TrueSecure by Seimitsu HIPAA Compliance Summary
Channel: Seimitsu
Date: 2024-01-24

TrueSecure by Seimitsu is a Business Associate that helps many Covered Entities. 
HIPAA (Health Insurance Portability and Accountability Act) compliance requirements for covered entities and business associates involve various rules and regulations designed to protect the privacy and security of individuals’ health information. Here are some key points:

For Covered Entities
Definition: Covered entities include healthcare providers, health plans, and healthcare clearinghouses that transmit health information in electronic form in connection with standard transactions.

Privacy Rule Compliance: They must comply with HIPAA's requirements to protect the privacy and security of health information, providing individuals with certain rights concerning their health information.

Security Rule Compliance: Covered entities must ensure the confidentiality, integrity, and availability of electronic Protected Health Information (e-PHI), identify and protect against threats, and ensure compliance by their workforce.

Risk Analysis and Management: They are required to perform risk analysis as part of their security management processes, continuously evaluate the effectiveness of security measures, and reevaluate potential risks to e-PHI.

Administrative and Physical Safeguards: This includes designating security officials, managing access to e-PHI, training the workforce, evaluating security policies, and implementing physical safeguards for facility access and workstation/device security​​​​.

For Business Associates
Definition: Business associates are individuals or entities that perform services on behalf of covered entities involving access to PHI, including billing, accounting, legal, consulting services, IT vendors, and other third-party contractors.

Compliance with Privacy and Security Requirements: They must comply with the same privacy and security requirements as covered entities, including implementing appropriate safeguards to protect PHI and adhering to HIPAA’s requirements for reporting and responding to data breaches.

Business Associate Agreements (BAA): They must maintain HIPAA-compliant BAAs with covered entities, establishing their obligations regarding PHI protection, data breach reporting, and ensuring compliance among subcontractors.

Penalties for Non-Compliance: Non-compliance can lead to significant penalties, including fines up to $1.5 million per year for violating privacy and security rules.

Maintaining Compliance: Business associates should establish robust policies for safeguarding PHI, including access controls, encryption, risk assessments, and staff training. Regular review and update of BAAs are also crucial to ensure ongoing compliance with HIPAA regulations​​.