How and Why to Make Your Email Comply With the HIPAA Security Rule?

If you are working in the healthcare industry or are a patient, you’ll likely encounter numerous security policies and procedures.

One of the most important pieces of legislation that benefits both healthcare organizations and patients is the HIPAA Security Rule.

What is HIPAA and why is it important that your emails comply with it? Let’s find out.

What is HIPAA (Health Insurance Portability and Accountability Act)?

The HIPAA Security Rule was created by the US Department of Health and Human Services as a set of standards that serve to improve the security of ePHI and their confidentiality, integrity and availability both in rest and in transit.

ePHI stands for “Electronic Protected Health Information” and they cover anything that could potentially identify a patient, such as:

  1. Their name;
  2. Birthdate;
  3. Address;
  4. Phone number;
  5. Email or IP;
  6. SSID, medical account or another identifying number;
  7. Photo, fingerprint or another physical identity information.

HIPAA was first introduced back in 1996 with the idea to address the problem of insurance coverage for individuals between jobs, who would otherwise run the risk of losing insurance coverage when between jobs.

From there, HIPAA has expanded, but the standards have mostly been the same since they were first published in 2003, though they were updated in the HITECH Act of 2009 which was applied in the 2013 Omnibus Final Rule.

Physical, Technical and Administrative Safeguards

The HIPAA Security Rule main task is to implement three types of safeguards:

  1. Physical;
  2. Technical;
  3. Administrative.

These three were developed to assist Covered Entities (CE) in identifying and protecting ePHI against reasonably anticipated threats and unauthorized disclosure.

It’s very important to understand all three types in order to fully grasp HIPAA at all, so let’s do that.

Physical Safeguards

Physical safeguards deal with the physical security of the facility where the ePHI is stored.

These are split into four standards:

  1. Facility access controls – Who can access the facility?
  2. Workstation use – Who can use the workstation?
  3. Workstation security – How secure is the workstation from unauthorized access and other threats?
  4. Device and media controls – How the device is used and how ePHI is removed and destroyed once the device is no longer needed?

Technical Safeguards

The next set of safeguards are technical.

These are concerned with placing audit controls and introducing measures to limit access to ePHI where that is necessary.

In addition, they deal with protecting ePHI in transit (email, SMS, IM).

As such, technical safeguards include these key elements:

  1. Access controls – Who is authorized to access ePHI or the systems used to create, store, maintain and transport them?;
  2. Audit controls – These deal with mechanisms for recording ePHI activity and controlling who can access and monitor logs;
  3. Integrity controls – Are necessary to prevent unauthorized change or destruction of ePHI;
  4. Authentication – Verify the identity before allowing access to ePHI;
  5. Transmission security – Prevent unauthorized access or changing ePHI while in transit.

Administrative Safeguards

Finally, the third set of safeguards HIPAA is concerned with are administrative.

These ensure that ePHI are secure and in compliance with the HIPAA Security Rule.

In essence, administrative safeguards deal with:

  1. Establishing the security management processes to protect ePHI – Typically from data breaches and other security violations, as well as introducing risk analysis and management process, sanctions and reviewing information systems activity;
  2. Appointing a HIPAA Privacy Officer – This is the person who will be responsible for HIPAA compliance;
  3. Workforce security – These are the policies and procedures that ensure only authorized individuals can access ePHI;
  4. Information access management – These policies and procedures are in place to ensure that only authorized personnel can access the information systems;
  5. Security awareness and training – Train workforce members to better recognize security threats (for instance, an email-based phishing attack);
  6. Security incident procedures – Ensure a fast response in case of a security violation;
  7. Contingency plan – Deal with security policies and procedures in case of natural disasters like earthquakes, fires and floods or other emergencies;
  8. Evaluation – Routine evaluations of security (technical and non-technical).

Think of your FHIR server as the control center for healthcare data sharing. It’s where important patient info flows through, so keeping it secure is a top priority to safeguard electronic patient data (ePHI). FHIR servers play a critical role in making sure healthcare data is exchanged safely, a key part of HIPAA compliance.

But here’s the thing, you can’t just set it and forget it. Technology keeps changing, and so do the tricks that cyber threats use. So, it’s crucial to keep your FHIR server’s security measures up to date. Staying current ensures your server can fend off the latest security challenges.

Why is HIPAA Important to Protect Your Health Information?

HIPAA is not only important for patients, but healthcare providers as well.

Why?

For patients, HIPAA ensures that everyone from healthcare providers themselves to business associates of HIPAA-covered entities enforce the safeguards that will protect their individually identifiable health information.

In addition, HIPAA enables patients to obtain copies and records of their health information.

