Inventory lists and network mapping, why they are so important!

First, it is required under HIPAA that medical organizations and business associates ensure the confidentiality, integrity, and availability of ePHI. Part of a HIPAA compliance program requires an entity to conduct a HIPAA risk analysis to determine where ePHI is located and how it is protected. It is critical that all organizations understand how data flows in and out of their systems as well has how business associates access your data. Risk management is the key to protecting your data.

Here is a starting point after your risk analysis:

  1. Create an inventory list. The list should include servers, computers, laptops, tablets, printers, scanners, fax servers/machines, and specialized equipment for your type of practice.
  2. Include what type of encryption you have implemented or what type of anti-virus and anti-malware is utilized. Also, think about devices that are not onsite, remote users, cloud servers, and offsite backups. If smartphones are used, add those as well. Even if they are not company owned, just make a note of that.
  3. The inventory list should also include software that is used to access or store ePHI. When the time comes to retire a device, this list could be used to determine how it is to be handled. For example, will it need to be destroyed or could be sanitized and reused?
  4. Be sure to include the operating systems on your devices. This will alert you when systems are at the end of life and need to be replaced.
  5. We also recommend adding assets that do not store or access ePHI, just in case they could be compromised and create a method of intrusion. This includes firewalls and routers.
  6. Next, create a diagram of all technology and how ePHI flows through your system. Hackers can gain access to your systems through your vendors. You may need the help from your IT company. Keep in mind when selecting an IT vendor, they MUST be well versed in healthcare. Your security is more complex than the average small business, not to mention the heavy fines should you suffer a data breach.
  7. When creating your network mapping, we suggest adding which devices store and/or access ePHI. Again, this is a visual reminder of how your data flows and can help you to understand how to protect your data. If possible, request a Visio Map from your IT vendor.

With all the data breaches that are happening, it is so important to know where your data is and how it is protected. Keeping up with your risk analysis and risk management plan demonstrates your on-going compliance efforts. This is a requirement under the HIPAA Security Rule. If you suffer from a data breach and you can provide documentation that you have reasonable and appropriate safeguards in place and that you have done the best you can to protect your data, more than likely you will not be fined.

If you would like more information, contact us at 877.659.2467 or complete the contact us form.

About Suze Shaffer

Suze Shaffer is the owner and president of Aris Medical Solutions. She specializes in HIPAA compliance, risk management, and cyber security. She believes that by educating her clients in understanding why and what needs to be done to protect their practice they have a better outcome.

Suze has been instrumental in helping clients nationwide with risk management, implementing privacy and security rule policies and procedures, and ultimately protecting patient data. She includes state and federal regulatory requirements to ensure clients are protected in all areas.

She has spoken at numerous conferences and functions. She continues to educate organizations how to minimize the risks of data breaches. HIPAA compliance is not an option, it is mandatory for every organization that comes in contact with protected health information to have reasonable and appropriate security measures in place. Unfortunately, most organizations don’t realize they are not compliant until they suffer a data breach or they are faced with an audit or investigation.

Did you know that the Office for Civil Rights (OCR) is the agency that investigates data breaches? Have you seen the heavy fines that have been imposed for non-compliance?

All 50 states now have their own set of privacy laws and the State's Attorney General may also investigate privacy violations!

HIPAA Fines assessed to small practices

August 15, 2020

Responsibilities of a HIPAA Compliance Officer

October 15, 2020
©2021 Aris Medical Solutions – HIPAA Risk Management | HIPAA Compliance Consultants | All Rights Reserved | Terms and Conditions | Privacy Policy
The content and images on this website is owned by Aris Medical Solutions and their owners. Do not copy any content or images without our consent.
Powered by Bandwise LLC