September 14, 2020

What is HIPAA compliance?

If you’ve interacted with any health-related service in the last 20-plus years, you’ve heard of HIPAA and the need to be HIPAA compliant. For companies working in or with the healthcare industry, HIPAA compliance is the cornerstone of a strong security posture.

‍

Are you in tune with what it takes to gain and maintain HIPAA compliance? Why is HIPAA compliance so important, and who needs to be HIPAA compliant? And what happens if an organization isn’t HIPAA compliant? Read on for answers to all these questions about HIPAA compliance and becoming compliant.

‍

Let’s start from the top: When did HIPAA compliance start?

‍

‍HIPAA stands for the Healthcare Insurance Portability and Accountability Act, which was signed into law on August 21, 1996. HIPAA’s high-level goal is to keep patients’ protected health information (PHI) — any individually identifiable health information — safe and secure, whether it exists in a physical or electronic form.

‍

HIPAA was passed to improve the portability and accountability of health insurance coverage for employees moving between jobs. An additional goal of HIPAA include providing coverage for employees with pre-existing medical conditions and simplifying the administration of health insurance.

‍

If your company works in the healthcare industry or is considering working with healthcare clients, it is important to have an understanding of HIPAA. It's also crucial you understand how to become HIPAA compliant and how to stay up to date on compliance.

‍

HIPAA applies to organizations known as covered entities and business associates. Covered entities HIPAA applies to include health care providers like:

‍

Doctors
Clinics
Psychologists
Health plans
Health insurance companies
Government healthcare programs
Health care clearinghouses

‍

Business associates are people or entities performing activities that involve the use or disclosure of protected health information on behalf of or in service to a covered entity. Business associates could include third party administrators assisting a health plan with claims processing, SaaS healthcare solutions such as telemedicine technologies and mobile health apps, and more.

‍

Why is HIPAA compliance so important?

‍

Before HIPAA was instituted, there was not a common set of accepted security standards or requirements for the protection of health information in the healthcare industry. HIPAA put in place requirements to ensure that healthcare organizations are actively safeguarding patient data — and also instituted repercussions for those organizations that fail to be HIPAA compliant.

‍

Technologies have evolved — and continue to evolve — in the years since HIPAA took effect and HIPAA compliance was put in place. Over time, the healthcare industry as a whole has been moving away from keeping and collecting data and information on paper, moving instead toward using electronic information systems to conduct a wide range of industry functions. These functions include both in the clinical delivery of care and in its administration.

‍

With more and more protected health information flowing through the many computerized systems and processes of covered entities and their business associates — from electronic health records and pharmacy and laboratory information, to computerized physician order entry (CPOE), by which healthcare providers use computers to directly enter medical orders — HIPAA compliance and the diligent protection of patient PHI only continues to increase in importance. New technology is always coming into play to manage and secure data in the healthcare industry; companies must be able to integrate and work with new technologies while maintaining the safety and security of patient PHI.

‍

In order to ensure that your company is in compliance with HIPAA, your organization should build and implement a holistic data protection strategy that encompasses all areas of HIPAA compliance while ensuring the security and availability of PHI, and maintaining the trust of patients and those people and organizations with whom you do business.

‍

So, What is HIPAA compliance?

‍

There are a number of HIPAA rules that must be adhered to in order to ensure HIPAA compliance. The HIPAA Security Rule, instituted in 2005, is key among these rules. HIPAA Security Rules specify safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

‍

The Security Rule articulates three types of security safeguards:

Administrative
Physical
Technical

‍

Security safeguards are required for a company to be in HIPAA compliance.

Administrative safeguards include a company’s performance of risk analysis as a part of their security management processes.

‍

Examples include:

Evaluating the likelihood and impact of potential risks to ePHI
Implementing security measures to address identified risks
Documenting security measures to be taken
Maintaining continuous and appropriate security protections

‍

Administrative safeguards also include:

Designation of an official representative or team responsible for HIPAA security policies and procedures
Implementing role-based access to ePHI
Providing employee training
Regularly evaluating how a company’s policies and procedures are meeting the Security Rule

‍

Physical safeguards include limiting and managing physical access to facilities while enabling authorized access, and implementing policies and procedures for access to and use of workstations and electronic media. Physical safeguards to become HIPAA compliant also include regarding transfer, removal, disposal, and reuse of electronic media, in order to protect ePHI.

‍

Technical safeguards include the implementation of ePHI access control policies, audit control mechanisms for the recording and examination of access and activity in systems interacting with ePHI.

‍

To be HIPPA compliant, you'll also need integrity controls to ensure and confirm that ePHI is not improperly altered or destroyed, and transmission security measures protecting against unauthorized ePHI access while ePHI is in transmission over a network.

