How Do You Manage HIPAA?:

A Complete HIPAA Compliance Overview

Table of Contents

No time to read?
Save our HIPAA compliance guide and read it later

(Valuable checklists included!)

While most healthcare professionals and stakeholders are aware of HIPAA, many do not fully appreciate the significance of this piece of legislation in their day-to-day operations, particularly in the area of security.

At the same time, there are very real consequences for organizations that compromise HIPAA standards. Procrastinating HIPAA compliance can be an expensive mistake. If your organization collects health information, getting compliant now will help you avoid penalties such as fines, legal fees, or harm to reputation.  

As organizations rely more heavily on electronic and online channels to gather, store, and share patient data, practicing HIPAA compliance becomes more complex. 

This page will walk you through the essentials of HIPAA, from general HIPAA compliance standards to what constitutes a HIPAA violation and how to prepare for a HIPAA audit.

First Things First — What is HIPAA?

HIPAA, or The Health Insurance Portability and Accountability Act, is a five-pronged piece of legislation intended to safeguard individuals’ personal health data and their access to health insurance. It is enforced by the US Department of Health and Human Services (HHS) and the Office of Civil Rights (OCR).

HIPAA is a five-pronged piece of legislation intended to safeguard individuals’ personal health data and their access to health insurance

When you hear healthcare providers or other non-insurance organizations talking about HIPAA compliance, they typically are referring to Title II. This is the set of standardized, national guidelines governing how organizations secure and share protected health information (PHI) or electronic protected health information (ePHI). (On this page, we’ll use both terms interchangeably.) The aim of Title II is to simplify healthcare administration while preventing fraud and abuse resulting from inappropriate use of PHI.

The aim of Title II is to simplify healthcare administration while preventing fraud and abuse resulting from inappropriate use of PHI.

HIPAA legislation is more than two decades old, but the application of HIPAA standards has changed as the infrastructure of the healthcare industry evolves. Furthermore, the regulations themselves have changed. There are now many provisions of HIPAA that relate specifically to the electronic storing and sharing of ePHI and new updates are expected to be proposed in the coming year. 


Securing ePHI becomes especially complex when this data is stored or shared in the cloud. Electronic tools like care management, self-service applications, and mobile health apps all increase the security risks facing health data. Because of this, an organization’s IT team should be a close partner in establishing and maintaining HIPAA security compliance. Particularly when using cloud services, your IT department needs to take specific steps to make your cloud environment HIPAA-compliant.

How important is HIPAA, really?

The short answer to that question is: extremely important. Patients entrust their healthcare provider or provider of other health services with some of their most sensitive personal data. HIPAA guidelines help those organizations maintain that trust and hold them accountable for how they handle patient data. When that data is misused, patients suffer. Furthermore, there are legal and financial consequences for organizations that fail to fully adhere to HIPAA compliance guidelines. 

If your organization or employee is found to be non-compliant at any point, you may face civil or criminal penalties from the federal government. Civil penalties apply when the OCR determines that the violation was not willful and can carry a fine of up to $25,000 per violation. The criminal penalty for a willful HIPAA violation by an individual is a fine of up to $250,000 and/or a prison term of between 1 and 10 years per violation. In either case, non-compliant organizations may also face litigation by the patient and reputational damage. 

Often, if an organization has mishandled or failed to protect data in one instance, it has made the same errors across multiple cases. If suspected of breaching HIPAA, an organization will be subjected to a HIPAA audit that can uncover other instances of negligence and result in additional per-violation fines. (You can find detailed information on how to pass a HIPAA audit further down the page.)

THE CRIMINAL PENALTY FOR A WILLFUL HIPAA VIOLATION

The criminal penalty for a willful HIPAA violation by an individual is a fine of up to $250,000 and/or a prison term of between 1 and 10 years per violation.

