Here are a few rules to remain compliant with HIPAA:
1. A company is responsible for ensuring plan documents and software are up to date and compliant with the most recent changes.
2. Employees' PHI cannot be used to make any work-related decisions. Example: You can't fire someone based on shared health information.
3. A system must be in place to protect all sensitive information at all times.
4. HIPAA compliant procedures and documentation should be included in your small business HRA contract documents and should list any actions you plan to take to ensure your employee’s PHI is fully protected.
5. HIPAA privacy officers must be identified within the business to handle sensitive information. Administration procedures must ensure no one outside of the designated privacy officers has access to employees’ PHI.