The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and healthcare technology have changed significantly over the past 20 years. Covered entities and their business associates face an ever-evolving risk environment in which they must protect electronic protected health information (ePHI). Although healthcare security budgets may increase this year, the cost of implementing and maintaining adequate security controls to protect an entity’s ePHI far exceeds what is often budgeted. As a result, some ePHI may be under-protected and vulnerable to data breach. A long-term, consistent and cost-conscious approach to HIPAA compliance is needed.
The foundation of an effective HIPAA compliance plan
Risk analysis is one of four required HIPAA implementation specifications that provide instructions to implement the Security Management Process standard. To further clarify risk analysis, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance on the risk analysis requirement in July 2010. The HIPAA Security Rule states that an organization must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization. Additionally, security risk analysis must be performed in order to comply and attest to Meaningful Use of electronic health records as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.With the OCR increasing enforcement efforts with a second year of random audits for both covered entities and their business associates related to HIPAA compliance, risk analysis plays a critical role. Organizations need to comply with the HIPAA risk analysis requirement if they are to be fiscally responsible and avoid returning Meaningful Use Medicare and Medicaid payments, avoid OCR fines and avert the cost of breach notification efforts.
Five steps to getting it correct
We find a range of compliance issues and tools used to conduct risk analysis when providing services. Often, HIPAA risk assessment reports do not meet the guidance defined by the Office for Civil Rights, or support a complete review of the security rule controls. Checklists of policies and procedures, penetration test results and IT assessments barely scratch the surface of the data security safeguards. The wide variance in HIPAA risk analysis scope and reporting suggests that many organizations may not truly understand the HIPAA Security Rule and how to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization as defined by the OCR. The five steps below should put you on the right track to be compliant with OCR guidelines.
1. Evaluate your current HIPAA risk assessment
The following components should be included in your current risk assessment efforts:
Identification of assets that create, store, process or transmit ePHI and the criticality of the data
Identification of threats and vulnerabilities to ePHI assets, the likelihood of occurrence and the impact to the organization along with a risk rating
Evaluation and documentation of the administrative, physical and technical safeguards for the organization, by department where applicable, and for each application with ePHI
Evaluation and documentation of the security measures currently used to safeguard ePHI. Are the controls configured and used properly? What are the vulnerabilities?
Evaluation of HIPAA policies and procedures – are the documents dated, signed, reviewed periodically and available?
If all of the above items are not included in the scope of your risk assessment, the assessment may not be acceptable with an OCR audit.
2. Determine the risk analysis frequency
One of the most prevalent challenges in complying with the HIPAA Security Rule’s risk analysis requirement is determining the frequency or triggering conditions for performing a risk analysis.
The HIPAA Security Rule and 2010 OCR risk analysis guidance state that risk analysis should be “ongoing” to document and update security measures as needed. The security rule states that continuous risk analysis should be completed to identify when updates are needed. OCR guidance notes that the frequency of performance will vary among covered entities.
Some covered entities may perform these processes annually or as needed (e.g., bi-annual or every three years) depending on circumstances of their environment. Typically, covered entities that are attesting to Meaningful Use and complying with the spirit of the security rule will conduct an annual HIPAA risk assessment.
3. Perform the risk assessment: Insource or Outsource?
HIPAA does not specify who should perform the risk assessment. Some organizations insource, some outsource and some do both – alternating between insourcing and outsourcing. For example, an organization may a consultant a specialist such as MedTech Consulting Solutions to conduct the HIPAA risk assessment every year. Hiring an outside professional to conduct the risk analysis reduces risk by providing an impartial assessment from someone who was not involved in the implementation of your systems or the development of your administrative policies, procedures and security controls.
4. Support cost savings without sacrificing risk assessment quality
How do you contain costs in performing a HIPAA risk analysis? Find a consultant who is reputable, has experience in performing HIPPA Risk Assessments and stays on top of any legal changes within the HIPAA policies and procedures (as they change and are updated). By maintaining your HIPAA Risk Assessment documentation on a quarterly or recurring basis, you will lower the overall cost
of remaining compliant, as your consultant will not have to start from scratch each year and thus your assessment will always be current and validated.
Final analysis: What could be missed, overlooked or found?
Healthcare organizations must implement strong and reliable data security safeguards. Doing so supports compliance with HIPAA's Security Rule, reduces risk and helps ensure the confidentiality, integrity and availability of the ePHI the organization creates, receives, maintains or transmits. C
Conducting internal risk analysis along with annual risk assessments that leverage a professional services provider every other year also reduces risk and maximizes the value of the resources engaged. Finally, leveraging an industry standard toolkit will help your organization be comfortable with conducting self-assessments on alternating years while saving time and money.