‍

In addition to implementing these safeguards for the protection of sensitive patient information, organizations working or interacting with patient PHI must now complete annual self-audits assessing their privacy and security practices to ensure that they are in line with current HIPAA standards, and should vet the vendors with whom they work.

‍

Who needs to maintain compliance with HIPAA? And what happens if an organization is not in compliance with HIPAA?

‍

The U.S. government passed the HITECH (Health Information Technology for Economic and Clinical Health) Act in 2009 to further encourage use of electronic health records. The HITECH Act also increased penalties for organizations in violation of HIPAA, and introduced the Breach Notification Rule.

‍

The Breach Notification Rule requires that breaches of unsecured protected health information must be communicated to affected individuals, the U.S. Department of Health and Human Services (HHS). In some cases breaches may even need to be reported to the media.

‍

As of 2020, HIPAA requires that breaches affecting fewer than 500 people, known as Minor Breaches, must be reported by the end of the calendar year to HHS and the affected individuals. Breaches affecting more than 500 people, known as Meaningful Breaches, must be reported within 60 days to HHS, the affected individuals, and the media. Meaningful Breaches reported to HHS are added to its Breach Notification Portal, a permanent archive and searchable database of HIPAA violations going back to 2009.

‍

A data breach is not automatically a HIPAA violation HIPAA violation is defined as a failure to comply with HIPAA standards and provisions. If an organization’s compliance program compromises the security and integrity of PHI or ePHI, then the organization is in violation of HIPAA.

‍

Thus a data breach resulting from an incomplete or ineffective HIPAA compliance program becomes a HIPAA violation. Organizations in violation of HIPAA risk compromising sensitive patient information — and facing financial and other penalties as a result.

‍

Violations and data breaches can be extremely costly, from steep monetary fines to the costs of communicating breach notifications and mitigating subsequent damages, to the possibility of criminal prosecution.

‍

How can my organization sustain our HIPAA compliance?

‍

One of the top challenges in HIPAA compliance is finding a way to continuously stay compliant despite changes to your systems and staff. To prevent costly compliance gaps, follow these top tips.

‍

Maintain Thorough Activity Logs - Have protocols and processes in place to make sure your IT staff has a detailed log of anything pertaining to PHI and where it goes. Along with this, find a way to monitor those logs and keep an eye out for security risks among this activity.
Lock Down Log-Ins - Maintain strict rules and requirements for passwords organization-wide and enforce these policies for every employee or contractor.
Layer Your Security - The best security takes a multi-layered approach to keep breaches at bay and make it easier to detect threats before they become problems. Layer security strategies like log-ins, multi-factor authentication, encryption, and more.

‍

Other recent HIPAA compliance updates to be aware of:

‍

New laws and amendments to laws can happen at any time and it’s up to your organization to keep track and make sure you’re following the current HIPAA and privacy laws. Just in the past few years, there have been multiple changes and new laws, such as:

‍

2020 CARES Act
2021 HIPAA Safe Harbor Law
21st Century Cures Act
HIPAA Civil Monetary Penalty Overturned

‍

Recent HIPAA updates under consideration have included potential changes to HIPAA compliance and related regulations with the goal of protecting the privacy of patients seeking treatment for substance abuse disorders. In the context of the opioid epidemic, there have been calls to make changes that would enable clinicians to view full medical records, including records related to substance abuse disorders.

‍

Access to these medical records would allow for treatment decisions to be informed by a patient’s full health history. With the passage of the Coronavirus Aid, Relief, and Economic Security (CARES) Act in 2020, healthcare providers’ ability to share records of individuals with substance abuse disorders has been expanded. At the same time, the CARES Act has tightened requirements around confidentiality breaches.

‍

Vanta is here to help your company build a holistic security compliance program that will support your ongoing HIPAA compliance. Vanta provides a set of security and compliance tools that scan, verify, and secure a company’s IT systems and processes.

‍

Vanta also offers a suite of tools streamlining the non-technical components of security tracking and audit preparation, so that gathering, maintaining, and consolidating audit evidence is easier for both your company and your auditor. Vanta is “security in a box” for technology companies, trusted by hundreds for automated security and compliance.

‍

Pre-work for your SOC 2 compliance

Choose the right type of SOC 2 report:

Do you sell goods or services to EU businesses, consumers, or both?

Determine the framework for your SOC 2 report. Of the five Trust Service Criteria in SOC 2, every organization needs to comply with the first criteria (security), but you only need to assess and document the other criteria that apply. Determining your framework involves deciding which Trust Service Criteria and controls are applicable to your business using our Trust Service Criteria Guide.

Estimate the resources you expect to need. This will vary depending on how closely you already align with SOC 2 security controls, but it can include several costs such as:

Compliance software

Engineers and potentially consultants

Security tools, such as access control systems

Administrative resources to draft security policies

Auditing for your compliance certification

Choose the right type of SOC 2 report:

Do you sell goods or services to EU businesses, consumers, or both?

