.png)
Note: This post was originally written and published in March 2020 but has been reviewed, revised, and updated by internal experts.
It can be difficult to translate vague, risk-focused HIPAA requirements into actionable controls and policies. What’s more, it takes significant time, money, and effort to become HIPAA-compliant.
Yet many HealthTech companies need HIPAA compliance to grow and thrive. Not only do you need to meet HIPAA requirements to handle certain types of data, but they can’t even dream of working with customers in the health industry without compliance; federal law (and the customers themselves) simply won’t allow it.
To help you start to navigate the complexity of HIPAA compliance, we mapped out the most important things you need to know. This resource explains why HIPAA is important for high-growth businesses, how much it costs, what’s involved, and what’s recommended for teams of all sizes pursuing compliance.
What Is HIPAA compliance, and does my company need it?
Before we dive into HIPAA requirements, let’s walk through what HIPAA is and why you should care about it.
What Is HIPAA?
Doctors’ offices, health insurers, and the tech companies that serve them need to meet federal regulatory compliance rules defined by the Health Insurance Portability and Accountability Act (HIPAA). Among many other things, HIPAA sets national security and privacy standards for certain types of health information and is enforced by the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services.
However, HIPAA was passed in 1996, at a time before smartphones and tech SMBs. It wasn’t written with today’s health data needs in mind. Since then, lawmakers have updated it several times to better align it with current issues facing the privacy and security of health information.
Does my company need to be HIPAA-compliant?
It depends on the type of business you are. For example, are you a covered entity or a business associate as defined by HIPAA.
Do you handle Protected Health Information (PHI)?
HIPAA Privacy Rule, according to the U.S. Department of Health and Human Services, states that: The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other individually identifiable health information (collectively defined as “protected health information”) and applies to health plans, healthcare clearinghouses, and those healthcare providers that conduct certain healthcare transactions electronically.
If your business handles patient records (past or present), payment information, or test results, chances are, you’re working with PHI.
On its own, health information (like a blood pressure reading) isn’t PHI. Neither is personal information like a name, phone number, or Social Security number. The data is contextual; it depends on where the information came from and how it’s being used or who is using it.
PHI can be a combination of health information and any identifier that could link that information to a specific person.
- Health information is data created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school (or university), or healthcare clearinghouse. It includes everything about a person’s past, current, and future health (diagnoses, health care coverage, payment for medical services). For example, patient or family medical history records, bills from a primary care physician, or lab results are all considered health information in the eyes of HIPAA.
- Identifiers, on the other hand, include any demographic information that could be used to identify an individual. HIPAA protects 19 identifiers, including names, phone numbers, email addresses, Social Security numbers, account numbers, license plate numbers, photos, fingerprints, genetic information, etc. Identifiers need to be protected only when combined with health information.
Do your customers need you to be HIPAA-compliant?
In many cases, your customers will need your company to comply with HIPAA in order to even consider working with you.
HIPAA applies to two types of organizations: covered entities and business associates.
- Covered entities are health plans, healthcare clearinghouses, or healthcare providers who transmit any health information in electronic form in connection with a transaction.
- Business associates are organizations or individuals who create, receive, maintain, or transmit protected health information on behalf of a covered entity. HR tech companies like WageWorks and Greenhouse may be considered business associates under HIPAA because they handle employee benefits information working with health plans. Something to note is that not all benefits information falls under HIPAA. It depends if they are working with a health plan. In that case, they would sign a BAA with the health plan (covered entity.)
A common question is, does my startup need a HIPAA business associate agreement? A HIPAA business associate agreement, or BAA, is a contract that defines how PHI will be used and protected by the business associate. It ensures that the business associate complies with HIPAA and that the covered entity reports and stops working with that vendor if any breaches or violations arise.
But it gets more complicated than that.
Say your SaaS company provides a dashboard that helps healthcare providers manage their PHI. Because you handle PHI for the health care provider, you are a business associate. Data hosting services are considered subcontractors. This is due to the ‘persistence of custody’ over the PHI the services hold for the business associate. Even if the data was encrypted, the data hosting company is still maintaining custody over the PHI data requiring them to comply with HIPAA.
In this scenario, think of your company as the middle link in a chain of HIPAA compliance. You would need a BAA with the health care provider AND the data host. But the data host wouldn’t need a BAA with the health care provider.
What happens if my business isn’t HIPAA-compliant?
Usually, an OCR audit doesn’t happen unless an employee, customer, or vendor reports your lack of compliance. But if something does happen, then you’re subject to some pretty significant fines.
