HIPAA TIPS: Implementing a Security Management Process

HIPAA TIPS: Implementing a Security Management Process

Lead Your Culture, Select Your Team, and Learn

1. Designate a Security Officer(s):

   Your security officer will be responsible for developing and maintaining your security practices to meet HIPAA requirements. The security officer will work with others to protect your patients’ electronic Protected Health Information (ePHI) from unauthorized access.

2. Discuss HIPAA Security Requirements with Your EHR Developer

   Meet with your EHR developer to understand how your EHR can be used in line with the HIPAA and Stage 1 and Stage 2 Meaningful Use requirements. We provide a list of questions you may want to ask your EHR developer [PDF – 649 KB].

3. Consider Using a Qualified Professional to Assist with Your Security Risk Analysis

   Using a qualified professional can often yield quicker and more reliable results than conducting an in-house risk analysis. If you hire a professional, pick one who has relevant certification and direct experience tailoring a risk analysis for your size of medical practice. You are still ultimately responsible for the risk analysis even if you hire a pro.

4. Use Tools to Preview Your Security Risk Analysis

   Use tools available on the Office of the National Coordinator for Health Information Technology (ONC) and U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) websites. These tools can give you a sense of your practice’s potential shortcomings in Protected Health Information (PHI) security. See the HHS Security Risk Assessment (SRA) Tool and OCR Guidance on Risk Analysis for more help in evaluating your risk level.

5. Refresh Your Knowledge Base of the HIPAA Rules

   Learn about the HIPAA Rules, state laws, and other privacy and security requirements.

6. Promote a Culture of Protecting Patient Privacy and Securing Patient Information

   Privacy and security are best achieved when your office has a culture of confidentiality and PHI protection. Learn more in Chapter 6 of the Guide [PDF – 569 KB].

Document Your Process, Findings, and Actions

The HIPAA Security Rule requires you to document your risk analysis and HIPAA-related policies, procedures, reports, and activities. Also, if you are attesting for Meaningful Use, you are required to retain all records that support attestation.

Review Existing Security of ePHI (Perform Security Risk Analysis)

In the risk analysis process, you assess potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The findings inform your risk mitigation strategy. A professional can plan and implement your risk analysis, but you will need to oversee the process. See the SRA Tool for guidance.

Develop an Action Plan

Using the results from your risk analysis, discuss and develop an action plan.

Manage and Mitigate Risks

1. Implement Your Action Plan

   Your action plan should address all five HIPAA security components. Follow your action plan and support ongoing efforts to identify, assess, and manage risks.

2. Prevent Breaches by Educating and Training Your Workforce

   All of your workforce members — employees, volunteers, trainees, and contractors — need education and training to know how to safeguard patient information. Your training program should prepare them to carry out your HIPAA-related policies and procedures. Reinforce training with reminders. Above all, lead by example.

3. Communicate with Patients

   A multi-pronged communications plan will help you address patient concerns about EHRs and privacy.

   • Inform patients that you place a priority on maintaining the security and confidentiality of their health information.
   • Address patients’ health information rights.
   • Educate patients on how their health information is used and how it may be shared outside your practice.
   • Follow your policies and procedures in notifying affected patients and caregivers when a breach of unsecured PHI occurs.

4. Update Your BA Contracts

   Update all your Business Associate (BA) agreements to comply with the HIPAA Privacy, Security, and Breach Notification Rules. OCR offers sample BA contract provisions.

Attest for Meaningful Use Security-Related Objective

You can register for the Meaningful Use Programs anytime, but to attest, you must meet the Meaningful Use requirements for an EHR reporting period. So, only attest after you have conducted your security risk analysis (or reassessment), corrected any identified issues, and documented those changes.

Monitor, Audit, and Update Security on an Ongoing Basis

The HIPAA Security Rule requires that you have audit controls in place and have the ability to audit. Have your security officer, Information Technology (IT) administrator, and EHR developer work together so your system’s monitoring/audit functions are active and configured to your needs. Set up your EHR to maintain an audit log on who, what, when, where, and how your patients’ ePHI has been accessed.

For more information on HIPAA-secure IT solutions for healthcare, contact Ace Technology Group at 610.640.4323.

Source: HealthIT.gov