The Health Insurance Portability and Accountability Act (HIPAA) is the gold standard for every healthcare provider. It is one of the most important – and well-known – regulations governing this industry across America, with fines of up to $1.5 million per year for disobedience.
Everyone knows the basics: under the HIPAA Privacy Rule, you must not identify patients without their consent, for example. But fewer organizations are aware that their IT is also subject to HIPAA. Under the Security Rule, first proposed in 1998, you must ensure data privacy not just in-person but online. HIPAA compliance requires strict standards that prevent unauthorized access, protecting your patients and staff.
1. Administrative Safeguards
Administrative safeguards are your first, tentative step towards compliance. Your security measures are only as strong as the staff implementing them, and one crack can leave you vulnerable. Your checklist for HIPAA compliance should always start with these items:
- Appoint a staff member to supervise and maintain HIPAA compliance.
- Conduct a risk assessment to identify vulnerabilities.
- Develop policies and procedures that control how sensitive data is handled.
- Schedule ongoing security awareness training that covers phishing scam detection, HIPAA compliance, proper data handling procedures, and how to report a breach.
- Implement role-based access controls (RBAC) that ensure staff can only access data they absolutely need.
- Have all partners and vendors sign a business associate agreement (BAA), committing to strong security practices.
2. Physical Safeguards
Even with the best defenses in place, a stolen laptop or unprotected server room is enough to jeopardize everything. Physical safeguards protect systems and equipment from this exact outcome. Covered entities and businesses must:
- Control access to facilities where ePHI (electronic protected health information) is stored.
- Set strict device and workstation security policies.
- Develop safe disposal procedures for outdated equipment.
- Backup all storage, using secure access protocols.
3. Technical Safeguards
This section of your HIPAA computer compliance checklist is where your IT team needs to pay attention – or where you may need to hire a managed service provider (MSP) who specializes in compliance, if you don’t have one. ePHI must be treated as carefully as gold, using strict technical safeguards. Include:
- Technical access controls, such as multi-factor authentication.
- 24/7 threat monitoring. Automated detection and response can be especially useful.
- Data encryption (preferably AES-256) at rest and in transit.
- Automated software updates, data backups, and logoff procedures
- Email filters, to reduce the risk of phishing scams reaching staff
4. Network Protection
Endpoint and account protection are important, but not enough on their own. Your network is one of your biggest vulnerabilities. Any threat actor who gains access to it can quickly compromise your entire organization.
Your HIPAA compliance network checklist should address:
- Firewalls and intrusion detection systems.
- Segmentation, to ensure easy lockdown if a breach occurs.
- Virtual private networks (VPNs) for secure remote access.
- Regular network vulnerability assessments.
- Secure Wi-Fi systems and practices.
HIPAA Compliance Checklist for Software Development
Proprietary software is becoming an increasingly common way to address the problems caused by off-the-shelf solutions that don’t quite address the needs of modern healthcare organizations. If your practice uses these, you must implement a HIPAA software compliance checklist. Verify:
- Whether the software is compatible with your data encryption practices.
- If access history is thoroughly logged and securely stored.
- That timeouts and lockouts are included, for both inactivity and suspicious behavior.
- That it undergoes regular vulnerability scans and patches.
HIPAA Compliance Website Checklist
If you have a patient portal, online appointment system, or other digital platform, then you will also need a HIPAA compliance website checklist. Ensure that your site:
- Uses HTTPS encryption across all pages.
- Protects contact forms and intake fields.
- Does not collect data unnecessarily, and stores it securely (not in a cookie or browser cache).
- Is built with access controls in mind.
- Has clear, up-to-date privacy policies listed that align with HIPAA.
Ready for a HIPAA Audit?
Implementing these security measures is only step one in protecting ePHI. You will need to regularly confirm that they remain effective, and that updates to HIPAA have not left you non-compliant. Your HIPAA compliance audit checklist should:
- Verify that all sensitive data is protected.
- Document any vulnerabilities, and all actions taken.
- Report any recent breaches, the damage caused, and what was done to resolve them.
- Outline all policies and procedures.
This exercise is invaluable. It will keep your defenses strong, and demonstrate your commitment to compliance should the Department of Health and Human Services (HHS) come knocking.
Moving to the cloud? Here’s an effective migration strategy
FAQs
What is the most important part of HIPAA compliance?
Every part of HIPAA is essential. This article focuses primarily on the Security Rule, but there are others to be aware of. You can find more information on the HHS website.
Which parts of my IT infrastructure are subject to HIPAA?
Your entire organization, including all parts of your IT environment, must remain HIPAA-compliant at all times.
Can I be punished if a staff member is found to be non-compliant?
Yes. You are considered responsible for the actions of all employees and third-party partners who interact with your organization.
What’s the best way to prepare for a HHS audit?
Document everything, especially your security protocols. Information will be your best defense if the HHS starts asking whether your organization is compliant with HIPAA.
Do small healthcare providers need the same safeguards as large ones?
Any entity that handles and transmits PHI, including all healthcare organizations, is subject to HIPAA.
Compliance Isn’t Optional. Safeguard Your Future Today
HIPAA compliance is not simply a way of avoiding cyber-attacks, like so many other frameworks. It is a mandatory requirement for any organization that regularly handles PHI. More than that, it can also provide you with a strong competitive advantage by building a deeper sense of trust. A strong HIPAA compliance IT checklist will keep you on track, protecting not just your patients but your own financial future.
Ascentient’s IT experts know that in healthcare, compliance is the name of the game. Our mission is to help organizations protect PHI, prevent cyber-attacks, and avoid nasty fines. You can start your journey now, by learning about more effective compliance management strategies.