CourseLover
$10/per page/Negotiable
http://searchcompliance.techtarget.com/feature/FAQ-What-is-the-impact-of-HIPAA-on-IT-operations
http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/
Â
Article review 2 pages
HIPAA is the Health Insurance Portability and Accountability Act of 1996. There are two sections in HIPAA:
The first, Title I, provides protections for the health insurance coverage of people who lose or change jobs. HIPAA made changes to three areas in the continuation coverage rules applicable to group health plans under the Consolidated Omnibus Budget Reconciliation Act of 1985 -- or COBRA -- each of which are described more extensively by the US Department of Labor at DOL.gov.
Title II is where organizations feel the impact of HIPAA on IT operations. It includes a section that deals with the standardization of healthcare-related information systems for electronic data interchange . These mandatory regulations all required extensive changes to the way that health providers conduct business.
Compliance with HIPAA is administered by the U.S. Department of Health and Human Services (HHS), which publishes requirements and sets deadlines for organizations to comply. HHS provides up-to-date information about HIPAA at HHS.gov.
Compliance with HIPAA requires organizations to implement safeguards and security standards when electronically storing and transmitting personal health information. HIPAA mandates standardized formats for all patient health, administrative and financial data. HIPAA also requires a unique identifier (essentially an ID number) for each healthcare entity, including individuals, employers, health plans and healthcare providers.
As the legislation was drafted, two additional rules were added to protect the privacy and safety of individuals' personal health information (PHI). These are called the Privacy Rule and the Security Rule. The Privacy Rule is the first comprehensive federal protection for the privacy of PHI, according to the National Institutes of Health (NIH). More information on the Privacy Rule can be found at PrivacyRuleandResearch.NIH.gov. The Centers for Disease Control and Prevention also offers guidance on the Privacy Rule and public health.
Get caught up on regulations and more with our IT compliance FAQs.
The Security Rule describes best practices organizations must adopt to protect the confidentiality, integrity and availability of electronic protected health information (ePHI). The Security Rule contains three types of standards: administrative, physical and technical. These standards are wide-ranging and require the involvement of a broad mix of people, processes and technology for full compliance.
HIPAA specifically requires that public companies or those that handle personal health information monitor or retain audit trails. To meet this requirement, event log management software (ELMS) is used to monitor change management and prepare for compliance audits at enterprises. ELMS is a key tool for IT administrators who must demonstrate to executives that an organization is prepared for a compliance audit.
Although wireless devices are not detailed in HIPAA's security rule, they must be viewed in the entire system for electronically storing and transmitting data.
Many IT departments find value in a third-party assessment of HIPAA compliance. The URAC (formerly the Utilization Review Accreditation Commission), the largest accrediting body for healthcare, will certify that a healthcare organization's operations are in compliance with HIPAA standards. The URAC provides an IT department with documentation and evidence of due diligence that support an organization's overall risk management efforts. As Robert N. Mitchell wrote for AdvanceWeb.com, the URAC has reported progress on HIPAA programs.
MORE INFO:
No good way to measure HIPAA compliance
It's been years since HIPAA took effect. But for many IT pros in the healthcare sector, measuring actual compliance is still tricky.
What's the best strategy to catch up on HIPAA compliance quickly?
Learn how to build a good compliance program for HIPAA in order to protect patient information and avoid fines and penalties.
HIPAA privacy records and guidelines: Building secure systems
Learn how to achieve compliance with HIPAA certification and how to avoid and fix risks with password security, privacy regulations, records and guidelines.
Reading between the HIPAA guidelines
HIPAA legislation explains what needs to be done to achieve compliance, but it fails to spell out how. Learn how to stay HIPAA compliant when sending work overseas.
Maintaining HIPAA compliance
It's been several years since covered entities were first required to comply with HIPAA. Learn how you can ensure your customers' ongoing compliance in this Ask the Expert Q&A.
The Security Rule applies to healthcare organizations that create, receive, maintain or transmit ePHI, including:
As a result of the financial and legal penalties that noncompliance imposes, corporate executives have pushed financial and IT departments toward compliance validation. In the years since HIPAA's introduction, healthcare organizations have developed a clearer picture of what practices will best protect themselves and patient information.
MORE INFO:
Lake Forest Hospital's Rx for HIPAA compliance
Learn how merging networks helped one medical facility with HIPAA compliance requirements.