The largest fines handed down for HIPAA violations to date have been for multiple millions of dollars. In 2019 alone, 4 major healthcare organizations — Texas Health and Human Services Commission, Texas Health and Human Services Commission, Touchstone Medical Imaging, and Cottage Health — were fined a total of $7.7 million for HIPAA violations including lack of risk assessment and lack of access control.

While an organization may not set out to intentionally misuse or abuse patient data, ignorance is not an acceptable excuse. Furthermore, organizations are held accountable not just for how they use and protect PHI but also for how any partners or contractors use the data provided to them by the organization. It is, therefore, essential that your organization agrees with any third-party entities on a HIPAA-compliant data governance strategy and cooperates only with trusted partners. Additionally, organizations should have an executed business associate agreement (BAA) in place with all 3rd parties storing, processing, and/or managing PHI.

Essential that your organization agrees with any third-party entities on a HIPAA-compliant data governance strategy and cooperates only with trusted partners.

The vast majority of HIPAA violations occur through security breaches via theft, loss of portable devices, or hacking. Your organization’s security policy is, one of the most important factors in how successful it will be in avoiding HIPAA breaches. Implementing strict policies for how devices and networks are secured is essential for HIPAA compliance, as is securing all data within your cloud environment.

What Is HIPAA Compliance?

“HIPAA compliance” means adherence to HIPAA standards with regard to how protected health information is stored and shared. Any discussion of HIPAA compliance, of course, has to start by answering the question, “What is protected health information”?

Protected health information, or PHI for short, is patient data that is protected by HIPAA. PHI that is electronically collected, stored, or shared is called ePHI. On this page, we will use the acronym PHI to refer to both forms of protected health information. 

HIPAA legislation defines PHI as data relating to the past, present, or future health of an individual and that can be used to identify that individual. Examples of PHI are:

PROTECTED HEALTH INFORMATION

or PHI for short, is patient data that is protected by HIPAA

 

ePHI

PHI that is electronically collected, stored, or shared

Date of birth, date of admission, date of discharge, and other key, individual dates

Biometric identifiers like finger or voiceprints

Device serial numbers and identifiers

Diagnosis and treatment details

Account number, medical records numbers, driver’s license numbers, social security numbers, health plan beneficiary numbers, and certificate numbers

Any other unique number that can be used to identify the individual

IP address numbers and URLs

Names of relatives

Email addresses and phone numbers

Photographs of patient or user

Geographical information, excluding the first three digits of a zip code (if the combined population of localities sharing these first three digits is over 20,000 people)

PHI can be found in many places — internal communications between medical staff, emails from patients, billing information, and appointment scheduling tools are chock full of it.

All of this information can be used by healthcare professionals to identify an individual and determine the appropriate care. Failure to adequately secure this information compromises patients’ privacy and exposes them to risks like identity theft and blackmail.

Failure to adequately secure this information compromises patients’ privacy and exposes them to risks like identity theft and blackmail.

It may come as a relief to learn that not all data that passes between patients and providers is considered PHI. Employment records of a covered entity, for example, are not considered to be PHI; nor are Family Educational Rights and Privacy Act (FERPA) records. 

Remember, the distinguishing feature of PHI is that it is personally identifiable information. Data like number of steps or calories burned, such as may be collected from fitness apps, is not included as PHI because it cannot be used to identify an individual. Additionally, health data that does not contain personally identifiable information (PII) like blood sugar readings or heart rate is not considered PHI.

Does my organization handle PHI?

If you’re wondering whether or not your organization handles PHI, there is a simple test: if your device or application (including organization computers or mobile app) stores, records, or transmits health information that can be used to identify an individual, then you’re dealing with PHI and need to practice HIPAA compliance.

If your device or application (including organization computers or mobile app) stores, records, or transmits health information that can be used to identify an individual, then you’re dealing with PHI and need o practice HIPAA compliance.

A second key term for HIPAA compliance is “covered entity”. HIPAA legislation uses the phrase “covered entities” to refer to any organization that collects, transmits, or stores any PHI via products or services.

