HIPAA for Dummies

The Health Insurance Portability and Accountability Act (HIPAA) was created primarily to modernize the flow of healthcare information, stipulate how Personally Identifiable Information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and address limitations on healthcare insurance coverage – such as portability and the coverage of individuals with pre-existing conditions.
https://www.hipaajournal.com/hipaa-training-requirements/

1. HIPAA
FOR
DUMMIES
Everything you need to know

2. Health
Insurance
Portability and
Accountability
Act

3. 1.
Why was HIPAA
Created?

4. The purpose
●Modernize the flow of healthcare information

●Stipulate how Personally Identifiable Information
maintained by the healthcare and healthcare insurance
industries should be protected from fraud and theft

●Address limitations on healthcare insurance coverage –
such as portability and the coverage of individuals with
pre-existing conditions

5. 1996: The Secretary of Health and Human Services (HSS)
proposed standards that protect individual health information

1999: First set of proposed “Code Set” standards

2000: First proposals for the Privacy Rule

Nowadays: The scope of the Act has been extended to cover
Business Associates – third party service providers that perform
a function on behalf of a HIPAA-Covered Entity that involves the
use or disclosure of Protected Health Information (PHI).
The Timeline

6. The HIPAA regulations policies
U.S. Department
of Health &
Human Services’
Office for Civil
Rights (OCR)
State Attorney
Generals
Have the authority impose financial penalties on
Covered Entities and Business Associates for violations of
HIPAA

7. 2.
What is the
Purpose of
HIPAA?

8. 2004
HIPAA
Combat fraud
Combat abuse
1996
2007

9. We need to accommodate the
advances in technology and
changes to working practices

10. ●HIPAA is
technology-neutral

●HIPAA does not preempt
state law, except in
circumstances in which
the state´s privacy and
security regulations are
weaker than those in
HIPAA.
OCR guidance has gone digital
(Listserv application)
Frequent guidance issued by
OCR
New HIPAA Rules

Original language of
HIPAA
HIPAA in 2018

11. 3.
Understanding
HIPAA for
Dummies

12. Personal Identifiers
➔18 Personal Identifiers

➔Could reveal the identity of a person, their medical
history or payment records

➔Most commonly known as “Protected Health
Information” or “PHI”

➔Known as “ePHI” when stored or communicated
electronically

13. Names or part of names Any other unique identifying characteristic
Geographical identifiers Dates directly related to a person
Phone number details Fax number details
Details of Email addresses Social Security details
Medical record numbers Health insurance beneficiary numbers
Account details Certificate or license numbers
Vehicle license plate detailsDevice identifiers and serial numbers
Website URLs IP address details
Fingerprints, retinal and
voice prints
Complete face or any comparable
photographic images

14. Personal
Identifiers
Name or
part of
name
Phone
number
details
Geographical
identifiers
Details of
Email
addresses
Dates
directly
related to
a person
Medical
record
numbers
Certificate
or license
numbers
Website
URLs
Fingerprints,
retinal and
voice prints
IP
address
details
Social
Security
details
Vehicle
license
plate
details
Any other
unique
identifying
characteristic

Account
details
Health
insurance
beneficiary
numbers
Complete
face or any
comparable
photographic
images
Device
identifiers
and serial
numbers
Fax
number
details

15. The main takeaway for HIPAA compliance is
that any company or individual that comes
into contact with PHI must enact and enforce
appropriate policies, procedures and
safeguards to protect data.

16. Violations of HIPAA often result
from the following:
●Lack of adequate risk analyses
●Lack of comprehensive employee training
●Inadequate Business Associate Agreements
●Inappropriate disclosures of PHI
●Ignorance of the minimum necessary rule
●Failure to report breaches within the prescribed timeframe

17. OCR may refrain from imposing a
significant financial penalty on a
Covered Entity if the offence has
not resulted in the unauthorized
disclosure of PHI
Accidental offences
It is likely a course of
“corrective action” will be
required.
OCR does not consider
ignorance an adequate
excuse for HIPAA violations

18. 4.
Who does
HIPAA apply
to?

19. Who does HIPAA apply to?
●“HIPAA Covered Entities” (Practically all health plans,
healthcare clearinghouses, healthcare suppliers,
endorsed sponsors of the Medicare prescription drug
discount card)

●Hybrid entities (employers who use schemes such as
the Employee Assistance Program (EAP)

●Business Associates - BA (entities who supply
services and perform certain functions for a Covered
Entities, during which they have access to PHI)

20. 5.
HIPAA Rules
Explained

21. Enforcement Rule 05
Lays out how any resulting
investigations are carried out.
Determines appropriate fines
Omnibus Rule 04
Activated HIPAA-related changes
that had been part of HITECH
Breach notification
Rule
03
The Department of Health and
Human Services must be notified if a
data breach has been discovered
HIPAA Privacy
Rule
01
Dictates how, when and under
what circumstances PHI can be
disclosed.
02
Sets the minimum standards to
safeguard ePHI
HIPAA Security
Rule

22. 6.
The Necessary and
Addressable
Security Measures
of HIPAA

23. Required or addressable security measures?
Practically every safeguard of
HIPAA is “required” unless there
is a justifiable rationale not to
implement the safeguard

24. Example where an addressable safeguard
might be not required:
Email encryption
Emails containing PHI only have to be encrypted
if they are shared beyond a firewalled, internal
server.

