HIPAA and Considerations to Adopt when Designing a System.
By: Vishnu Pradeep
Tags: System Architecture, Hippa Compliance, Compliance, Design Process, Hipaa

The healthcare domain is one of the rapidly growing and changing domains. One of the major changes that have been incorporated into the healthcare industry is the shift from legacy systems to electronic systems. All the data that was once jotted down is now either printed or stored in some kind of database. These data are collected, created, and manipulated in healthcare providers like hospitals, clinics, etc. are important details of an individual’s health history. Naturally, any system designed would take into consideration the security of the system and also data. But the question arises here, Are the normal security considerations enough for a system handling health-related data? What happens if there is a breach? Are there any privacy considerations for health data? All the answers to mentioned questions, rules, and regulations related to handling health-related data are mentioned in HIPAA.

What is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) is a law that ensures data privacy and security provisions for safeguarding the medical information of an individual.

The sole purpose of HIPAA is to provide continuous health insurance and also to reduce frauds, abuse, and waste in health insurance and health care delivery. The following rules are to be followed to be HIPAA compliant:

National Provider Identifier Standard.

A unique 10 digit identification number must exist for each health care entity, including individuals, employers, health plans, and health care providers.

Transactions and Code Set Standard.

A standardized mechanism must be followed while exchanging electronic data to submit and process insurance claims.

HIPAA Privacy Rule: Authorized Use and Disclosure

Officially known as the Standards for Privacy of Individually Identifiable Health Information, this rule establishes national standards to protect patient health information.

HIPAA Security Rule: Confidentiality, Integrity, Availability

This rule specifies the standards that are to be met while sharing and storing Electronic Protected Health Information (ePHI) in a secure manner.

Breach Notification Rule: Reporting Security Events

This rule requires organizations that experience a PHI breach to report the incident.

HIPAA broadly divides the institutions into two:

Covered Entities.

A HIPAA-covered entity is any organization or corporation that directly handles PHI or personal health records (PHRs). Covered entities are required to comply with HIPAA and HITECH (Health Information Technology for Economic and Clinical Health) Act mandates for the protection of PHI and PHRs.

Business Associates.

They are third-party organizations that perform certain activities that involve the handling of PHI on behalf of the covered entity. (The workforce of covered entities are not considered BAs). A subcontractor that creates, receives, maintains, or transmits PHI is also considered a BA.

What is Protected Health Information(PHI)?

PHI are details of an individual past, present, or future health status that is

created, collected, transmitted, or maintained by a covered entity concerning

provision of health care, payment of health care services, or health care operations. PHI includes the following but not only them,

Names. Geographical identifiers smaller than a state, except for the initial three digits of a zip code (if the number of people identifiable using zip code is more than 20000 and zip code contains more than 20,0000 people). Dates (other than year) directly related to an individual. Phone number. Fax. Email. Social Security Number. Medical Record Number. Insurance Number. Account Number. Certificate/ License number. Vehicle Identifiers. Device Identifiers and Serial Numbers. URLs. IP Address. Biometric. Face Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data.

What is the Privacy Rule in HIPAA?

The privacy rule in HIPAA aims at regulating the use and disclosure of PHI held by covered entities. The HSS, when implementing the HIPAA Omnibus Rule, extended the HIPAA privacy rule to independent contractors of covered entities who fit within the definition of a business associate. The Privacy Rule strives to assure that an individual’s health information is properly protected. At the same time, it allows access to the information needed to ensure high-quality health care for patients and to protect the public. The Privacy Rule strikes a balance that permits important usage of information while protecting the privacy of people who require health care services. The essence of the HIPAA privacy rule can be summarized as the following points.

Uses and disclosures of PHI are prohibited unless required (expressly requested by the subject of the PHI or by a government agency) or permitted (disclosures to the subject or a representative, uses undertaken in the public interest, and incidental disclosure, etc.) All permitted disclosures, except certain required cases, need to be limited in scope to the minimum necessary amount that satisfies the permitted or required use case. The HIPAA Privacy Rule is enforced by assessing the extent to which these principles are operationalized across a company’s cybersecurity architecture, personnel, and practices.

What is the Security Rule in HIPAA?

The security rule exists to increase the privacy rule principles across a covered entity’s security architecture. The key goal of the security rule is to stipulate rules that protect the privacy of PHI and also ensure quality and efficient patient care. The HITECH Act of 2009 expanded the responsibilities of business associates under the HIPAA Security Rule. The security rule specifies 3 safeguards covered entities must implement to ensure confidentiality, integrity, and availability of (e)PHI. Specifically, covered entities must:

Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit. Identify and protect against reasonably anticipated threats to the security or integrity of the information. The security rule exists to extend the privacy rule principles across a covered entity’s security architecture. The major goal of the security rule is to outline rules that protect the privacy of PHI and also ensure quality and efficient patient care. The HITECH Act of 2009 expanded the responsibilities of business associates under the HIPAA Security Rule. The security rule specifies 3 safeguards covered entities must implement to ensure confidentiality, integrity, and availability of (e)PHI. Specifically, covered entities must: Protect against reasonably anticipated, impermissible uses or disclosures and Ensure compliance by their workforce.

The Security Rule defines “confidentiality” to mean that e-PHI is not available or disclosed to unauthorized persons. The Security Rule’s confidentiality requirements are in line with the Privacy Rule’s prohibitions against improper uses and disclosures of PHI.

