For a healthcare organization subject to HIPAA, technology is one part of a broader compliance program. The Security Rule addresses administrative, physical and technical safeguards for electronic protected health information. IT support can implement and document controls; buying software or hiring a provider does not establish compliance by itself. Read the HHS Security Rule summary.
Begin with the information and its path
List the systems that create, receive, maintain or transmit electronic protected health information: clinical applications, email, shared files, scanners, backups and remote access. Include devices outside the main office and identify the people and vendors involved.
HHS’s risk analysis guidance is a starting point for evaluating threats and vulnerabilities in that environment. Keep the assessment connected to the actual systems and changes in the practice. See HHS guidance on risk analysis.
Translate the assessment into assigned work
- Access: define roles, review privileges and establish onboarding and departure processes.
- Devices: manage updates, physical handling, loss reporting and appropriate protection of stored information.
- Transmission: review approved ways to send records and configure the relevant security controls.
- Oversight: decide which events are logged, who reviews them and how a concern is escalated.
- Recovery: identify backup coverage and test restoration of a selected clinical workflow safely.
Review cloud and vendor responsibilities
Confirm applicable business associate arrangements and the division of responsibilities with the organization’s compliance advisers. A cloud provider’s safeguards do not remove the practice’s need to manage its own users, configuration and procedures. Read HHS guidance on cloud computing.
Prepare for change and interruption
Before a migration, new office or application upgrade, review data movement, access and downtime procedures. A practical acceptance check should involve an authorized staff member verifying the required workflow without exposing patient information in test records or general support notes.
Keep technical and compliance decisions connected
IT MGMT’s healthcare IT support can help maintain systems and document agreed technical work. The practice and its designated advisers determine its obligations and policies. Confirm the current rule and any finalized changes through HHS; a proposal or vendor checklist should not be treated as the law already in effect.