So how does your organization stay HIPAA compliant?

COVERED ENTITY

It’s any organization that collects, transmits, or stores any PHI via products or services.

Get Your Free HIPAA Compliance Guide Now

Download our HIPAA compliance guide with checklists to track HIPAA compliance!

Staying HIPAA Compliant in the Digital Age — What Is the HIPAA Security Rule?

The channels through which PHI is stored and shared have changed significantly since the Health Insurance Portability and Accountability Act was passed in 1996. Instead of tucking away patient records in filing cabinets, most healthcare organizations store PHI on computer or cloud databases and interact with that data digitally. In response, Health Information Technology for Economic and Clinical Health (HITECH) developed revisions that limit the way in which organizations can legally share patient information. It also outlined specific technical requirements for how to store PHI.

The HIPAA Security Rule is an amendment to HIPAA law that addresses electronic protected health information (ePHI). The requirements of this amendment are what you need to pay attention to when making a plan for HIPAA IT compliance. The HIPAA Security Rule outlines three main categories of HIPAA safeguards for ePHI:

Technical

Technical

Physical

Physical

Administrative

Administrative

Covered entities must fulfill the requirements for all three categories in order to fulfill HIPAA obligations.

HIPAA Requirements — Get HIPAA Compliant in 9 Steps

Getting and keeping your organization HIPAA compliant across all the digital channels and platforms it uses can be achieved in 9 steps.

01

Outline Your Organization’s Policies

The first step in HIPAA compliance is establishing an organization-wide set of policies addressing privacy and security. Policies must be documented and provide clear steps for how to respond to a breach event. They should also outline disciplinary measures to be taken against employees who break the privacy policy.

The first half of 2018 alone saw 1.12 million health records exposed in a total of 110 breaches.

Having a breach protocol in place in order to respond if and when a breach occurs is vital for HIPAA compliance.

Organizations, of course, strive to reduce the likelihood of any data being exposed through a security breach. However, security is never guaranteed.

A HIPAA-compliant security brief protocol should outline:

01

When to report

04

Findings of the investigation, including identification of the root cause

02

Who to inform

05

Procedure for mitigation of the breach

03

Investigation of the breach

02

Appoint HIPAA Compliance Officers

HIPAA requires every organization to have a designated individual to supervise developing and implementing its HIPAA compliance program. Typically, organizations have both a HIPAA Privacy Officer and a HIPAA Security Officer. Smaller organizations may combine these roles. 

A HIPAA Privacy Officer is the person who will be accountable for developing and implementing security policies for correctly handling PHI according to HIPAA standards. This includes:

HIPAA PRIVACY OFFICER

It’s the person who will be accountable for developing and implementing security policies for correctly handling PHI according to HIPAA standards.

Conducting security risk assessments

Investigating possible breaches

Responding to breaches if they occur

Ensuring that patients’ rights are protected as outlined in state and federal laws

Additionally, the HIPAA Privacy Officer typically oversees employee privacy and security trainings.

The duties of a HIPAA Security Officer are similar to those of a Privacy Officer, although the focus of the Security Officer should be specifically on upholding the Security Rule and often involves the more technical aspects of the business. This rule requires covered entities to implement appropriate administrative, physical and technical safeguards to protect ePHI.

03

Conduct A Security Risk Assessment

Organizations are not always aware of the security risks facing them. Conducting risk assessments regularly helps pinpoint weaknesses before hackers or other cybercriminals exploit them. Organizations should be proactively adjusting their policies and practices in response to security risk assessment findings.

HIPAA requires that organizations conduct a HIPAA risk assessment at a minimum of once a year.

04

Establish Email and Smartphone Messaging Guidelines

Most organizations digitally communicate important patient information, including PHI, both internally and with patients. Under HIPAA, this is an acceptable practice as long as the platforms in use meet specific security standards. 

