HIPAA Compliance For Small Practices: According to the American Health Information Management System (AHIMA), an average of 150 people from nursing staff to x-ray technicians, to billing clerks, have access to patient’s medical records during the course of typical hospitalization.

1. Presentation on
HIPAA 101

2. What we want to accomplish
 Why need HIPAA
 Understand what is HIPAA and its rules?
 Understand who it applies to?
 Understand why we need to know about HIPAA in NISOS?
 Know about PHI and ePHI?

3. History of HIPAA
 Long back, a patient medical record was recorded and maintained primarily
on paper and stored in offices of physicians, hospitals, and other healthcare
professionals
 These records are kept in locked cabinets or closets
 With the advent of computers and other technology, we are now able to
maintain electronic files that allow us more flexibility in communicating
information between offices, and clinics, as well as cutting down on the space
requirements storage.

4. History of HIPAA …
 According to the American Health Information Management System (AHIMA),
an average of 150 people from nursing staff to x-ray technicians, to billing
clerks, have access to patient’s medical records during the course of typical
hospitalization.
 There are however concerns that the increase in electronic information may
result in a loss of privacy and confidentiality
 Out of so many people , we must make sure that only those people must have
access to the medical information who NEED it

5. Top Healthcare Data
Breaches are due to:
 Sharing/ Unauthorized access or disclosure
 Hacking
 Theft
 Loss
 Inadequate Disposal

6. Biggest Healthcare Data
Breaches of 2018
 Ransomware attack against California provider breaches data of 85000
patients
 (Where hackers hit the IT vendor of three center for Orthopedic Specialists
locations in February, which locked out users and encrypted patient data)
 134512, records breached in malware attack. St Peter’s surgery and
Endoscopy Center, in New York, was hit with the second largest healthcare
data breach of 2018
 Data of 43000 patients breached after theft of unencrypted laptop

7. HIPAA Law
 The Federal government passed a law in 1996 that creates
national standards to protect patient’s medical records as
well as other personal health information
 The Federal legislation is called the “Health Insurance
Portability and Accountability Act “

8. What is HIPAA
 Health Insurance Portability and Accountability Act of 1996
 HIPAA is the federal statutory basis for the establishment of national
standards for the privacy and security of protected health information (ePHI)
 HIPAA is about mitigating the risk of a potential health information.
 It is steps taken to control or prevent a health hazard from causing harm and
to reduce risk to a tolerable or acceptable level

9. Why need HIPAA
 Increased number of data breaches
 This law is defined to protect patient privacy as well as the integrity of the
medical practice
 To promote personal and societal values : Individuality, Respect, Dignity
 To promote more transparent healthcare
 It is not an option

10. What is PHI
PHI (Protected Health Information)
PHI is any information in a medical record that can be used to identify an
individual and that was created, used or disclosed in the course of providing a
healthcare service
Includes
 Medical Records
 Billing Information
 Health Information
 Any individually identifiable information

11. What is ePHI
 ePHI – Electronic Protected Health Information
 Refers to any protected health information (ePHI) that is covered under HIPAA
security regulations and is produced, saved, transferred, or received in an
electronic format.

12. PHI and EPHI Identifiers
 There are 18 specific identifiers of electronic protected health information
 1. Names
 2. All geographic sub-divisions smaller than State ( Including street address,
city, country, zipcode and other equivalent geocodes)
 3. Dates related to an individual (Birthdate, Admission date, discharge date)
 4. Telephone Numbers
 5. Fax Numbers
 6. Email Address
 7. Social Security Number

13. Who needs to be HIPAA
Compliant
Federal regulations identified two categories of individuals , organizations,
agencies and businesses, that must comply with HIPAA requirements
 Covered Entity
 Business Associates

14. Covered Entity
A covered entity is anyone who provides treatment, payment and
operations in healthcare.
Covered Entities Include:
 Healthcare Providers
 Health Plans
 Health Clearinghouses

15. Business Associates
Business Associate is any entity that uses or discloses
PHI on behalf of a Covered Entity. Here are some
examples of potential Business Associates:
 Third-party administrator that assists a health plan with claims processing
 Consultant that performs utilization reviews for a hospital
 Health care clearinghouse that translates a claim from a crude format
into a standard transaction on behalf of a doctor, and forwards the
processed transaction to a payer
 Independent medical transcriptionist that provides transcription services
to a physician
Also, a covered health care provider, health plan, or
health care clearinghouse can be a business associate of
another covered entity.

16. HIPAA Requirements
 HIPAA Privacy Rule
 HIPAA Security Rule
 HIPAA Enforcement Rule
 HIPAA Breach notification Rule

17. HIPAA Requirements:
HIPAA Privacy Rule
Definition:
The Rule requires appropriate safeguards to protect the privacy of
personal health information, and sets limits and conditions on the uses
and disclosures that may be made of such information without patient
authorization.
The Rule also gives patients rights over their health information,
including rights to examine and obtain a copy of their health records,
and to request corrections.