If a healthcare group only uses email as an
internal form of communication – or has an
authorization from a patient to send their
information unencrypted – there is no need
to adapt this addressable safeguard.

25. 7.
HIPAA
Encryption
Requirements

26. PasswordEncryption
ePHI unreadable and undecipherable
▸Data can only be read to a key or code is applied
to decrypt the data.



Data encryption is mentioned in the HIPAA Security Rule,
but is only an addressable specification.

27. PasswordEncryption
▸If the decision is taken to use encryption :
The National Institute of Standards and Technology
(NIST) recommends Advanced Encryption Standard
(AES) 128, 192 or 256-bit encryption, OpenPGP, and
S / MIME.

▸If the decision is taken not to use encryption:
An alternative may be used in its place, provided it
is reasonable and appropriate and provides an
equivalent level of protection

28. 8.
HIPAA
Password
Requirements

29. Even though password requirements are not
detailed in HIPAA, HIPAA covered entities should
develop policies covering the creation of
passwords and base those policies on current
best practices.

It is strongly recommended that healthcare
organizations follow the advice of NIST when
creating password policies.

30. Password requirements : advice of NIST
▸A minimum of 8 characters up to 64 characters, with
passphrases – memorized secrets – longer than
standard passwords.
▸No password hints storage
▸Designed to prevent commonly used weak passwords
from being set
▸There is no need to change passwords frequently
▸Multi-factor authentication should be implemented
▸NIST recommends salting and hashing stored
passwords using a one-way key derivation function

31. 9.
HIPAA Record
Retention
Requirements

32. HIPAA Record Retention Requirements
There are no HIPAA record retention
requirements as far as medical records are
concerned but medical record retention
requirements are covered by state laws. Data
retention policies must therefore be developed
accordingly.


When medical records are retained,
they must be kept secure at all times.

33. 10.
HIPAA
Violation
Reporting
Requirements

34. HIPAA Violation Reporting
▸Notifications must be issued to patients/health plan
members and to the HHS’ Secretary within 60 days
after the discovery of a breach.

▸The individual and media notices should include a
brief description of the security breach, the types of
information exposed, a brief description of what is
being done by the breached entity to mitigate harm
and prevent future breaches

▸A copy of the breach notices should be retained

35. 10.
Top 10 most
Common HIPAA
Violations

36. Risk Analysis Failures
Failure to perform a comprehensive,
organization-wide risk analysis.
1

37. Risk Management
Failures
Risk management is critical to the security
of ePHI and PHI and is a fundamental
requirement of the HIPAA Security Rule.
2

38. Lack of Encryption or
Alternative Safeguards
3

39. Security Awareness
Training Failures
HIPAA requires covered entities and
business associates to implement a
security awareness training program for all
members of the workforce.


4

40. Improper Disposal of PHI
When PHI or ePHI is no longer required it
must be disposed of securely in a manner
that ensures PHI is “unreadable,
indecipherable, and otherwise cannot be
reconstructed.”


5

41. Impermissible
Disclosures of PHI
An impermissible disclosure of PHI is a
disclosure not permitted under the HIPAA
Privacy Rule.


6

42. Failure to Adhere to the
Minimum Necessary
Standard
7

43. Failure to Provide
Patients with Copies of
PHI on Request
The Privacy Rule permits patients to access
and obtain copies of their protected health
information on request


8

44. Failure to Enter into A
Business Associate
Agreement
9

45. Failure to Issue Breach
Notifications Promptly
Breach notifications must be issued
without unreasonable delay and no later
than 60 days from the date of discovery of
the breach.


10

46. 11.
Explaining
HIPAA to
Patients

47. The best fashion to explain HIPAA to
patients is to put the relevant information
in the Privacy Policy, and then give the
patients a summary of what the policy
contains

48. 12.
Explaining
HIPAA to
Staff

49. In order to adhere with HIPAA, organizations must
compile privacy and security policies for their
employees, and a sanctions policy for staff
member who do not comply with the
requirements.

The best method of explaining HIPAA to
employees is in special compliance training
tutorials. Compliance training sessions should
be short and often.

50. If you are unsure about any element
of HIPAA, it is recommended you
seek professional help

51. HIPAA
FOR
DUMMIES
You now know everything!
https://www.hipaaguide.net/hipaa-for-dummies/