New HIPAA Compliance and Security Requirements

The Health Insurance Portability and Accountability Act (HIPAA) is a set of regulations that protect the privacy and security of patient health information. HIPAA compliance is essential for healthcare organizations of all sizes, as it helps to ensure that patient data is kept safe and secure.

In recent years, there have been a number of changes to HIPAA compliance requirements, many of which have a direct impact on IT and cybersecurity. Let's dig in to some of the most significant changes as of 2023.

Risk Assessment Requirement

Under the HIPAA Security Rule, healthcare organizations must now conduct a risk assessment to identify and assess the potential risks to the security of patient health information. This risk assessment must be documented and updated on a regular basis. Risk assessments are important for all organizations to determine their acceptable risk level, as well as to prioritize address the most pressing risks. While there will always be some level of risk within every organization, having them documented and on the radar is the key to risk assessment.

Encryption Requirement

Healthcare organizations must now use encryption to protect patient health information in transit and at rest. This means that patient health information must be encrypted when it is being transmitted over a network, such as when it is being sent from one computer to another and when it is stored on a computer or other device. Encryption is an essential part of protecting physical hardware within your company.

Strong Password Implementation

Healthcare organizations must now implement strong passwords for all accounts that have access to patient health information. There is no direct password requirements for HIPAA compliant organizations, but they are expected to follow the NIST guidelines on good password practice. This means that passwords must be at least eight characters long and must include a mix of upper and lowercase letters, numbers, and symbols. Furthermore, using multi-factor authentication is highly recommended to provide a second form of identification for password sign-ins. Most healthcare organizations are adopting this practice rapidly, if they haven't already.

Employee Training on HIPAA compliance

All employees who have access to patient health information must now be trained on HIPAA compliance. This training must cover the organization's policies and procedures, as well as the latest HIPAA regulations. This may also include a form of security awareness training This helps organizations prevent social engineering cyber attacks by making employees aware of what to look out for.

Increased Enforcement

The Office for Civil Rights (OCR), which is responsible for enforcing HIPAA compliance, has increased its enforcement efforts in recent years. This has led to a number of healthcare organizations being fined for HIPAA violations. The HIPAA violation fines are publicly disclosed and vary between four tiers. 

• Tier 1 - Reasonable Efforts: Minimum penalty per violation is $127, Maximum penalty per violation is $63,973.
• Tier 2 - Lack of Oversight: Minimum penalty per violation is $1,280, Maximum penalty per violation is $63,973.
• Tier 3 - Neglect (Rectified within 30 days): Minimum penalty per violation is $12,794, Maximum penalty per violation is $63,973.
• Tier 4 - Neglect (Not rectified within 30 days): Minimum penalty per violation is $63,973, Maximum penalty per violation is $1,919,173.

The annual limit penalty per organization when it comes to HIPAA violation fines is currently $1,919,173. These numbers are subject to change per the Department of Health & Human Services (HHS) and usually do so on a yearly basis.

These changes to HIPAA compliance requirements highlight the importance of staying up-to-date on the latest regulations and implementing appropriate IT and cybersecurity measures to protect patient health information. Healthcare organizations that fail to comply with HIPAA can face significant penalties, including the fines listed above and even criminal charges.

Here are some additional tips for staying compliant with HIPAA in the context of IT and cybersecurity:

• Use strong security measures to protect patient health information: This includes using strong passwords, implementing encryption, and using firewalls and other security software.
• Educate employees on HIPAA compliance: All employees who have access to patient health information should be trained on HIPAA compliance. This training should cover the organization's policies and procedures, as well as the latest HIPAA regulations.
• Monitor compliance: The organization should have a process in place to monitor compliance with HIPAA. This process should include regular audits and reviews of the organization's policies and procedures.
• Respond to breaches promptly: If a breach of patient health information occurs, the organization should respond promptly and in accordance with HIPAA regulations. This may include notifying affected patients and the OCR.

If you are a healthcare organization looking to ensure you're in compliance with HIPAA, contact Charles IT today to learn how we can help protect the privacy and security of patient health information!