Small practices have to spend an out-sized amount of time managing HIPAA. It may seem like too much work, but like with vaccines its better to have your data protected in advance.
“Get your flu shot.”
As a healthcare professional, you advise your patients to protect themselves and their families by getting an annual flu shot, despite the momentary unpleasantness. Additionally,, researchers work to create an effective flu vaccine to combat the most recent virus evolution. In the same way that vaccines proactively protect your patients physical health, HIPAA compliance controls protect your patients’ data health.
Online information about the Health Insurance Portability and Accountability Act (HIPAA) Security Risk Assessment requirements overwhelm you the same way vaccine information on the internet overwhelms your patients. However, thinking about cybercrime as an organic virus and data controls as the vaccination can make understanding it easier.
As part of your HIPAA compliance, you need to assess your information security. To do this, you need to think about all the different ways you collect information, places you store it, and ways it travels. At first glance, you might think, “I only collect the minimum information necessary and store it on my secure systems.”
However, let’s take a quick look at the amount of information a single intake form collects:
Before a patient even meets you for the first time, you have an entire record of all the personally identifiable information right there on a clipboard. Just like multiple strains of a virus, you collect multiple streams of information.
The Office of the National Coordinator for Health Information Technology (ONC) website offers a downloadable Security Risk Assessment tool (SRA). For practices with financial constrictions, the free HIPAA toolkit offers a potential solution. Unfortunately, monetarily free doesn’t always mean really free.
In 2016, two information systems researchers engaged in a case study using a small healthcare clinic. The small clinic, with no dedicated IT personnel, processed approximately 1,600 patient records. The researchers, in conjunction with the owner, needed six hours to answer 101 of the 156 questions in the SRA tool. As they noted, for many small clinics the time spent makes sense but often the questions felt repetitive for the owner.
If you think about it like a vaccine, you tell your patients that the few days of “flu-like” symptoms are their body adjusting to the virus, so the protection is worth it. In the same way, the few days of engaging in healthcare risk assessment template is worth the protection it provides.
If you’re a sole practitioner or small practice, you might be tempted to use an online HIPAA risk assessment checklist. These checklists help you get started, but they don’t meet the ongoing monitoring requirements embedded in HIPAA. Often, a HIPAA risk assessment template starts with creating a security plan and creating audit procedures. These act as moment-in-time reviews.
Unfortunately, additional checklist items include continuous monitoring to determine the necessity of sanctions for employee non-compliance and periodically reviewing documentation to ensure continued control effectiveness.
Thinking about it medically, you know that the flu virus evolves from season to season. Hackers evolve their methodologies to evade protections. Therefore, the same way this season’s vaccine won’t protect against next year’s flu strain, today’s data controls may not protect against next year’s malicious actor methodologies.
A few years ago, the Centers for Medicare and Medicaid Services EHR Incentive Programs set out objectives under the Merit-Based Incentive Payment System (MIPS) and Promoting Interoperability (PI) functions for engaging patients. As more practices incorporate these EHR services, it’s easy to think that by incorporating a HIPAA compliant vendor that you are also compliant.
As part of the security risk assessment, meaningful use doesn’t change your requirements. It just means that you need to ensure that your EHR provider protects data they access. However, you collect information that may not be part of that system. You’re still in charge of the information you collect or that your patient sends you outside of that EHR.
Putting this in terms of a flu vaccination, it’s similar to a parent and child both getting vaccinated. If the child gets vaccinated but the parent doesn’t, the parent is still at risk for getting sick. If your EHR provider is protected but you aren’t, your patients’ data is still at risk of contamination.
A HIPAA risk assessment for medical offices can be over twenty pages in length making the risk assessment and analysis frustrating and overwhelming. However, starting with a security-first approach helps ease the burden. Securing the data environment starts with a cyber security risk assessment and ends with a physical security risk assessment. However, at their most basic levels, all HIPAA risk assessments focus on making sure no one obtains access to information without needing it to do their jobs or without you giving them express permission.
The following security risk assessment examples offer an overview, although not a complete set of steps, for understanding HIPAA risk assessment requirements.
Most medical practices will start with these. The desktops or laptops your staff use as well as any software or cloud storage solution should be reviewed.
Diagnosing the Problem: Asset Inventory
Vaccinating the Data: Finding the Protections
If your practice uses the “standing desks on wheels” to collect intake information, you need to think about a variety of ways to protect that information.
Diagnosing the Problem: Asset Inventory
Vaccinating the Data: Finding the Protections
Many of your patients may be using medical devices that send you information. Remote patient monitoring devices often include sensors that measure vital signs and send patient information to centralized storage or cloud locations.
Diagnosing the Problem: Asset Inventory
Vaccinating the Data: Finding the Protections
By protecting ePHI with a security-first approach, you’re vaccinating your client information from a data breach. When your patients complain about having to make appointments, wait in offices, or pay for flu shots, you remind them that it’s to protect herd immunity. HIPAA intends to vaccinate data from infections and breaches, even if it takes time and money to be compliant. One of our core values at Zeguro is transparency. As you explain medical concerns to your patients, we explain security concerns to you.
Protect you practice today by getting a free cyber insurance quote in minutes.
Note: Zeguro is not able to comment on specific HIPAA cases or violations and only provides general advice in its blogs and articles. For assistance with HIPAA violations, we recommend you contact licensed legal counsel.