Ken Lynch, Founder & CEO, Reciprocity

home

authors

ken-lynch-founder-and-ceo-reciprocity

HIPAA compliance is the responsibility of all healthcare stakeholders.

Soon after figuring out how to go about the definition of “business entity,” Congress introduced the Omnibus rule. Thanks to the establishment of the 

 or HITRUST, the HITRUST framework assists vendor management and Health Insurance Portability and Accountability Act (HIPAA) compliance, which had unexpectedly become ‘a thing.’ The management of patient health information can be compared to the gathering of evidence from a given crime scene.

LISTEN: Amazon Alexa and the Potential of Voice Assistants for Healthcare

If you can recall the O.J. Simpson trial, then you probably know about the bloody fingerprint. The blood sample of Simpson disappeared during police investigations. However, only 6 millileters of the 8 milliliters of blood were accounted for, arousing suspicions of planted evidence. Although HIPAA may not be as exhilarating as a car chase, tracking a chain of evidence or chain of trust matters a lot.

Protected health information (PHI) comprises different types of information that is accessible to health providers. When trying to understand the different ways that the HITRUST Framework assists vendor management and HIPAA, you need first to learn the various terms that fall under this particular umbrella.

“Health information” includes information received or created by a healthcare provider, healthcare clearinghouse, health plan, public health authority, school or university and employer life insurer. The information can be linked to the past, current or future mental and physical health of a person.

Individually Identifiable Health Information

“Individually identifiable health information” encompasses all the demographic information, which can be traced back to patients. In short, this covers the information that can be used to spot a person or clearly identify them.

PHI entails all individually identifiable health details or information, which can be maintained in electronic media, conveyed through electronic media, or maintained or conveyed in any other media. The protected health information excludes all the education records safeguarded by the Family Educational Rights and Privacy Act, employment records maintained by a covered entity in its duty as an employer, and the records featured in 20 U.S.C.1232g(a)(4)(B)(iv).

According to HIPAA, a business associate entails any entity or person, excluding a covered entity’s workforce member, who provides services to or carries out activities and functions on behalf of a covered entity with access to PHI. A business associate could even be a cleaning service that works around files or a cloud storage vendor.

READ: Keeping HIPAA Compliance Efforts Up to Date

How Is Health Information Exchange Related to This?

 makes up one of the common IT terminologies with different meanings. In essence, it refers to the sending and receiving of digital information that occurs between various providers. In other areas, the term translates to the broader idea of general information movement that takes place between stakeholders. In terms of how HITRUST Framework aids vendor management and HIPAA, health information exchange can also refer to the entity that facilitates information movement.

Health information exchange can refer to all the vendors that handle your patient data. As such, vetting such vendors is crucial due to the safety concerns associated with that information.

What Does a Chain of Trust Partner Agreement Mean?

Although HIPAA and vendor management are akin to other types of vendor monitoring, they are more invasive, especially if you are the vendor. Under HIPAA, working with vendors calls for the need to trust them with not only your information but also your client’s information. While this may not require you to complete an SSAE 18 review and be SOC compliant, you have to know how your vendors oversee their information security measures and interact with information.

 as a written trust fall task. “Trust falls “used to exist in corporate training. A chain of trust agreement acts as the adult, contractual form of this case. The business entity positioned at the top of the chain engages in a contract with its vendor.

The particular relationship is covered by the agreement between the business entity and the vendor. Nonetheless, that particular vendor may require having some vendor for itself. As such, this means that in spite of having some degree of isolation from the initial business entity, the vendors are also associated with the business entity through their functions with other vendors.

How the HITRUST Framework Assists HIPAA and Vendor Management

In case your business falls anywhere in the scope of a business entity, you need to figure out how to 

Most HIPAA compliance conditions feature in other frameworks, particularly those involved in governing information systems. However, if you are planning to implement HIPAA or you have already done so, you may want to focus on the possible gaps.

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. He has propelled Reciprocity's success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens.

