Administrative safeguards
- Risk analysis. A written review of where patient information lives and what could go wrong, updated when things change. This is the item regulators ask for first.
- Policies and a named security officer. Someone is responsible, and the rules are written down.
- Workforce training. Every staff member, at hire and regularly afterward, including how to spot phishing.
- Business Associate Agreements. A signed BAA with each vendor that handles patient information: IT provider, billing company, phone and fax service, cloud storage, shredding.
- Incident response plan. Who to call, what to shut off, and how to decide whether patients must be notified.
Technical safeguards
- Unique user accounts. No shared logins, so every action can be traced to a person.
- Multi-factor authentication on email, the EHR and remote access.
- Encryption on laptops, phones, backups and anything sent over the internet.
- Automatic logoff and screen locks on workstations in patient areas.
- Audit logs that record who accessed what, kept and reviewed.
- Patching and endpoint protection on every device, monitored around the clock.
Physical safeguards
- Controlled access to server rooms, network closets and records storage, with a log of who enters. Screens turned away from public view. Old drives and devices wiped or destroyed before disposal.
Backups and recovery
HIPAA expects you to be able to restore patient data after an emergency. Keep encrypted backups in a second location, and test a restore on a schedule. A backup that has never been restored is a hope, not a plan.
If a breach happens
Affected patients must be notified without unreasonable delay, and no later than 60 days after the breach is discovered. Larger breaches also require notice to the federal government and sometimes the media. Having logs and a response plan ready makes this far less painful.
This article is general information, not legal advice. Talk to your attorney about how the law applies to your organization.