The global average total cost of a data breach from 2020-2022 in the healthcare sector was $10 Million. And in the financial industry, it was 5.97 Million.
It’s important to note that actual federal fine amounts depend on the severity of the breach and negligence. The totals also include breach containment and notification costs, business disruption, revenue cost, customer turnover, reputation losses, and other long-term impacts.
As mentioned above, companies in the health industry can’t legally work with technology companies without a BAA if PHI is involved. Failing to become HIPAA-compliant means your sales team won’t be able to close deals, and your startup will struggle to move upmarket.
What HIPAA requirements do I need to be compliant?
Now that we understand what HIPAA is and why it’s important for SMBs, let’s look at the HIPAA requirements and frameworks that founders need to know.
How to make sense of HIPAA regulatory requirements
HIPAA is broken up into three different rules: the Security Rule, the Privacy Rule, and the Breach Notification Rule.
The HIPAA Security Rule
The HIPAA Security Rule establishes administrative, physical, and technical safeguards for electronic PHI. It’s similar to main security frameworks such as NIST SP 800-53 and ISO 27001.
In adhering to the HIPAA Security Rule, you’ll need policies and procedures in place to address the following items, among others:
Administrative
- Risk analysis and management
- Sanctions for employees who don’t comply with policies
- Regular review of system activity
- PHI access rights
- Awareness and training (password controls, log-in monitoring, training reminders)
- Incident protocols
- Contingency planning
Physical
- Office/facility access (including contingency access for emergencies)
- Office/facility security
- Device/computer security and access
- Physical PHI storage (device disposal, data backup, etc.)
Technical
- Unique user identification
- Automatic log-off
- Encryption and decryption
- Auditing app and backend activity
- MFA and other authentication
- Integrity controls
For help translating HIPAA’s Security Rule requirements for your business, check out these resources:
- Security Risk Assessment Tool: This government-offered application helps small to medium-sized companies navigate HIPAA Security Rule standards.
- NIST HIPAA Security Rule Toolkit: This application helps organizations conduct a self-assessment and identify gaps in Security Rule adherence. (Note: NIST no longer supports this toolkit.)
- Thoropass: We provide custom HIPAA-compliance road maps tailored specifically for your needs. Our team of HIPAA experts will work with you to make compliance quick and pain-free.
The HIPAA Privacy Rule
The HIPAA Privacy Rule sets guidelines for what you can and can’t do with PHI. For example, HIPAA’s Privacy Rule
- defines allowed use cases and disclosure of PHI;
- gives individuals access to their PHI, the ability to know who else has seen it, and some control over how their PHI is used;
- makes sure PHI disclosure is limited to only the information that’s needed;
- stipulates what organizations have to do in order to protect PHI; and
- establishes penalties for PHI mishandling.
The HIPAA breach notification rule
Once part of the Privacy Rule, the Breach Notification Rule, defines a breach and what must be done if one occurs.
This rule goes into detail about who needs to be notified, how, and when. For example, the rule stipulates that covered entities must, within 60 days of a breach, send first-class mail or an email informing patients whose PHI was put at risk in the breach. It also defines when businesses have to notify the media and the U.S. Department of Health and Human Services.
Choose your HIPAA adventure: Third-party review, HITRUST Certification, or Security Framework
Knowing the three aforementioned rules is just the start. Translating them into actionable objectives takes a bit more work. Thankfully, you have some options to help you with this task.
The OCR provides some resources for organizations to become HIPAA-compliant on their own (see above). However, most companies bring in a third-party reviewer, pursue HITRUST certification, or follow a security framework to make sure they do it right.
Third-party HIPAA Review
A reviewer provides an unbiased report about your policies, procedures, and controls through the lens of HIPAA.
Like other audits (such as a SOC 2 Type 2 audit), an annual HIPAA Compliance Review should require evidence your company actually executes on your policies and validate these controls. It is highly recommended for you to collect evidence to demonstrate your company’s compliance with your HIPAA policies/procedures. While there isn’t a formal certification for HIPAA, regulators will want to know how effective your controls are, which will then impact their risk analysis requirements.
HITRUST CSF Certification
The Health Information Trust Alliance (HITRUST) is an organization that maintains the HITRUST CSF Common Security Framework, a risk-management framework that pulls from other well-known compliance frameworks (HIPAA, NIST, ISO, PCI).
The HITRUST CSF is more prescriptive than HIPAA while covering the necessary controls.