First, let’s look at email. In order to ensure accountability for communication of PHI and to prevent PHI from being compromised during transit or at rest, HIPAA requires certain controls governing email communications to be put in place:

Use of a secure server

Use of a secure server

Access controls

Access controls

Audit controls

Audit controls

Integrity controls

Integrity controls

ID authentication

ID authentication

Transmission security

Transmission security

Texting is more strictly controlled. Generally, it is a violation of HIPAA to communicate PHI via text message except when using an application specifically designed to meet HIPAA compliance standards. These applications are encrypted and store photos, other images, and messages in-app rather than on the physician’s device.

 

It is important to keep these requirements in mind when considering all the devices and digital communications involved in your organization. If you have a Bring Your Own Device (BYOD) program or employees take work home with them, then your Privacy Officer or Security Officer needs to ensure that their devices are equipped with the appropriate applications, permissions, and encryptions. Outlining clear, written policies for how employees should handle PHI on their devices is required to be HIPAA compliant and will help avoid accidental HIPAA violations.

 

An example of an employee policy for storing PHI could be:

“Never store unencrypted files containing protected health information (PHI) regulated by HIPAA on your desktop, laptop, USB flash drive, tablet, smartphone, or other mobile devices. Encrypted files can be stored on these devices only after your senior executive officer has given prior written approval. Any device holding PHI must have full-disk encryption to ensure that PHI will be protected at rest. If you are not sure if your device is appropriately encrypted, contact the HIPAA Security Officer.”

05

Train
All Employees

While encryption and other security measures are your first layer of protection for PHI, your employees are the gatekeepers for that data. Any PHI protection plan is incomplete without employee education; in fact, HIPAA requires it.

HIPAA training should inform all relevant staff of your organization’s privacy and security practices for handling PHI. HIPAA education should also be a mandatory part of new employee onboarding. These trainings should ensure that each person clearly understands his or her obligations under HIPAA, as well as the consequences for violating HIPAA compliance. 

HIPAA law requires covered entities to hold HIPAA trainings only when updates to the law are made. However, technology and individuals’ use of it changes constantly (and memories are not perfect). Best practice is holding refresher trainings on a yearly or bi-yearly basis, as well as obligatory trainings for new hires.

06

Health Providers
Send Privacy Policy Notices

All covered entities are required to send patients a Notice of Privacy Practices (NPP). This document should inform patients in clear, easy-to-understand language of their individual rights regarding PHI and of the privacy practices of your organization. Whenever your organization makes a change in its privacy practices, patients must be informed of them. 

NPPs must be available online and in written form. Additionally, covered entities are required to obtain each patient’s signature on the NPP confirming that they have read it and consent to their PHI being used in the ways denoted in the document. You can find NPP templates from the US Department of Health and Human Services here.

NPP

This document should inform patients in clear, easy-to-understand language of their individual rights regarding PHI and of the privacy practices of your organization

07

Sign a Business Associate Agreement with Business Partners and Third Parties

Your organization likely shares PHI with third parties like cloud servers, backup storage vendors, email encryption providers, or IT security vendors. Under HIPAA, your responsibilities for securing PHI extend to ensuring appropriate use of PHI by third parties, as well. Because of this, a Business Associate Agreement (BAA) is a key component of HIPAA compliance. 

This document establishes each party’s obligations to uphold HIPAA law and protects you, as a covered entity, from prosecution for misuse of PHI by a business associate. Teams may look at several HIPAA cloud solutions, when building a HIPAA compliant IT infrastructure. You can find more detailed information on who needs a Business Associate Agreement further down on this page.

08

Establish Technical
Safeguards

Technical safeguards help protect PHI by regulating access to that data by individuals within your organization and anticipating outside security breaches. Encryption is an essential technical safeguard. Encrypting records once they leave your own firewall means that data will be unreadable to an unauthorized third party.