Get the best insights in healthcare analytics 

Make Sure You’re HIPAA Compliant Before You Have to Prove It

EHRs Can Be Dangerous. Are New Guidelines Necessary?

Overcoming the Cultural Resistance to Health Tech

Articles

How healthcare stakeholders can navigate the HITRUST framework.

Helping HIPAA Compliance and Vendor Management

Back in 1996, the U.S. Congress enacted the 

Health Insurance Portability and Accountability Act

 (HIPAA) to help protect individuals’ sensitive health information when they move from one employer to another. Then, in 2003, the Department of Health and Human Services (HHS) created the Privacy Rule to expand this coverage to any organization that maintains or has access to protected health information (PHI). This includes any information about health status, payment for healthcare and any medical services rendered, to name a few. In 2005, the Privacy Rule was extended to electronic PHI, or ePHI, as well.

What this means for businesses is that even software-as-a-service providers and human resources platforms must be in compliance with HIPAA regulations if their products are used to manage PHI. Here’s what you need to know about 

 and how to manage it. Healthcare decision makers, meanwhile, must also ensure that their business associates are in compliance.

>> READ: What Does HIPAA Mean for New Health Tech?

The latest regulations break down HIPAA compliance into three primary categories:

This area refers to the specific policies and procedures your company or healthcare organization has put in place to monitor and verify compliance. The details of the policy should be tailored to the unique activities and data capabilities of your business.

This category denotes the measures you have instituted to control which employees have access to your physical data storage areas. It is a good idea to restrict this access to only those who truly have need for it and to update access immediately following any personnel changes.

If you transmit any PHI electronically, you’ll need to encrypt and protect that data in transit, bringing your IT department into your compliance efforts. Electronic communications are among the most common access points for hackers, so technical safeguards are critical for your organization.

Your organization must maintain compliance across all three areas in order to be deemed fully compliant. Failure to comply with the HIPAA regulations can result in severe penalties, including fines, civil litigation and even jail time. The 

, a branch of HHS, oversees the implementation of the regulations and works to strengthen them over time.

Maximize Your Efforts with Continuous Monitoring

As hackers and other thieves continue to grow more sophisticated, it is no longer enough to simply measure your HIPAA compliance at a particular point in time; you need to engage in continuous monitoring to protect your customers successfully. You’ll need to evaluate the specific risks that could impact your organization so that you can implement the proper safeguards.

This includes monitoring those risks on an ongoing basis to detect any security incidents so that you can address them as quickly as possible. Hackers are devising new tactics and threats with each passing day, so proper compliance requires constant vigilance.

Monitoring your security efforts continuously is only half the battle, though. To maintain continuous compliance, you’ll also need to take action based on the information you uncover. This can include tasks like updating software to the latest versions, adding or revoking employee access as needed and changing passwords regularly. The more proactive you are in addressing any potential compliance issues, the easier it will be to maintain continuous compliance.

Automated Software Can Assist with HIPAA Compliance Management

You’ll have plenty of options available to you in terms of technology to help manage your HIPAA compliance. These automated software applications can monitor your system continuously, auditing it for any anomalies or potential breaches. This way, you’ll receive an alert immediately if anything looks suspicious, enabling you to take action right away to ensure your ongoing compliance and the protection of your customers.

Another way that automated compliance software can help is by documenting any incidents that occur, along with how your company addressed them. This will come in handy in the event that your organization is ever audited to ensure compliance. You’ll have detailed records of your company’s ongoing efforts to secure your customers’ PHI and ePHI.

HIPAA regulations aren’t likely to go away or become more lenient any time in the near future. In fact, the opposite is likely to be true. Getting your HIPAA compliance in order now will help you be as prepared as possible to implement even stronger measures in the future as needed. Your compliance software can grow and scale along with your business to ensure you stay compliant as consistently as possible.

Amazon’s Alexa Really Isn’t Ready for Healthcare

HIPAA compliance requires great effort, but tech can help.
 