to manage their billing software securely. The subcontractor and business associate should have a subcontractor agreement outlining their responsibilities in protecting PHI.
4. Individuals
Under HIPAA, patients have the right to their health information and privacy. They have the right to access their medical records, request revisions to their records, and receive a privacy notice from healthcare professionals.
HIPAA Rules Simplified
Here’s a simplified explanation of the four HIPAA rules.
HIPAA Privacy Rule
The HIPAA Privacy Rule guides how healthcare providers handle patients’ protected health information (PHI), including their medical records. The Privacy Rule ensures that healthcare professionals obtain consent before sharing PHI and gives patients the right to examine and get a copy of their health data. It strikes a balance between protecting individuals’ privacy and allowing necessary information sharing for effective healthcare.
HIPAA Security Rule
The HIPAA Security Rule’s focus is on safeguarding electronic protected health information (ePHI). It outlines steps healthcare professionals should take to secure digital data. For instance, if a healthcare professional uses an internet fax service, the chosen software should include features like encryption, access controls, and audit logs.
The Security Rule categorizes the safeguards for protecting ePHI into the following:
- Administrative safeguards: The policies and procedures to protect ePHI. They include developing and implementing privacy policies and training staff on HIPAA rules.
- Technical safeguards: Involves the use of technology to protect ePHI. They include encryption, multi-factor authentication (MFA), audit trails, automatic logoffs, etc.
- Physical safeguards: Physical measures to protect electronic systems, buildings, and equipment from natural and environmental hazards and unauthorized access. They include biometric systems, ID cards, and workstation security.
Breach Notification Rule
A breach is an unauthorized use or disclosure of health data that goes against the Privacy Rule and compromises the security or privacy of PHI. If a security breach exposes patients’ PHI, the Breach Notification Rule kicks in. HIPAA requires covered entities, business associates, and subcontractors to promptly notify affected individuals, the Department of Health and Human Services (HHS), and–in cases where the breach affects over 500 residents in a State or jurisdiction–the media.
Enforcement Rule
The HIPAA Enforcement Rule imposes the consequences for violating HIPAA rules. It empowers the Office of Civil Rights (OCR) under the HSS to enforce compliance. Penalties include fines, legal measures, and corrective actions. The penalty depends on various factors:
- Nature and extent of the breach
- Extent of harm to individuals
- The violator’s knowledge and intent
- Timely reporting of the breach
- Entity’s compliance history
- Efforts to correct the violation
Omnibus Rule
The HIPAA Omnibus Rule updated HIPAA to keep pace with changes in technology and healthcare practices. It implements relevant provisions in the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination (GINA) Act.
Changes in the Ombinus Rule include:
- Holding business associates and subcontractors directly liable for HIPAA compliance
- Increasing penalties for non-compliance
- Introducing a tiered penalty system based on the level of negligence
- Requiring healthcare providers to report data breaches unless they can demonstrate a low probability that PHI was compromised
- Explicitly adding genetic information to the definition of PHI
- Establishing stricter rules for the use of PHI in marketing and fundraising activities
- Introducing new patient rights to restrict certain PHI disclosures
Use This HIPAA Cheat Sheet for Compliance
This cheat sheet gives healthcare professionals a concise overview of HIPAA compliance requirements and guidelines. After all, following HIPAA requires studying and consistently keeping up with the latest provisions.
Healthcare providers should know the basics of HIPAA and ensure that their business associates and subcontractors do the same.