Other HIPAA-required technical safeguards are:

ACCESS CONTROL

Establish who has access privileges to PHI and assign each accessor a unique name and password. This both reduces the risk of misuse of PHI by an unauthorized individual and ensures that in case misuse occurs, your organization can identify the individual behind it. 

Additionally, passwords used to access PHI must be secured and a protocol for creating and changing passwords needs to be put in place. HIPAA law does not specify what those protocols should be. Current best practice is implementing a 2-factor authentication system for logging in and changing passwords, while some experts recommend changing passwords every 60 to 90 days.

AUDIT CONTROLS

These controls allow you to monitor who has accessed PHI and what actions the accessing individual took. Audit controls let organizations ensure the integrity of PHI in real-time and provide a record of use in case of suspected misuse.

AUTO LOG-OFF

This helps prevent authorized individuals from inadvertently allowing others to access PHI, particularly in the event of loss or theft of a device containing PHI.

Additionally, standard operating procedures (SOPs) and configuration management for cloud services are an important part of HIPAA compliance. Defining a predictable configuration process makes your cloud security environment more robust by reducing human error. SOPs are necessary because it is typically the organization’s responsibility to implement necessary security controls for each individual service.

09

Implement
Your Policies

Once your organization has outlined its policies, educated its employees, and put the supporting infrastructure in place, you are ready to implement your organizational policies. These policies should outline standard operating procedures for implementing and maintaining technical security controls. Policies should also be built around HIPAA-eligible cloud services, and additional administrative security configurations.

HIPAA Business Associate Agreement: Who Needs One?

HIPAA requires that all covered entities sign a Business Associate Agreements (BAA), or Business Associate Contract, with any business associates that may come into contact with PHI. Signing a BAA is a key step in HIPAA compliance. This document specifies how PHI is being safeguarded and defines responsibilities for both parties.

Software vendors are typically required to enter into a BAA when working with health providers and health systems.

BUSINESS ASSOCIATE AGREEMENTS (BAA)

This document specifies how PHI is being safeguarded and defines responsibilities for both parties.

In the context of PHI, HIPAA legislation uses the phrase “covered entities” to refer to any organization that collects, transmits, or stores any protected health information about individuals via products or services.

Examples of covered entities include:

State and local government agencies that are responsible for administering health care

State and local government income assistance and human service agencies

Hospitals and Medicaid and Medicare providers

Family health centers

Physicians and other healthcare professionals in private practice with patients assisted by Medicaid

Community mental health centers

Alcohol and drug treatment centers

Nursing homes and Foster care homes

Public and private adoption and foster care agencies

Daycare centers and Senior citizen centers

Health applications that are also business associates of the covered entity or that are operated by the covered entity

Nutrition programs

Any entity established under the Affordable Care Act

What happens if my business associate misuses PHI?

The Omnibus Rule, established in 2013, significantly expands potential liability for covered entities. Firstly, it extends the category of “business associate” to include subcontractors of business associates. Secondly, it holds covered entities responsible for acts or omissions by their business associates that compromise PHI if a BAA was not already in place at the time of the breach.

If your organization entrusts any PHI to a third party such as a cloud server, you are required by law to have a BAA.

Common examples of HIPAA-covered business associates include:

Cloud providers (such as AWS, Google, and Microsoft Azure)

Data conversion, de-identification, and data analysis service providers

Medical transcription companies and answering services

File sharing vendor

Backup storage

Email encryption vendor

Patient safety or accreditation organizations

Companies involved in claims processing, repricing, or collections (e.g., medical billing companies)

Health information exchanges (HIEs), e-prescribing gateways, and other HIOs

Third-party administrators and pharmacy benefit managers

A BAA outlines the responsibilities of both parties in their handling of PHI according to HIPAA standards. This document serves as protection for your organization. It gives you the right to take legal action against a business associate that breaks the BAA and can protect you from prosecution if a business associate violates HIPAA regulations without your knowledge. Not signing a BAA with third-party companies means that your organization can be prosecuted for misuse of data by any of those third parties.

