1

HIPAA Entity Identification

We help you identify your classification under HIPAA in terms of a covered entity or business associate. Covered entities include:

• Health care providers
• Health plans such as health insurance companies
• Healthcare clearing houses

Business associates do business with covered entities or deal with protected health information. We help in identifying and classifying based on HIPAA definitions.

2

PHI

PHI stands for Protected Health Information, which can include anything in the patient health record. As part of HIPAA, it is crucial to identify PHI and maintain privacy regarding this data. Not all health data can be considered PHI and regulated by HIPAA. It must meet the following criteria:

• The patient must be able to identify with the data.
• During care, this data must be disclosed to a covered entity.

We help you maintain the security and privacy of PHI.

3

Identify HIPAA Rules

Identifying the rules to be implemented plays a key role in HIPAA compliance. The rules are broadly classified as:

• Security rules which deal with confidentiality, integrity, and availability of health information
• Privacy rules which deal with prevention of unauthorized disclosure of health data
• Breach notifications ensure the notification mechanisms are in place in case of a data breach.

4

Maintain Privacy

In all circumstances, unless the patient has approved of allowing disclosure of their information, the data privacy needs to be maintained. We can share the data only in case of:

• Shared with any individual that has been allowed by the patient
• For treatment, payment, or general health care operations

In every other case, data privacy needs to be maintained and we help you with this

5

NPP

NPP stands for Notice of Privacy Practices. All practices need to provide patients with a Notice of Privacy Practices. Our team works with your organization to implement the NPP. The NPP must inform patients of the uses and disclosures of PHI that may take place, and also define the patient’s right to access and amend their medical information.

6

Required Access Controls

Access controls manage centrally controlled and easily accessible user record entries with usernames and passwords. This also includes a well-defined procedure to be incorporated to disclose information in case of emergency.

7

Administrative Safeguard

We help you place safe authentication mechanisms and monitor for situations of unauthorized access to data or alteration of information. Administrative Safeguards require practices to create and maintain updated policies and procedures. This also includes employees learning to follow procedures on how to safeguard the security of PHI. We train employees on their access rights and responsibilities with handling PHI. Essential items covered here include:

• Acceptable use of policies
• Sanction policies to discipline employees who violate HIPAA law
• Information access policies to grant access to health records
• Security awareness training
• Contingency planning, which includes adequate preparation, policies, and procedures in order to respond to emergencies

8

Technical Safeguards

Technical safeguarding includes practices and procedures, along with the correct software and equipment to protect PHI. We help you incorporate these changes and allow PHI access only to those who are allowed. Other areas included are:

• Ensuring encryption and decryption of information is completed before transmitting any patient’s information. So, it will be unreadable to anyone other than the intended parties.
• Policies and procedure set up to destroy PHI when it’s no longer necessary to perform a job
• If required, we implement hardware or software to protect PHI.
• Tracing system activity to a specific user accessing PHI
• We will protect any data received from other practices or authorized vendors.

9

Physical Safeguard

One of the core components of HIPAA compliance is traceable audit logs. This helps to safeguard private information and register all transactional details. We help you identify the most secure way to handle and access PHI, and maintain isolation levels, while handling health-related sensitive data by an allowed user. We must monitor all access. Our team works towards achieving this for your organization.

10

Key Roles

HIPAA requires that every practice designates a HIPAA security and HIPAA privacy officer. These are individuals who lead the implementation and training of HIPAA requirements for your practice. We support training within the organization.