18. HIPAA Requirements:
HIPAA Privacy Rule
Requirements:
 Do not allow any impermissible uses or disclosures of PHI.
 Provide breach notification to the Covered Entity.
 Provide either the individual or the Covered Entity access to PHI.
 Disclose PHI to the Secretary of HHS(US department of Health and Human
Services), if compelled to do so.
 Provide an accounting of disclosures.
 Comply with the requirements of the HIPAA Security Rule.

19. HIPAA Requirements:
HIPAA Security Rule
Definition:
The HIPAA Security Rule contains the standards that must be applied to
safeguard and protect ePHI (Electronic protected health information) when
it is at rest and in transit. The rules apply to anybody or any systems that
have access to confidential patient data.
Under HIPAA Security rule every Covered Entity and Business Associate that
has access to PHI must ensure the:
 Technical,
 Physical and
 Administrative safeguards
are in place and adhered to.

20. HIPAA Requirements:
HIPAA Security Rule:
Technical Safeguards
The Technical safeguards focus on the technology that protects PHI
and controls access to it.
It consists of
1. Access Control
 Unique user identification
 Emergency access procedure
 Automatic log off
 Encryption and Decryption
2. Audit Controls
 Audit control mechanisms are implemented so as to record and examine the
activity in information system that contain or use ePHI.
 It helps protect against any security violation
 For e.g. Audit reports generated by information system

21. 1. 3. Integrity
Integrity is defined as “the property that data or information have not been
altered or destroyed in an unauthorized manner.
 Checksum verification and digital signatures
For protecting person or entity authentication,
 Use of passwords, PIN
 Require something that individual possess such as a smart card, a token or a key
 Require something unique to an individual such as Biometric; Examples:
Fingerprints, voice patterns, facial patterns or iris patterns
1. 4. Transmission security
 Integrity
 Network Communication protocols
 Data message authentication codes
 Encryption
HIPAA Requirements:
HIPAA Security Rule:
Technical Safeguards

22. HIPAA Requirements:
HIPAA Security Rule:
Physical Safeguards
Physical safeguards are set of rules and guidelines that focus on the physical access to
PHI (Protected Health Information)
It consists of
1. Facility Access Control
2. Workstation Use
3. Workstation Security
4. Device and Media Controls

23. Physical Safeguards:
Facility Access Control
This standard requires covered entities to implement policies and procedures to
limit physical access to its electronic information system and the facility or
facilities in which they are housed, while ensuring that authorized access is
allowed
It contains four implementation specification
1. Contingency operations
2. Facility Security Plan – Locked doors, signs warning of restricted areas,
3. Access control and Validation procedures – Use of guards, identification
badges
4. Maintenance records – policies and procedures that specify repairs and
modifications to a physical component of a facility.

24. Physical Safeguards:
Workstation Use
This standard requires covered entities to implement physical safeguards on all
workstations that have access to PHI that will limit access only to authorized
users.
 Example:
 Logging off before leaving a workstation for an extended period of time
 Using continually updated antivirus software

25. Physical Safeguards:
Workstation Security
This standards states that how workstations such as laptops, desktop computers,
personal digital assistant (PDAs) should be physically protected from unauthorized
users
Example: Completely restrict physical access to the workstation by keeping it in a secure
room where only authorized personnel work

26. Physical Safeguards:
Device and Media Controls
This standard requires the covered entities to implement policies and procedures
that govern the receipt and removal of hardware and electronic media that
contain ePHI, into or out of the facility and the movement of these items within
the facility
It includes
a. Disposal
b. Media Re-Use
c. Accountability
d. Data backup and storage

27. HIPAA Security Rule:
Administrative Safeguards
Administrative Safeguards include
 Administrative actions
 Policies and Procedures
Example:
 Training the entire workforce on security and developing
 Implementing security policies and procedures

28. HIPAA Enforcement Rule
 The HIPAA Enforcement Rule spells out investigations, penalties, and
procedures for hearings
 The HIPAA Enforcement Rule contains provisions relating to compliance and
investigations, the imposition of civil money penalties for violations of the
HIPAA Administrative Simplification Rules, and procedures for hearings.
 HIPAA violations are expensive. The penalties for noncompliance are based on
the level of negligence and can range from $100 to $50,000 per violation (or
per record), with a maximum penalty of $1.5 million per year for violations of
an identical provision. Violations can also carry criminal charges that can
result in jail time.

29. HIPAA Breach Notification Rule
 The HIPAA Breach notification rule requires covered entities to notify patients
when there is a breach of their ePHI (Electronic protected health
information).
 The Breach Notification Rule also requires entities to promptly notify the
Department of Health and Human Services of such a breach of ePHI
(Electronic protected health information) and issue a notice to the media if
the breach affects more than five hundred patients.

30. Read complete article here
Https://nisostech.com/hipaa