With PHI security being a primary focus in HIPAA, appropriate safeguards like access controls and encryption must be implemented.
They’re not just for your own self-assurance—financial penalties for not implementing proper securities have gone as high as:
Stemming from insecure storage, it’s also important to protect PHI from being hacked and stolen by external bad actors.
Besides implementing basic encryption and access controls, other steps to take for limiting the risk of data breach include:
Considering their constant handling of PHI, employees are one of the most common sources of HIPAA violations.
Whether knowing or unknowingly, there are a range of violations committed by employees that in turn need to be covered in HIPAA training programs, including:
If you were to have access to PHI and discussed it with those who aren’t authorized to do so it would be a direct violation of HIPAA.
It may not be the first violation to come to mind when it comes to HIPAA compliance, but it’s nonetheless important to ensure PHI is only discussed with people who are directly involved, including:
Similar to the violation risk of removing PHI from a facility, accessing PHI from unsecure places like a home computer or sharing PHI over text is another common source of HIPAA violations.
Rather than using personal devices to share, store, and access PHI, it’s recommended to instead implement a central electronic health records (EHR) system for storing information with tools like authentication, access controls, and encryption to protect PHI and ensure HIPAA compliance.
It’s important that when it’s time for PHI to be disposed, proper steps are taken to ensure it’s safely destroyed.
Although HIPAA doesn’t specify a method for destroying PHI, shredding services are frequently used not only because of their cost efficiency compared to alternatives, but also because they provide certificates of destruction.
A certificate of destruction is a key tool that can be used to provide proof of HIPAA compliance in case of any legal disputes, and includes information like where and when the shredding was done, who did it, and witness signatures.
Regularly conducting a risk assessment helps organizations to determine whether any vulnerability to the confidentiality, integrity, and availability of their PHI exists, and although it’s beneficial for organizations just for shoring up their securities, it’s also required by HIPAA.
Recent HIPAA settlements for not conducting a risk analysis include:
Conducting an organization risk assessment is important, but it doesn’t end there.
Although performing a risk analysis will keep you HIPAA compliant, it’s also necessary to follow it up by implementing a risk management process to address the identified risks.
Recent organizations who conducted a risk assessment but failed to act on them include:
A patient’s PHI can only be released to its listed recipients and disclosing the information to an unauthorized party is a direct violation of HIPAA.
This common violation is typically the result of one of the following errors:
The HIPAA Privacy Rule contains the right to revoke clause, which is a statement used on authorization forms to tell patients that they can legally void their approval for covered entities to use and disclose their PHI.
Without including the right to revoke statement on authorization forms, the use of PHI in any way will be a HIPAA violation.
Contact Scan-Optics to learn how our digital security experts can help you avoid HIPAA violations.