This is important for two reasons:

  1. First, patients can check their health records for mistakes and correct them;
  2. Second, HIPAA allows patients to pass on this information to a new health care provider, who then can then make informed decisions about their patients based on their health history.

On the other hand, HIPAA is also important for healthcare institutions, because it serves to improve their efficiency by moving from paper to electronic records and ensure that these records are safely shared.

Who is Responsible for Enforcing the HIPAA Security Rule?

As with any other legislation, someone must be responsible for HIPAA Compliance as well.

So who is responsible for enforcing the HIPAA security rule?

The job of the HIPAA PO is to:

The primary enforcer of HIPPA is the Department of Health and Human Services’ Office for Civil Rights (OCR).

Other entities that have some (albeit smaller) powers in enforcing HIPAA Rules are the state attorneys general, the Food and Drug Commission (FDA), the Federal Communication Commission (FCC) and the Center for Medicare and Medicaid Services (CMS).

The OCR is primarily responsible for investigating data breaches that covered entities and business associates report. Normally, this happens when the breach impacts over 500 people, though the OCR can also investigate smaller breaches.

Furthermore, OCR also investigates patient and employee complaints of HIPAA infringements by covered entities and determines whether the CE has violated the HIPAA Privacy, Security and Breach Notification Rules.

What happens when the OCR finds that the CE has violated HIPAA Rules?

If this happens, the OCR can take several actions, depending on the severity of the offense.

For minor HIPAA offenses, perhaps caused by misinterpreting the HIPAA Rules, the OCR might give the covered entity “a pass”, so to speak, as long as it’s their first infraction.

However, if the CE continues to make the same transgressions or the violation is particularly grievous and the CE failed to “reasonably” address it, then the OCR can impose certain financial penalties for failing HIPAA Compliance.

A HIPAA violation cuts to the core of why medical privacy matters. Beyond the legal ramifications, it represents a catastrophic failure to uphold the fundamental tenets of human dignity and personal autonomy that the doctor-patient relationship is built upon.

In an era where cybercriminals grow increasingly brazen, allowing Protected Health Information to slip through the cracks is tantamount to leaving the vault open – unforgivable negligence.

The most reputable healthcare institutions know that robust data security protocols are not an IT luxury, but an inviolable vow to safeguard each patient’s deepest vulnerabilities.

Ensuring such lapses never occur demands a profound cultural pivot – one where regulatory compliance is but the bare minimum, and true patient-centered ethics govern every decision.

Imagine a scenario in which a healthcare provider unknowingly transmits patient information to a public platform because their system lacks proper encryption measures.

How to solve such an upsetting problem? In such cases, the use of robust HIPAA software solutions could prevent the leak. This way, data can be handeled securely and meet regulatory standards.

HIPAA Violation Penalties have four tiers:

HIPAA Checklist

HIPAA security requirements are vague (this is intentional), but every CE and BA with access to ePHI must make sure that they put the physical, technical and administrative safeguards in place, have protected the ePHI integrity by following the HIPAA Privacy Rule and have followed the HIPAA Breach Notification Rule in case of a PHI breach.

As you can see, depending on the violation, whether the CE knew/should have known about it, or if it has made a reasonable effort to address it, the covered entity must pay anywhere from $100 to $1.5 million.

Naturally, this is not the type of money that you want to throw away just like that, so it’s important to perform the following checklist first to determine if your organization is subject to the HIPAA compliance guidelines:

  1. Which of the required audits and assessments apply to your organization?;
  2. Perform these audits and risk assessments and analyze and document the results;
  3. Document and put plans to address the issues in action and review and update at least once per year;
  4. Appoint a HIPAA Privacy Officer (also called a “Security Officer) and make sure that they perform regular HIPAA training for all workforce members;
  5. Assess whether Business Associates’ HIPAA Compliance and review BAAs (Business Associate’s Agreement) annually;
  6. Review processes to report breaches as well as how the breaches are reported to the OCR.

The HIPAA security rule, as we said, contains three sets of safeguards: administrative, physical and technical. Each, in turn, contains several implementation specifications that could either be required or addressable.

“Required” ones must be implemented, while covered entities can use an alternative or even not introduce the “alternative” ones.

We won’t go into the specifics of the implementation specifications (you can find the full explanation for each at the HIPAA Journal), so we’re just going to list them here.

Physical Safeguards

Administrative Safeguards

Technical Safeguards

Conclusion

With healthcare information selling for as much as $1,000 on the dark web, it’s vital to protect it against thieves and data breaches. Luckily, HIPAA was introduced as a measure to make health organizations more liable to keep their patient records safe from these.

Hopefully, this article has given you a better understanding of the HIPAA Security Rule and its importance.