HIPAA Requirements | Complete Compliance Guide for Healthcare

HIPAA Compliance Framework

Who Must Comply?

Covered Entities:

• Healthcare providers (doctors, hospitals, clinics)
• Health plans (insurance companies, HMOs)
• Healthcare clearinghouses

Business Associates:

• SaaS companies handling PHI
• Medical billing services
• EHR vendors
• Cloud storage providers
• Analytics platforms

Three Main Rules

Privacy Rule

Standards for protecting PHI privacy and patient rights

Security Rule

Technical and administrative safeguards for ePHI (electronic PHI)

Breach Notification Rule

Requirements for reporting PHI breaches to patients and HHS

HIPAA Security Rule Safeguards

📋

Administrative Safeguards (9 Standards)

Policies and procedures to manage security measures

Security Management Process (Required)

✓Risk analysis to identify threats to ePHI
✓Risk management to reduce risks to reasonable level
✓Sanction policy for workforce violations
✓Information system activity review

Assigned Security Responsibility (Required)

✓Designate security official responsible for HIPAA compliance

Workforce Security (Required)

✓Authorization and supervision procedures
✓Workforce clearance procedures
✓Termination procedures

Information Access Management (Required)

✓Access authorization policies
✓Access establishment and modification procedures

Security Awareness and Training (Required)

✓Security reminders for workforce
✓Protection from malicious software
✓Log-in monitoring procedures
✓Password management

Security Incident Procedures (Required)

✓Response and reporting procedures for security incidents

Contingency Plan (Required)

✓Data backup plan
✓Disaster recovery plan
✓Emergency mode operation plan
✓Testing and revision procedures
✓Applications and data criticality analysis

Evaluation (Required)

✓Periodic technical and non-technical evaluation

Business Associate Contracts (Required)

✓Written contracts with Business Associates
✓BAA must require BA to implement safeguards

🏢

Physical Safeguards (4 Standards)

Controls for physical access to systems and facilities

Facility Access Controls (Required)

✓Contingency operations procedures
✓Facility security plan
✓Access control and validation procedures
✓Maintenance records

Workstation Use (Required)

✓Policies for proper workstation functions and physical attributes

Workstation Security (Required)

✓Physical safeguards for workstations accessing ePHI

Device and Media Controls (Required)

✓Disposal procedures for ePHI
✓Media re-use procedures
✓Accountability for hardware and media
✓Data backup and storage

💻

Technical Safeguards (5 Standards)

Technology controls to protect ePHI

Access Control (Required)

✓Unique user identification
✓Emergency access procedure
✓Automatic logoff (addressable)
✓Encryption and decryption (addressable)

Audit Controls (Required)

✓Hardware, software, and procedural mechanisms to record and examine access to ePHI

Integrity (Required)

✓Mechanisms to ensure ePHI is not improperly altered or destroyed (addressable)

Person or Entity Authentication (Required)

✓Procedures to verify identity of persons/entities accessing ePHI

Transmission Security (Required)

✓Integrity controls for transmitted ePHI (addressable)
✓Encryption for transmitted ePHI (addressable)

HIPAA Privacy Rule Requirements

Patient Rights

✓Right to access their PHI
✓Right to request amendments
✓Right to accounting of disclosures
✓Right to request restrictions
✓Right to confidential communications
✓Right to paper copy of privacy notice

Permitted Uses & Disclosures

✓Treatment, payment, healthcare operations
✓Patient authorization required for other uses
✓Minimum necessary standard applies
✓De-identification permitted
✓Business associate agreements required
✓Limited data sets with data use agreements

Notice of Privacy Practices

✓Describe how PHI may be used and disclosed
✓Patient rights and entity obligations
✓Must be provided to patients
✓Posted prominently at facility
✓Available on website
✓Updated as needed

Administrative Requirements

✓Designate privacy official
✓Workforce training
✓Safeguards for PHI
✓Complaints process
✓Sanctions for violations
✓Mitigation of harmful effects

Breach Notification Requirements

Small Breaches (<500 people)

• Notify affected individuals within 60 days
• Maintain log of breaches
• Submit annual report to HHS

Large Breaches (≥500 people)

• Notify affected individuals within 60 days
• Notify HHS within 60 days
• Notify media outlets
• Posted on HHS Wall of Shame

Notification Contents

• Brief description of breach
• Types of information involved
• Steps individuals should take
• What entity is doing to mitigate
• Contact procedures

Ready to achieve HIPAA compliance?

LowerPlane provides HIPAA-specific tools including BAA management, PHI inventory, and automated evidence collection

Book a Demo View Implementation Checklist