March to HIPAA: Bitter pill or best prescription?
SearchSecurity.com interviewed IT, security and compliance professionals across the United States over a two-month period to learn more about their progress.
HIPAA Compliance Guide
Value-added resellers and security consultants can help healthcare practitioners comply with HIPAA by educating small and medium-sized businesses (SMBs) during product sales and by implementing risk analysis.
HIPAA causes data security problems for small businesses
If your local dentist isn't complying with HIPAA's security rules, he's not alone. Experts say most doctors' offices aren't getting it.
One way to avoid HIPAA headaches
Research showed many SMBs avoided HIPAA compliance "like the plague" in the years immediately after the act's passage. One community health care provider says he found a cure.
Compliance is now a deeply embedded aspect of corporate IT culture. Why? HIPAA requires that the privacy of health records be protected, wherever they reside or whenever they are moved. That means the impact of HIPAA can be felt by nearly every aspect of IT operations, including messaging, storage, virtualization and even networking, so long as electronic PHI (ePHI) records are stored within or transferred over them. In turn, IT must be able to produce evidence of the security of these systems for compliance audits.
Healthcare organizations must be able to demonstrate that they have standardized mechanisms for the security and confidentiality of all healthcare-related data. From an IT perspective, there are several general guidelines that entities must follow:
Many enterprise IT shops use Control Objectives for Information and related Technology (COBIT) as a reference framework for this work. COBIT is an open standard that defines requirements for the control and security of sensitive data. According to WhatIs.com's definition for COBIT, the standard "consists of an executive summary, management guidelines, framework, control objectives, implementation tool set and audit guidelines. Extensive support is provided, including a list of critical success factors for measuring security program effectiveness and benchmarks for auditing purposes."
The IT departments of all companies that handle PHI must be aware of the key requirements of HIPAA, including log management, backups and the security of electronic communications. IT departments also approach HIPAA compliance through PHI flow analysis, training, policy and procedure refinement, risk analysis and self-assessment.
The impact of HIPAA can also be felt on Web 2.0 technologies like blogs, wikis and social networking. Such platforms are introducing all-new compliance headaches, as gigabytes of data are generated through messaging and sharing. If it pertains to private health records, enterprise IT professionals must prepare for the inevitable visit by a HIPAA compliance auditor looking for log files and security holes. Increasingly, compliance officers are using event log management software to track key moments where data enters or exits an enterprise, like email systems or the addition or departure of employees with access to sensitive financial data.
MORE INFO:
Perfect HIPAA security impossible, experts say
Two years after HIPAA security rules took effect, IT pros in the healthcare sector found that constant security improvements are necessary for compliance.
HIPAA security and Lotus Notes Domino
Learn how HIPAA changes will affect Lotus Notes Domino security.
The consequences for noncompliance with HIPAA regulations can be substantial. The severity of the penalty varies with the infraction; both civil and criminal charges may be levied by the Office for Civil Rights (OCR). The criminal penalties for violating the HIPAA privacy standards can be found in 42 USC 1320d-6 (HIPAA Sec. 1177).
It states that:
    A person who knowingly and in violation of this part:
- uses or causes to be used a unique health identifier;
- obtains individually identifiable health information relating to an individual; or
- discloses individually identifiable health information to another person,
Shall be punished as provided below:
- be fined not more than $50,000, imprisoned not more than 1 year, or both;
- if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
- if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.
When it comes to IT operations, compliance with HIPAA has historically been accomplished as part of more generalized security preparations. Healthcare entities generally received attention only when an individual or organization made a complaint. As Kate Norton wrote for SearchSecurity.com in 2007:
Enforcement of the HIPAA Administrative Simplification rules is complaint-driven only -- and at least for the foreseeable future. Privacy rule complaints go to the U.S. Department's Health and Human Services' (HHS) Office for Civil Rights. The OCR handles civil penalties and refers potential criminal complaints to the Department of Justice. All other rules under Administrative Simplification, including the security rule, will be enforced by HHS' Centers for Medicare and Medicaid Services (CMS) Office of HIPAA Standards. This is true of all "covered entities" large and small. There is no government agency or other body that officially audits proactively for HIPAA compliance.
In 2009, however, HIPAA privacy regulations have teeth. As Randy Nash points out in a recent tip for SearchSecurity.com, the HHS has levied the first penalties against a healthcare agency.