The Security rule also promotes the two additional goals of maintaining the integrity and availability of e-PHI. Under the Security Rule, “integrity” means that e-PHI is not altered or destroyed in an unauthorized manner. “Availability” means that e-PHI is accessible and usable on demand by an authorized person. The 3 safeguards are specified below:

Administrative Safeguards:

Policies and procedures are designed to clearly show how the entity will comply with the act.

Covered entities must adopt a written set of privacy procedures and designate a privacy officer to be responsible for developing and implementing all required policies and procedures. The policies and procedures must reference management oversight and organizational buy-in to compliance with the documented security controls. Procedures should identify employees or classes of employees who will have access to electronic protected health information ePHI. Access to ePHI must be restricted to only those employees who need it to complete their job functions. The procedures must address access authorization, establishment, modification, and termination. Entities must show that an appropriate ongoing training program regarding the handling of PHI is provided to employees performing health plan administrative functions. HIPAA laws state that covered entities that out-source some of their business processes to a third party must ensure that their vendors also have a framework in place to comply with HIPAA law requirements. Companies typically gain this assurance through clauses in the contracts stating that the vendor will meet the same data protection requirements that apply to the covered entity. Care must be taken to determine if the vendor further out-sources any data handling functions to other vendors and monitor whether appropriate contracts and controls are in place. A contingency plan should be in place for responding to emergencies. Covered entities are responsible for backing up their data and having disaster recovery procedures in place. The plan should document data priority and failure analysis, testing activities, and change control procedures. Internal audits play a key role in HIPAA compliance by reviewing operations to identify potential security violations. Policies and procedures should specifically document the scope, frequency, and procedures of audits. Audits should be both routine and event-based. Procedures should document instructions for addressing and responding to security breaches that are identified either during the audit or the normal course of operations under HIPAA rules.

Physical Safeguards:

Controlling physical access to protect against inappropriate access to protected data.

Controls must govern the introduction and removal of hardware and software from the network. When equipment is taken out of service it must be disposed of properly to ensure that PHI is not compromised. Access to equipment containing health information should be carefully controlled and monitored. Access to hardware and software must be limited to properly authorized individuals. Required access controls consist of facility security plans, maintenance records, and visitor sign-in and escorts. Policies are required to address proper workstation use. Workstations should be removed from high traffic areas and monitor screens should not be in direct view of the public. If the covered entities utilize contractors or agents, they too must be fully trained on their physical access responsibilities.

Technical Safeguards:

Controlling access to computer systems and enabling covered entities to protect communications containing PHI transmitted electronically over open networks from being intercepted by anyone other than the intended recipient.

Information systems housing PHI must be protected from intrusion. When information flows over open networks, some form of encryption must be utilized if deemed appropriate and possible. If closed systems/networks are utilized, existing access controls are considered sufficient and encryption is optional. Data integrity must be maintained, including the use of a checksum, double-keying, message authentication, and digital signature to ensure data integrity. Covered entities must also authenticate entities with which they communicate to include: password systems, two or three-way handshakes, telephone callback, and token systems. Covered entities must make documentation of their HIPAA practices available to the government to determine compliance. In addition to policies and procedures and access records, information technology documentation should also include a written record of all configuration settings on the components of the networks. Under HIPAA laws, documented risk analysis and risk management programs are required. Covered entities must carefully consider the risks of their operations as they implement systems to comply with the act.

What is the Breach Notification Rule?

The HIPAA Breach Notification Rule requires organizations that experience a PHI breach to report the incident. Depending on how many patients are affected by the breach, reporting requirements differ. Breaches affecting 500 or more patients must be reported to the HHS OCR, affected patients, and the media. These large-scale breaches must be reported within 60 days of discovery. Additionally, when a breach affects 500 or more patients, they are publicly displayed on the OCR breach portal.

Breaches affecting less than 500 patients must be reported to HHS OCR and affected patients. These breaches must be reported within 60 days from the end of the calendar year (March 1st) in which the breach was discovered.

How to achieve HIPAA compliance?

When designing a HIPAA compliant system we need to ensure that the Privacy Rule and the Security Rule are met. We can ensure the Security Rule is followed by ensuring the data is always encrypted in transit and at rest. If we are designing a system using cloud solutions then it is mandatory to enter into a Business Associate Addendum (BAA) with the cloud provider. We can ensure the data is encrypted at rest by ensuring we have configured or selected a database that supports encryption at rest for eg: AWS RDS, MongoDB enterprise, etc.

It is also important to avoid communicating the data over insecure channels or methods, for eg: emails, SMS, etc. If the system must send the ePHI via email then as mentioned above we need to enter into BAA with the email service provider. There are also HIPAA password requirements that demand the system to ensure the password is only known to the user, for this we can use biometrics, passwords, pin, or smart card as a form of password. It is also necessary to track the user identity and also monitor the login attempts and avoid any form of brute force attack.

We also need to ensure that the data when shared with a third party like for analytics is de-identified. The following are two methods which can be followed:

Expert Determination:

A person with appropriate knowledge and experience can use any generally accepted statistical and scientific principles and methods for rendering information not individually identifiable.

Safe Harbor:

We can remove the identifiers mentioned above in the section of “What is Protected Health Information(PHI)?”.

Thank you for your valuable time in reading through this article. I hope you were able to understand the basics of HIPAA and what it signifies and also things to remember while designing one. Hope to come back with more interesting and fun articles until then

Peace out ✌.