Work toward SOC 2 compliance

Begin with an initial assessment of your system using compliance automation software to determine which necessary controls and practices you have already implemented and which you still need to put in place.

Review your Vanta report to determine any controls and protocols within the “Security” Trust Service Criteria that you do not yet meet and implement these one by one. These are multi-tiered controls across several categories of security, including:

CC1: Control Environment

CC2: Communication and Information

CC3: Risk Assessment

CC4: Monitoring Activities

CC5: Control Activities

CC6: Logical and Physical Access Controls

CC7: System Operations

CC8: Change Management

CC9: Risk Mitigation

Using Vanta’s initial assessment report as a to-do list, address each of the applicable controls in the other Trust Services Criteria that you identified in your initial framework, but that you have not yet implemented.

Using Vanta’s initial assessment report, draft security policies and protocols that adhere to the standards outlined in SOC 2.  

Vanta’s tool includes thorough and user-friendly templates to make this simpler and save time for your team.

Run Vanta’s automated compliance software again to determine if you have met all the necessary criteria and controls for your SOC 2 report and to document your compliance with these controls.

Complete a SOC 2 report audit

Select and hire an auditor affiliated with the American Institute of Certified Public Accountants (AICPA), the organization that developed and supports SOC 2.

Complete a readiness assessment with this auditor to determine if you have met the minimum standards to undergo a full audit.

If your readiness assessment indicates that there are SOC 2 controls you need to address before your audit, complete these requirements. However, if you have automated compliance software to guide your preparations and your SOC 2 compliance, this is unlikely.

Undergo a full audit with your SOC 2 report auditor. This may involve weeks or longer of working with your auditor to provide the documentation they need. Vanta simplifies your audit, however, by compiling your compliance evidence and documentation into one platform your auditor can access directly.

When you pass your audit, the auditor will present you with your SOC 2 report to document and verify your compliance.

Maintain your SOC 2 compliance annually

Establish a system or protocol to regularly monitor your SOC 2 compliance and identify any breaches of your compliance, as this can happen with system updates and changes.

Promptly address any gaps in your compliance that arise, rather than waiting until your next audit.

Undergo a SOC 2 re-certification audit each year with your chosen SOC 2 auditor to renew your certification.

Download this checklist for easy reference

Download now

Prioritizing Your Security and Opening Doors with SOC 2 Compliance

Information security is a vital priority for any business today from an ethical standpoint and from a business standpoint. Not only could a data breach jeopardize your revenue but many of your future clients and partners may require a SOC 2 report before they consider your organization. Achieving and maintaining your SOC 2 compliance can open countless doors, and you can simplify the process with the help of the checklist above and Vanta s compliance automation software. Request a demo today to learn more about how we can help you protect and grow your organization.

‍

Request a demo

Develop a roadmap for successful implementation of an ISMS and ISO 27001 certification

Implement Plan, Do, Check, Act (PDCA) process to recognize challenges and identify gaps for remediation

Consider ISO 27001 certification costs relative to org size and number of employees

Clearly define scope of work to plan certification time to completion

Select an ISO 27001 auditor

Set the scope of your organization’s ISMS

Decide which business areas are covered by the ISMS and which are out of scope

Consider additional security controls for business processes that are required to pass ISMS-protected information across the trust boundary

Inform stakeholders regarding scope of the ISMS

Establish an ISMS governing body

Build a governance team with management oversight

Incorporate key members of top management, e.g. senior leadership and executive management with responsibility for strategy and resource allocation

Conduct an inventory of information assets

Consider all assets where information is stored, processed, and accessible

‍

Record information assets: data and people
Record physical assets: laptops, servers, and physical building locations
Record intangible assets: intellectual property, brand, and reputation

Assign to each asset a classification and owner responsible for ensuring the asset is appropriately inventoried, classified, protected, and handled

Execute a risk assessment

Establish and document a risk-management framework to ensure consistency

Identify scenarios in which information, systems, or services could be compromised

Determine likelihood or frequency with which these scenarios could occur

Evaluate potential impact of each scenario on confidentiality, integrity, or availability of information, systems, and services

Rank risk scenarios based on overall risk to the organization’s objectives

Develop a risk register

Record and manage your organization’s risks

Summarize each identified risk

Indicate the impact and likelihood of each risk

Document a risk treatment plan

Design a response for each risk (Risk Treatment)

Assign an accountable owner to each identified risk

Assign risk mitigation activity owners

Establish target dates for completion of risk treatment activities

Complete the Statement of Applicability worksheet

Review 114 controls of Annex A of ISO 27001 standard

Select controls to address identified risks

Complete the Statement of Applicability listing all Annex A controls, justifying inclusion or exclusion of each control in the ISMS implementation

