Checklist for HIPAA Security Rule

A checklist for HIPAA Security Rule is a crucial tool that healthcare groups should implement during a risk analysis to ensure compliance with the specific regulations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.

The Security Rule requires the implementation of proper administrative, physical and technical security measures to ensure the confidentiality, integrity, and security of protected health information (PHI) both on the move and at rest.

• The Administrative Safeguards require that a security officer is given to identify and analyze potential dangers to the integrity of PHI. They must also select and adapt security measures to reduce risks and flaws to a reasonable level and are responsible for information access management and workforce training.
• The Physical Safeguards relate to the physical security of data and access to where it is saved. This includes securing physical computer systems, servers and buildings from fire and other natural and environmental dangers, as well as from intrusion and hacking. The physical security measures also cover workstation and device security.
• The Technical Safeguards chiefly concern the security measures that guard against unauthorized access to PHI that is being shared over an electronic network. There are three sets of “controls” that must be set up to comply with the technical safeguards of the HIPAA Security Rule checklist – access controls, audit controls and integrity controls.

The most important part of the administrative Security Rule safeguard to think about is the ongoing risk analysis. Regular reviews must be conducted to ensure the effectiveness of the security measures put in place and that authorized users are adhering to the policies designed to maintain the strength of the security measures.

This includes any instance in which personnel are allowed to use their own personal mobile devices. Research has indicated that 87% of doctors (Manhattan Research/Physician Channel Adoption Study) and 67% of nurses (American Nurse Today study) use Smartphones in the workplace to “support their workflow”.

A HIPAA Security Rule checklist should treat personal mobile devices the same when identifying risks and vulnerabilities, and compiling appropriate use policies. Any changes to working practices, technological advances and revised legislation should also be thought about when these factors may reduce the effectiveness of implemented security measures.

Additional Physical Security Rule Security

Although the physical Security Rule safeguards would comprise the smallest portion of a HIPAA Security Rule checklist, they are no less important than any other. They mainly relate to the security of and physical access to facilities in which computer equipment is stored and the validation of personnel entering these clinics.

In respect of workstation and device security, policies and procedures must be adapted to specify the proper use of and access to workstations and mobile devices. This includes the implementation of an automatic log-off feature, so the PHI cannot be seen by unauthorized personnel when a workplace or mobile device is left unattended.

Healthcare groups and other entities covered by the HIPAA Security Rule must also have in place policies and processes regarding the transfer, removal, and disposal of PHI, the disposal of computer hardware and the re-use of electronic media. It should not be forgotten that the physical Security Rule safeguards apply to data that may no longer be necessary or in use.

More Information Regarding the Technical Security Rule Safeguards

It was referred to above that there are three sets of “controls” within the technical Security Rule safeguards. The access controls are linked to the identity verification processes that should be implemented to ensure a person accessing PHI is who he or she say they are, whereas the audit controls ensure that access to PHI is saved.

The integrity controls are related to PHI “at rest” – i.e. any electronically stored patient identifiers. Mechanisms should be put in place to ensure that PHI is not incorrectly altered or destroyed. For many healthcare groups, this involves having a system in place that safely archives PHI in a format that is read-only.

The safety of PHI “in transit” – i.e. used in communications – is also included in the technical Security Rule safeguards. The Security Rule states “A covered entity must implement technical security measures that protect against unauthorized access to PHI that is being transmitted over an electronic network”.

Secure Messaging & the HIPAA Security Rule Checklist

A cloud-based, secure messaging solution ticks the boxes on a HIPAA Security Rule checklist – especially in relation to in scenarios where medical professionals are allowed to use their personal mobile devices in the workplace. Secure messaging solutions work by allowing access to PHI via secure messaging apps that can be installed onto any desktop computer or mobile device.

Authorized users have to authenticate their identities by using a centrally-allocated user name and PIN number. This unique username allows that review of an individual’s activity on the secure messaging solution and the automatic preparation of audit reports. The secure messaging apps enable the easy communication of PHI between authorized users; but, as the apps only connect with a healthcare groups private network, PHI cannot be shared outside of the network to unauthorized people.

Other safeguards – such as automatic log off – exist to protect against the accidental or deliberate unauthorized disclosure of PHI, while security officers have the power to remotely wipe and PIN-lock any device that is lost, stolen or otherwise disposed of. All communications through a secure messaging solution are automatically archived in an uneditable and unerasable format, and PHI is encrypted both at rest and on the move so that it is undecipherable if a system is hacked or a communication is intercepted.

The Advantages of Secure Messaging in a Healthcare Group

Along with helping healthcare groups comply with the requirements of the HIPAA Security Rule, there are a number of benefits associated with secure messaging in a healthcare sector. Secure messaging has been shown to improve message accountability and reduce phone tag. This clears up time for medical professionals to deliver a higher standard of care to patients.

The secure messaging applications also support group messaging and multi-party conversations. This facility fosters collaboration and accelerates the communications cycle to bring down the length of time it takes to process hospital admissions and patient discharges. As pictures, test results and x-rays can be attached to secure messages, the solution is a much more effective way to request physician consults or escalate patient worries.

A secure messaging solution can also be installed with an answering service or EMR. A study into secure messaging/EMR integration found that complications from processes and tests that compromised patient safety were cut by 25 percent, medication mistakes caused by miscommunication decreased by 30 percent and the hospitals surveyed recorded 27 percent fewer patient safety incidents in total.

HIPAA Security Rule Checklist is About More than Compliance

Although it was referred to at the beginning of this article that a HIPAA Security Rule checklist is a tool that healthcare groups should use to ensure compliance with the HIPAA Security Rule, it has many more roles that that. A HIPAA Security Rule checklist can find weaknesses in a healthcare group’s channel of communication channel. Once these weaknesses are addressed, healthcare groups can become more efficient, more productive and more profitable.