Protect patient data and address HIPAA compliance with a HIPAA Security Risk Assessment
Any organization that is a Covered Entity or Business Associate under HIPAA regulations MUST complete an annual security risk assessment, then maintain a supporting risk management as evidence of compliance for a potential HHS/OCR audit.
The Health Insurance Portability and Accountability Act (HIPAA) is a series of regulatory standards that outline the lawful use and disclosure of Protected Health Information (PHI) including Electronic Protected Health Information (ePHI). This federal law passed in 1996 required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. HIPAA compliance is regulated by the Department of Health and Human Services (HHS) and enforced by the Office for Civil Rights (OCR).
Keeping patient data safe requires healthcare organizations to exercise best practices in three areas:
- Administrative security – Refers to the policies and procedures in place to protect the sensitive data.
- Physical security – Refers to the physical location of the sensitive data and how it is protected. This includes physical workstations and mobile devices.
- Technical security – Refers to the technology that is used to protect the sensitive data and who has access to the data
A HIPAA Security Risk Assessment (SRA) is essential for the security of information in your organization. A data breach doesn’t just cost you money; it costs you time, resources, and trust. While laws require healthcare providers and their associates to be compliant with HIPAA and HITECH through periodic risk assessments, the objective of those assessments should be to reduce the overall risk of a breach of any protected information.
The Tego Approach
All HIPAA risk assessments are conducted by our ISACA-certified team using the controls identified in the HIPAA Privacy and Security Rules. In addition to conducting the assessment, Tego can help build risk management policies, conduct periodic security training with your employees, and develop and test any contingency plans for your organization.
A HIPAA SRA will address the requirements all healthcare providers and their business associates are required to follow in order to remain compliant. A HIPAA SRA is not a one-time requirement and should be conducted yearly to ensure continued HIPAA compliance.
Meaningful Use and Merit-Based Incentive Payment System (MIPS)
In 2009, the Federal Government passed the HIPAA HITECH act. A core objective of HITECH was to drive adoption and “meaningful use” of electronic health record systems. Ultimately, the feds sought the efficiencies and health benefits of automating the processing of medical records.
Almost anyone who is not operating as a hospital is considered an eligible professional (EP). Starting in 2011, EPs could receive incentive money for the early adoption of EHR systems. Those same EPs could receive additional incentives by progressing to more advanced stages of EHR implementation. As of October 1, 2017, all EPs must attest that they have at least completed the first stage and implemented an EHR system. EPs who fail to show Stage 1 MU, will have up to 6% of their Medicare/Medicaid reimbursements withheld.
Within the core elements for attestation at each stage is the requirement that the EP has completed a HIPAA Security Risk Assessment pursuant to the HIPAA Security CFR. Completing a Security Risk Assessment is essential to ensuring your medical practice is compliant with the Meaningful Use regulations.
Each iteration of HIPAA modifications, from Meaningful Use through MIPS/MACRA, encourages the completion of a HIPAA SRA and security management program.
Contact us today for a quote for a HIPAA Risk Assessment.