Continuously assess and manage risk

Build a framework for establishing, implementing, maintaining, and continually improving the ISMS

Include information or references to supporting documentation regarding:

‍

Information Security Objectives
Leadership and Commitment
Roles, Responsibilities, and Authorities
Approach to Assessing and Treating Risk
Control of Documented Information
Communication
Internal Audit
Management Review
Corrective Action and Continual Improvement
Policy Violations

Assemble required documents and records

Review ISO 27001 Required Documents and Records list

Customize policy templates with organization-specific policies, process, and language

Establish employee training and awareness programs

Conduct regular trainings to ensure awareness of new policies and procedures

Define expectations for personnel regarding their role in ISMS maintenance

Train personnel on common threats facing your organization and how to respond

Establish disciplinary or sanctions policies or processes for personnel found out of compliance with information security requirements

Perform an internal audit

Allocate internal resources with necessary competencies who are independent of ISMS development and maintenance, or engage an independent third party

Verify conformance with requirements from Annex A deemed applicable in your ISMS's Statement of Applicability

Share internal audit results, including nonconformities, with the ISMS governing body and senior management

Address identified issues before proceeding with the external audit

Undergo external audit of ISMS to obtain ISO 27001 certification

Engage an independent ISO 27001 auditor

Conduct Stage 1 Audit consisting of an extensive documentation review; obtain feedback regarding readiness to move to Stage 2 Audit

Conduct Stage 2 Audit consisting of tests performed on the ISMS to ensure proper design, implementation, and ongoing functionality; evaluate fairness, suitability, and effective implementation and operation of controls

Address any nonconformities

Ensure that all requirements of the ISO 27001 standard are being addressed

Ensure org is following processes that it has specified and documented

Ensure org is upholding contractual requirements with third parties

Address specific nonconformities identified by the ISO 27001 auditor

Receive auditor’s formal validation following resolution of nonconformities

Conduct regular management reviews

Plan reviews at least once per year; consider a quarterly review cycle

Ensure the ISMS and its objectives continue to remain appropriate and effective

Ensure that senior management remains informed

Ensure adjustments to address risks or deficiencies can be promptly implemented

Calendar ISO 27001 audit schedule and surveillance audit schedules

Perform a full ISO 27001 audit once every three years

Prepare to perform surveillance audits in the second and third years of the Certification Cycle

Consider streamlining ISO 27001 certification with automation

Explore tools for automating security and compliance

Transform manual data collection and observation processes into automated and continuous system monitoring

Identify and close any gaps in ISMS implementation in a timely manner

Learn more about achieving ISO 27001 certification with Vanta

Book an ISO 27001 demo with Vanta

Download this checklist for easy reference

Download Now

Determine which annual audits and assessments are required for your company

Perform a readiness assessment and evaluate your security against HIPAA requirements

Review the U.S. Dept of Health and Human Services Office for Civil Rights Audit Protocol

Conduct required HIPAA compliance audits and assessments

Perform and document ongoing technical and non-technical evaluations, internally or in partnership with a third-party security and compliance team like Vanta

Document your plans and put them into action

Document every step of building, implementing, and assessing your compliance program

Vanta’s automated compliance reporting can streamline planning and documentation

Appoint a security and compliance point person in your company

Designate an employee as your HIPAA Compliance Officer

Schedule annual HIPAA training for all employees

Distribute HIPAA policies and procedures and ensure staff read and attest to their review

Document employee trainings and other compliance activities

Thoroughly document employee training processes, activities, and attestations

Establish and communicate clear breach report processes
to all employees

Ensure that staff understand what constitutes a HIPAA breach, and how to report a breach

Implement systems to track security incidents, and to document and report all breaches

Institute an annual review process

Annually assess compliance activities against theHIPAA Rules and updates to HIPAA

Continuously assess and manage risk

Build a year-round risk management program and integrate continuous monitoring

Understand the ins and outs of HIPAA compliance— and the costs of noncompliance

Download this checklist for easy reference

Download Now

Written by

Access Review Stage	Content / Functionality
Across all stages	Easily create and save a new access review at a point in time View detailed audit evidence of historical access reviews
Setup access review procedures	Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems	Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta. Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS) Upload access files from non-integrated systems View and select systems in-scope for the review
Review, approve, and deny user access	Select the appropriate systems reviewer and due date Get automatic notifications and reminders to systems reviewer of deadlines Automatic flagging of “risky” employee accounts that have been terminated or switched departments Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section Track progress of individual systems access reviews and see accounts that need to be removed or have access modified Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners	Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access	Focused view of accounts flagged for access changes for easy tracking and management Automated evidence of remediation completion displayed for integrated systems Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results	Auditor can log into Vanta to see history of all completed access reviews Internals can see status of reviews in progress and also historical review detail