 |
Home / Compliance / What is HIPAA Compliance?
Compliance guide
The four main HIPAA rules explained in plain words, and what they mean for your practice and your billing partner.
The Health Insurance Portability and Accountability Act (HIPAA) is the U.S. law that sets the rules for protecting patient health data. Any organization that handles protected health information (PHI) must put security measures in place and follow them consistently.
More health data is stored and shared electronically every year, and the risks have grown with it. That makes HIPAA compliance more important than ever. Health plans and providers keep adding online portals and apps, and each new tool must protect patient privacy.
HIPAA compliance is built around four main rules:
Sets national standards for how patients’ health information may be used and shared. It defines protected health information (PHI): any health information that can identify a patient and is held by a covered entity or its business associates. It also sets the limits on how that information may be used, disclosed and stored. PHI includes:
1. Records of a person’s past, present or future physical or mental health
2. Records of the care the patient has received
3. Records of past, present or future payment for that care.
Sets national standards for protecting electronic PHI (ePHI). The safeguards apply across the whole organization, covering people, processes, buildings and technology. They fall into three groups:
1. Administrative. Written policies and procedures, risk analysis and risk management, assigned security responsibilities, and workforce training.
2. Physical. Controls on access to buildings, workstations, servers, network equipment and storage media, so only authorized people can reach them.
3. Technical. Access controls, encryption, audit logs and secure transmission for the systems and devices that store or send ePHI.
Requires organizations to give notice when unsecured PHI is breached. No system is perfectly secure, so every organization needs a plan to inform affected patients, HHS and, for larger breaches, the media, explaining what happened and what people should do next.
Extended HIPAA’s requirements directly to business associates and their subcontractors, such as billing companies. Covered entities and their vendors must have proper business associate agreements in place and keep their risk assessments and compliance procedures up to date.
We sign a HIPAA Business Associate Agreement before we touch any patient data.
Every team member completes HIPAA training and follows written privacy procedures.
Work happens in your systems through secure, individual logins - no patient files on personal devices.
Staff see only the information they need for their task, and access is removed when no longer needed.
A BAA is a contract required by HIPAA between a healthcare provider and any vendor that handles protected health information. It sets out how the data must be protected.
Covered entities (healthcare providers, health plans and clearinghouses) and their business associates, such as billing companies.
Under the HIPAA Breach Notification Rule, affected individuals must be notified, and breaches are reported to HHS. Business associates must tell the covered entity without unreasonable delay.
Ask Us About Our Trial Offer