The Health Insurance Portability and Accountability Act, also known as HIPAA, was enacted to help keep private health information safe. It’s not just for protecting sensitive data from prying eyes, but it’s also meant to maintain the integrity of the information by preventing unauthorized changes.
In the 1990s, the technology boom completely transformed the way that medical information was sent from health care providers to health insurance companies and so on. Nowadays, most protected health information, or PHI, is sent through the Internet. It’s quick, easy, and incredibly affordable. So, why not take advantage of it? Unfortunately, digital communication also opens up a pandora’s box of potential risks!
Let’s face it, online privacy issues are much more prevalent today than they were two decades ago. Data breaches, hacking, malware, and a slew of other cybersecurity issues put PHI at risk of getting into the wrong hands. The question is…
Are your systems and communication lines encrypted for HIPAA compliance?
Do You Even Need to Comply?
First things first, you should ask yourself whether or not you need to comply in the first place. There’s a lot of confusion out there about who must comply and how the entire process works. Medical professionals spend years getting those privacy and security rules drilled into their brains.
However, they’re not the only ones that need to pay attention to how PHI is being protected. Whether you’re performing medical data analysis or administrative work, compliance is a must. All covered entities and business associates that handle sensitive medical data need to keep that data encrypted to comply with federal law.
Violations of the privacy rule are no joke. They carry civil and potential criminal penalties. Plus, you could face sanctions, lawsuits, and possible jail time. Needless to say, investing in some top-notch security for your company is crucial.
The Basics of Encryption
To put it simply, to encrypt something is to scramble information so that it’s unreadable. There are several ways to encrypt information. However, they all work on the same basic principles. If an unscrupulous individual were to get their hands on the data, the complex algorithms would make it look like nothing more than a mess of bits and bytes. The only people who can make sense of it are those who have a key.
What Needs to Be Encrypted to Comply with HIPAA?
These days, technology is all around us. While it’s made communication and data transfer a breeze, there are several ways that technology can be compromised. To fully comply with HIPAA, consider how the following items are protected against digital thieves.
The most obvious thing that needs to be encrypted is your hard drives. Any piece of equipment that stores PHI needs to be fully encrypted. Chances are, you also have an off-site backup system. You can encrypt that as well for some peace of mind.
Imagine what would happen if burglars stole all of the computers from your office. Or, if your network was compromised. There have been quite a few cases of multi-million dollar fines due to serious data breaches. The privacy rules also extend to laptops, tablets, and any other hard drive that’s storing sensitive data.
Proper end-to-end encryption is paramount for business associates. There’s no easier way to communicate than email. However, hackers can get into unsecured email servers pretty easily. They may even be able to intercept it while it’s in transit.
With end-to-end encryption, the message is scrambled while it’s being sent and when it’s just sitting there waiting to be read. Typically, business associates and smaller covered entities will utilize secured email service providers to ensure compliance. However, you can also set up your own in-house system.
It’s not uncommon for people to forget about their phones. We can use smartphones to access our email, view files, and even browse through remote hard drives. Banning smartphones from your business entirely isn’t realistic. So, it’s important to make sure that the gadgets are all protected.
Smartphones are usually deemed as an “addressable” requirement rather than a “required” one. With an “addressable” requirement, protective measures don’t have to be taken if there’s another security system in place that covers the device. This could include powerful firewalls and other property-wide security techniques.
With that said, phones can communicate with both Wi-Fi and cellular connection, making it nearly impossible to create that secondary measure. As a result, you’re going to need to get a bit more creative with protecting PHI. Many business associates and covered entities take advantage of secured messaging systems. Essentially, they’re standalone apps that encrypt messages and files on both ends.
It doesn’t matter what kind of work your company does. If you’re a business associate that handles PHI, you absolutely need encryption on your hard drives, phones, and email servers. We can’t stress the importance of cybersecurity enough. Forgoing proper security is not only irresponsible, but it violates federal law. Have a chat with your IT department/person or company to see if your business complies. If not, put it at the very top of your to-do list!