HIPAA Policies & Procedures

What Are HIPAA Policies & Procedures?

HIPAA stands for the “Health Insurance Portability & Accountability Act.” It was passed in 1996 and designed to safeguard individuals from having their Protected Health Information (PHI) shared without their consent.

HIPAA policies and procedures consist of a set of standards that all centers and professionals must follow to ensure people’s private medical information is protected and safe.

HIPAA policies and procedures include:

• the proper use and disclosure of a person’s PHI;

• a Notice of Privacy that informs patients how their health information could potentially be used; and

• guidelines and standards that describe a person’s rights over their PHI.

By design, HIPAA targets various uses and instances. This measure ensures broad protection for individuals and can apply to many businesses and establishments.

Aside from healthcare professionals, HIPAA applies to healthcare providers, healthcare cleaning services, health plans, and other establishments and individuals who may have to handle a person’s PHI.

The Three HIPAA Rules

There are three key rules that entities have to comply with HIPAA. Failure to comply with these rules can lead to hefty fines, losses, and a loss of employment for employees. You can find the Privacy Rule, Security Rule, and Breach Notification Rule in HIPAA, which contain the standards that protect an individual’s PHI.

Let’s take a closer look at each of these rules.

Privacy

The Privacy Rule is the national standard to protect people’s medical records. Under the rule, entities need to abide by certain safeguards. These safeguards are designed to set the limits of when and how a person’s PHI can be shared without their consent.

The Privacy Rule establishes who should follow the HIPAA standards, defines protected health information, and explains how and when organizations can share or use PHI with others.

Another aspect of the Privacy Rule is the rights that patients have over their personal health information. This ensures that entities cannot disclose information that can be used to identify a person unless given consent.

While the Privacy Rule states that health plans, healthcare providers, and healthcare cleaning houses must follow HIPAA’s standards, business associates in charge of transactions for these entities also fall under these standards.

Security

The Security Rule explains how entities should protect a person’s PHI. The rule contains standards for storing data digitally, also known as ePHI. Any business or entity that uses ePHI, meaning they store patient data digitally, will have to follow the Security Rule.

On top of containing the safeguards in place to protect a person’s ePHI, it also states what specific information falls under the rule.

To protect patient ePHI, entities that fall under the safety rule are required to:

• Make sure the ePHI is confidential, available, and truthful

• Provide adequate protection of ePHI from security threats

• Train employees to comply with the security rule

• Follow certain policies and procedures to ensure compliance with the security rule

• Ensure ePHI isn’t shared without consent

Additionally, entities falling under the Security Rule also need to practice risk management and conduct risk assessments to ensure that the ePHI is as safe as possible. Risk reduction is a crucial part of the security rule and requires entities to:

• Find and identify the risks

• Craft a comprehensive risk management plan

• Install safeguards to protect against the risks

• Document the process

• Conduct regular risk assessments to ensure the safety of ePHI

Breach Notification

Accountability is another key aspect of HIPAA. The Breach Notification Rule is established to ensure that any breach is reported to the proper authorities and individuals. The rule describes a breach as any disclosure of PHI that isn’t allowed under the security rule. In the event of a breach, entities must report the breach within 60 days of discovery.

If a breach has indeed happened, the entity is required to notify the persons affected, health and human services, and the media if it’s necessary.

Organizations can choose not to send alerts. However, this is only allowed if there’s a low probability of a person compromising someone else’s PHI.

What are the Consequences of a HIPAA Violation?

Different HIPAA violations have specific penalties. These include sanctions on the individual that may come from the employer as well as fines and other consequences for the entity. Typically, the consequences of a HIPAA violation include financial penalties. On top of that, entities with violations are required to craft a corrective action plan that can elevate their procedures to comply with HIPAA standards.

Individual consequences can include termination, sanctions, and even criminal charges and fines. The Office of Civil Rights (OCR) has the right to impose financial penalties, corrective action plans, or both on entities that fall under HIPAA to encourage and ensure compliance.

How to Ensure HIPAA Compliance

Ignorance of HIPAA Policies & Procedures is no excuse in the event of a violation. For this reason, understanding the HIPAA policies and employing best practices to ensure compliance is crucial for all covered entities.

Below are a few tips to ensure that your organization remains HIPAA compliant.

Conduct Risk Assessments

Understanding the risks is key to figuring out how to prevent others from compromising PHI or disclosing it without proper consent. This is why regular risk assessment is crucial to ensure HIPAA compliance.

With a risk assessment, organizations can understand where they need to make changes and how they can implement those changes to protect PHI.

Create Checklists

Once the team has a full grasp of the risks, it’s important to build a checklist that includes everything they need to follow to comply with HIPAA policies. Keeping a HIPAA checklist gives employees a reference point for handling PHI and ensures that they don’t disclose or share PHI without proper authorization.

Incorporate Technology

Conducting risk assessments, creating checklists, and ensuring that everything is up to standard is a challenging task. This is why covered entities are encouraged to incorporate modern technology to ensure HIPAA compliance.

There are many tools and software available that can help you stay HIPAA compliant. An example of these tools is SafetyCulture (formerly iAuditor). SafetyCulture has tons of features that can improve HIPAA compliance within the organization.