What To Do In Case Of A HIPAA Audit?

The HHS Office for Civil Rights (OCR) regularly conducts HIPAA audits of healthcare organizations. Their purpose is to confirm the compliance of covered entities and their business associates with the HIPAA Privacy, Security, and Breach Notification Rules. Organizations that have had a security breach may be subject to a HIPAA audit and potential monetary penalties. The Audit Protocol was last updated in July 2018.

How to prepare for a HIPAA audit is an important question, and its answer starts with another question — when to prepare for a HIPAA audit? 

Getting ready for a HIPAA audit starts on Day 1. If your organization is selected to be audited, you will need to submit certain HIPAA forms and documentation to the OCR that demonstrate how your organization was, is, and will be keeping itself HIPAA compliant. These documents should outline the development and implementation of your organization’s HIPAA compliance program. Because of this, it is very difficult and time-consuming to prepare for a HIPAA audit retroactively. 

The Phase 2 HIPAA Audit Program assesses an organization and its business associates for both HIPAA Privacy Rule compliance and HIPAA Security Rule compliance. If audited, you will be asked to provide full documentation of how your organization ensures its workforce and business associates implement HIPAA standards as they come into contact with PHI. 

You will also need to provide documentation demonstrating how your organization maintains HIPAA network compliance and secures PHI across information systems (hardware, software, information, data, applications, communications, and people). This category includes backup servers and cloud providers like AWS. (For more on AWS compliance, consult this article.)

Before getting into the specific documents required (there are many), it is helpful to consider the broader questions these documents are meant to answer:

How do we maintain a strong general security stance?

Where are our vulnerabilities and how are we addressing them?

How secure are our workstations and facilities?

Do our employees and BAs understand how to protect PHI?

How do we ensure HIPAA compliance within our BYOD program?

What are our future goals and milestones?

Your HIPAA auditor will ask you for documents that address these questions and tell the story of your organization’s efforts and success in safeguarding PHI. Specifically, you will need the following documents to prove Privacy Rule compliance:

Copies of business associate contracts

Business associate compliance assurances

Patient confidentiality forms

Confidential communications requests

Notice of Privacy Practices

Disclosure agreements

Whistleblower policies

Work desk procedures

HIPAA training logs

Procedures and policies for PHI use

Patient authorization forms (including patient intake consent forms)

A comprehensive list of people with access to the facility


You will need the following documents to prove Security Rule compliance:

HIPAA Risk Management Plan

HIPAA Risk Analysis

PHI location documentation (e.g., a PHI map)

How you’ve eliminated third party risks

How the environment is coping with identified vulnerabilities

Incident response plan/breach response plan

Explanation of unimplemented addressable implementation standards

Compliant processes and procedures

List of authorized wireless access points

List of all devices including physical location, serial numbers, and make/model

Electronic commerce agreements

Trading partner security requirements

Lists of vendors​

Policies and procedures for the Security Rule, Privacy Rule, and Breach Notification Rule

HIPAA documentation is an ongoing process. The best way to prepare for (and pass!) a HIPAA audit is to treat documentation and revision as a regular task. Your organization’s HIPAA Compliance Officer is central in maintaining this database of information.

Final Thoughts

Getting HIPAA compliant does not happen in a day. HIPAA requirements cover organizations’ physical, technical, and administrative policies and procedures. In order to get and keep your organization HIPAA-compliant, you will need the informed cooperation of your workforce and business associates.

It is especially important to establish HIPAA compliance in any of the cloud platforms your organization uses.

Even in HIPAA-approved cloud platforms, like AWS, you will need to set the appropriate controls and policies for your unique environment.

If you’re new to HIPAA compliance, want to deepen your understanding, or need to configure your cloud environment, the Dash Knowledge Center and Blog are great places to start.