The document discusses the Health Insurance Portability and Accountability Act (HIPAA) and its requirements for protecting private health information. It notes that HIPAA was established in 1996 and outlines its privacy and security rules. It also provides recommendations for HIPAA compliance, including training employees, implementing access controls, conducting security audits, and logging system activity. Finally, it discusses the civil and criminal penalties for violating HIPAA regulations.

1. Walt Minor
Dr. Lu
2.23.19

2.  Established in 1996
 Overseen by the Office of Civil Rights of the United States
 “The HIPAA Privacy Rule protects the privacy of individually identifiable health
information,” (Hicks, 2017)
 “The HIPAA Security Rule sets national standards for the security of electronic
health information,” (Hicks, 2017)

3.  Provide all employees with HIPAA education and training
 Design different levels of access for staff and how access is gained; proper
authorization
 Create formal security management processes including: internal audits,
alternative plans, and developing policies and procedures
 “Assign responsibility of security to a designated person to manage and supervise
the use of security measures and the conduct of the staff,” (Hicks, 2017)

4.  Provide protection from hazards such as fires and floods
 Secure locations for PHI (personal health information); uses of locks, keys, and
badges could assist with this allowing only authorized users to enter these areas
 “Develop policies for verifying access authorizations, equipment control, and
handling visitors. Develop and provide documentation including instructions on
how your medical office can help to protect PHI (for example, logging off the
computer before leaving it unattended),” (Hicks, 2017)

5.  Logoff expiration times
 Log system activity
 Utilize encryption
 Unique user identification

6.  Civil Penalties: $250 per failure to comply; up to $25k maximum per year for
multiple violations
 Criminal Penalties (knowingly obtaining and/or disclosing PHI) : “The minimum
penalty is $50,000 and up to one year in jail. Violations committed under false
pretenses require a penalty of $100,000 and up to five years in prison. The most
severe penalty is enforced in cases where the intent was to sell, transfer or use
patient information for commercial advantage, personal gain, or malicious harm.
This type of violation is punishable by a fine of up to $250,000 and up to 10 years
of jail time,” (Data File Technologies, 2010)

7.  Data File Technologies (2010) Consequences of HIPAA Violations Can Be Hefty,
But Avoidable. Retrieved From:
https://www.datafiletechnologies.com/consequences-of-hipaa-violations-can-be-
hefty-but-avoidable/
 Hicks, J. (2017) Annual HIPAA Compliance Training. Retrieved From:
https://www.verywellhealth.com/annual-hipaa-compliance-training-4050244