First, it is required under HIPAA that medical organizations and business associates ensure the confidentiality, integrity, and availability of ePHI. Part of a HIPAA compliance program requires an entity to conduct a HIPAA risk analysis to determine where ePHI is located and how it is protected. It is critical that all organizations understand how data flows in and out of their systems as well has how business associates access your data. Risk management is the key to protecting your data.
Here is a starting point after your risk analysis:
- Create an inventory list. The list should include servers, computers, laptops, tablets, printers, scanners, fax servers/machines, and specialized equipment for your type of practice.
- Include what type of encryption you have implemented or what type of anti-virus and anti-malware is utilized. Also, think about devices that are not onsite, remote users, cloud servers, and offsite backups. If smartphones are used, add those as well. Even if they are not company owned, just make a note of that.
- The inventory list should also include software that is used to access or store ePHI. When the time comes to retire a device, this list could be used to determine how it is to be handled. For example, will it need to be destroyed or could be sanitized and reused?
- Be sure to include the operating systems on your devices. This will alert you when systems are at the end of life and need to be replaced.
- We also recommend adding assets that do not store or access ePHI, just in case they could be compromised and create a method of intrusion. This includes firewalls and routers.
- Next, create a diagram of all technology and how ePHI flows through your system. Hackers can gain access to your systems through your vendors. You may need the help from your IT company. Keep in mind when selecting an IT vendor, they MUST be well versed in healthcare. Your security is more complex than the average small business, not to mention the heavy fines should you suffer a data breach.
- When creating your network mapping, we suggest adding which devices store and/or access ePHI. Again, this is a visual reminder of how your data flows and can help you to understand how to protect your data. If possible, request a Visio Map from your IT vendor.
With all the data breaches that are happening, it is so important to know where your data is and how it is protected. Keeping up with your risk analysis and risk management plan demonstrates your on-going compliance efforts. This is a requirement under the HIPAA Security Rule. If you suffer from a data breach and you can provide documentation that you have reasonable and appropriate safeguards in place and that you have done the best you can to protect your data, more than likely you will not be fined.
To find out more about how our automated HIPAA compliance platform can help your organization click here:
https://arismedicalsolutions.com/aris-hipaa-service-automated-platform/
Or to schedule a demo click the contact us tab and scroll down.
“Simplifying HIPAA through Automation, Education, and Support”
