Source: http://geminisecurity.com/hipaa/
Timestamp: 2019-04-25 16:00:53+00:00

Document:
As we near the date on which the new 2013 HIPAA Omnibus goes into effect (March 26, 2013), we wanted to provide this HIPAA articles roadmap that describes our current and upcoming HIPAA Articles.
In general we want this series to represent What You Need to Know about the 2013 HIPAA Omnibus. Our goal is not to just educate you on what has changed, but also cover a general overview about some of the important security and privacy rules of HIPAA. Accordingly, we’ve split the articles into three general areas. Articles are linked below, and those without links are pending publication.
These HIPAA articles focus on specific rule changes in the 2013 HIPAA Omnibus, focusing on the Security Rule and the Privacy Rule.
What does “Should Reasonably have Known” mean?
These HIPAA articles focus on how the 2013 HIPAA Omnibus has changed who the HIPAA requirements apply to, and has changed what organizations can now be found legally liable for HIPAA violations.
These HIPAA articles provide a general overview of what organizations need to do to be compliant with the HIPAA Security Rule and the HIPAA Privacy Rule. Also covered in this section are what HIPAA Audits entail, and how to handle a HIPAA Breach.
How does HIPAA Auditing Work?
Overall we hope that these HIPAA articles help to educate organizations about HIPAA’s requirements and their role in fulfilling them. Please contact us if there are additional areas you’d like to see addressed in future HIPAA Articles.
Section §164.310 of the Health Insurance Portability and Accountability Act describes the physical safeguards that a covered entity or business associate must employ when handling electronic protected health information (ePHI). These physical safeguards cover several areas, including facility access, use of workstations, and use and disposal of devices and media that contain ePHI.
Procedures must be established that allow necessary physical access to the facility when restoring lost data after an emergency. This restoration must take place under a formalized disaster recovery plan.
A formalized plan must be established to protect facilities from unauthorized access.
Access to the facility must be contingent upon the verification of an individual’s identity as well as their need for access to carry out business functions. This includes visitor control.
Any changes to the physical layout of the facility that may affect the access control policies and procedures must be documented.
For facilities where workstations are used to access ePHI, those workstations must be kept in a secure state. To this end, a covered entity or business associate must have formal policies that determine how workstations are to be used, and what physical state those workstations are to be kept in. For example, this policy could mandate that a specific workstation can only run a restricted list of programs, and that when it is in use, the user must be supervised by an administrator.
Covered entities and business associates also must implement policies that create physical safeguards to the workstations themselves. In any case where a workstation has or could have access to ePHI, there must be a formal policy in place that restricts physical access to that workstation only to those who are authorized to use it. This policy also must detail the procedure through which authorization is obtained.
Physical controls must also be enacted for devices and media which may house ePHI. A covered entity of business associate must have formalized policies that indicate how devices and media are handled inside of a facility in order to prevent the accidental or malicious theft or destruction of ePHI. There are four policies or procedures that a covered entity or business associate must enact to be compliant with the device and media physical controls requirement.
Procedures must be established to securely dispose of devices or media that contain ePHI when they are no longer in use.
Procedures must be established for secure and complete removal of ePHI from devices and media before they can be repurposed for other use.
The owner or party responsible for devices or media that contain ePHI must be tracked and recorded throughout the life cycle of the medium.
Retrievable backups of ePHI data should be created before any equipment is moved. These backups are subject to the same rules as other removable media that contain ePHI.
The 2013 HIPAA Omnibus Rule changed the scope of the physical controls requirements to apply not only to covered entities, but also to business associates. No other changes were made in the update.
This article will explore section §164.308(b) of HIPAA, which deals with the business associate contracts and their protection of electronic protected health information (ePHI).
While section §164.314(a) covers the organizational requirements in more depth, this requirement covers the security requirements that apply to dealing with business associates. This portion of the security rule requires a covered entity to have a contract or other formal arrangement with any individual or organization that qualifies as a business associate. A full definition of what constitutes a business associate can be found in section §160.103 of the HIPAA law. In simple terms, a business associate is any entity that is not employed directly by the covered entity but engages in activities on behalf of the covered entity that are subject to HIPAA requirements.
This particular requirement is only applicable for business associates who handle ePHI as part of their relationship with the covered entity. The covered entity must ensure that the business associate will safeguard ePHI in accordance with all requirements of the HIPAA law.
This specification is fairly straightforward – it simply requires that the business associate contract containing the security assurances required by HIPAA is formally documented.
An auditor will verify this by inquiring whether there is a process to ensure that business associate contracts sufficiently address the security of ePHI. The auditor will review the documentation of the process of establishing business associate contracts, and will also determine that these documents are sufficiently reviewed. The auditor will also review whether the business associate contract process differentiates between private sector and public sector business associates in compliance with section §164.314.
This implementation specification is required.
Several major changes were implemented to the business associate contract requirement in the 2013 HIPAA Omnibus Rule. First, in the previous version of HIPAA, this requirement presented several exceptions to the business associate contract requirement. These exceptions have been removed, and instead the definition of “business associate” has been updated to remove those exceptions from qualifying as business associates.
Second, the language of the rule has been modified to clarify that a covered entity does not need to enter into business associate relationships with subcontractors of a business associate. It is the responsibility of the business associate to secure the proper agreement with the subcontractor. This is not a change in the law, but a clarification of an existing rule.
Finally, the update removes the provision that a covered entity would be in violation of the rule if the assurances provided in in a business associate contract with another covered entity were not upheld. This is due to a change in the law that now holds the covered entity (which is also a business associate) directly responsible for compliance with the security rule.
For example, say Company A and Company B are both considered covered entities, and Company B acts as business associate with Company A. Under the old law, if Company B did not uphold the assurances it gave Company A in the business associate contract, it would be considered in violation of this rule. Under the new law, this is no longer the case, as Company B will be directly responsible for compliance with the HIPAA security rule outside of the context of the business associate contract.
The 2013 HIPAA Omnibus Rule simplifies the business associate contract requirement by removing the exceptions and making many business associates directly responsible for compliance with the security rule. Covered entities are still responsible for formalizing contracts with business associates who are not covered entities, though. These contracts must sufficiently protect the confidentiality, integrity and availability of ePHI that is shared with the business associate.
This article explores section §164.308(a)(8) of HIPAA, which deals with HIPAA policy evaluation and periodic examination of security requirements. Policies must be re-evaluated to ensure they are sufficient and appropriate for HIPAA compliance. This is required for changes in the general security climate as well as changes in a covered entity’s use of electronic protected health information (ePHI).
There is no implementation specification provided for this requirement. However, there are several audit procedures that will determine compliance. First, an auditor will meet with management to determine whether periodic evaluations are conducted internally or by hired consultants. The auditor will view copies of the HIPAA policy evaluation and determine who performed the assessment. If the evaluations were performed by a third party, the auditor will then determine whether an agreement between the covered entity and the third party exists and if it includes verification of the consultants’ qualifications.
Evaluations are repeated whenever there are changes within the organization that affect the security of ePHI.
Finally, the auditor will determine from management whether all of the above policies are reviewed and approved on a periodic basis.
No changes to the HIPAA contingency planning requirements were included in the 2013 HIPAA Omnibus Rule. However, as described in this article, business associates of covered entities are also liable for complying with the Security Rule. Therefore, these requirements also apply to business associates.
Periodic HIPAA policy evaluation is important for ensuring continued legal compliance. As a covered entity’s business environment and business relationships evolve, policies and procedures must be re-examined to ensure the continued security of ePHI used by the covered entity.

References: §164
 §164
 §164
 §160
 §164
 §164