Especially in the middle of a global health emergency, network and data security become key in operations of healthcare organizations. The information that circulates a healthcare organization’s network is mostly of sensitive nature about its patients, and so protecting this information equates with protecting the welfare of patients themselves.

Given this, the industry standard is for electronic health records (EHRs) to be encrypted and for guideline and requirement lists such as that of the Health Insurance Portability and Accountability Act (HIPAA) to be strictly enforced. As an integral policy of the U.S. Department of Health and Human Services (HHS), the HIPAA compliant checklist is implemented by the federal law that aims to protect sensitive health information from being disclosed or disseminated without the patient’s consent or prior knowledge.

In today’s socially distanced world where digital interaction has become the norm, the need to secure one’s network from hackers, identity thieves, spammers, and others becomes all the more pressing. Because of this, hospitals and healthcare organizations all around the world are beefing up their cybersecurity gameplan, which is guided and standardized by laws such as the HIPAA.

It does not end at simply complying

EHRs do not only contain sensitive patient data; they are also used to connect and piece together other bits of data to produce valuable information as in data analytics. This form of shared and interconnected data thereby requires strict compliance with HIPAA’s Privacy Rule, which states that identifying information must be either removed from shared and interconnected data or de-identified, made anonymous, or encrypted.

HHS provides detailed guidance as to how to implement de-identification, but this can fall short when EHRs can still be accessed through stolen login credentials, unauthorized access, phishing, and cases of lost or stolen devices. Once access is gained, the de-identified information can still be re-identified and override the anonymity and encryption.

Protecting your patients’ data does not only mean having the up-to-date and standard technology and equipment in place. It also requires all precautionary protocols to be practiced. Many healthcare organizations comply by simply doing the bare minimum as stated in HIPAA’s Privacy Rule and nothing beyond that.

In a column Why HIPAA Compliance Does Not Equal Data Security, cyber surveillance expert Amit Kulkarni points out that the urgent need arises for automated systems that continually monitor the organization’s network, establish a baseline pattern for each individual user, pick up on any deviations from that user’s pattern, and then require additional authentication before allowing the aberrant action to proceed while simultaneously reporting it the IT security team.”

HIPAA compliance in 2021

Beyond the HIPAA Privacy Rule, there are the HIPAA Security Rule Standards that aim to supplement and strengthen the measures in the aforementioned. Here’s a quick rundown of the type of safeguards classified in the HIPAA Security Rule Standards.

• Administrative safeguards – these are measures that deal with network and data privacy from a management perspective
  • Security management – risk analysis and management
  • Workforce security – authorization and/or supervision, workforce clearance and termination processes
  • Information access management – access authorization, access establishment, and modification
  • Security awareness and training – security reminders, protection from malicious software, login monitoring, and password management
  • Contingency plans – data backup, disaster recovery, and emergency mode operation plans
• Physical safeguards
  • Facility access controls – limits on physical access to equipment storing data, validation procedures, and maintenance records
  • Workstation use and security
  • Device and media controls
• Technical safeguards – these are measures that ensure authorized data access
  • Access control – unique user identification, emergency access procedures, automatic logoff, and encryption and decryption
  • Audit controls
  • Integrity controls – authentication mechanisms such as electronic protected health information (e-PHI)
  • Transmission security – integrity controls and encryption of e-PHI during data transmission

Ever since the COVID-19 pandemic shifted the world as we know it, in the healthcare sector, telehealth has become a prominent choice for those who opt to receive treatment from a safe distance. With that, the HHS and Office for Civil Rights (OCR) have also implemented a series of guidance standards on telehealth communications that leans towards slightly loosening HIPAA enforcement. The guidelines call to “not impose penalties for HIPAA violations against healthcare providers in connection with their good faith provision of telehealth using communication technologies during the COVID-19 nationwide public health emergency.”

Just January of last year, President Trump signed bill HR 7898 into law, which amends the Health Information Technology for Economic and Clinical Health Act (HITECH Act) to create a safe harbor for healthcare organizations that have dutifully implemented standard security best practices prior to experiencing a data security issue. The objective of the HITECH Act is to incentivize HIPAA-covered entities and their business associates to adopt a common and more standardized, robust security framework.

Quality customer service is staying up to date with how you can better protect your customer’s data

The growing importance of data protection has been manifested in this ongoing development in legislation. Updates and revisions to industry standards with regards to data privacy and security are treated as priority for the U.S. federal government as a whole.

And while the changes and developments may imply that this is an added “burden” in the realm of healthcare and its stakeholders, the pros definitely outweigh the cons for all the health plans, healthcare providers, healthcare clearinghouses, and business associates that must adhere to the HIPAA Privacy, Security, Breach Notification, and Omnibus Rules.

Especially during a global health emergency, the HIPAA Rules are there ultimately to cover and ensure that healthcare operations are airtight during emergencies such as natural disasters and disease pandemics.