Blog

David Carter   |   October 18, 2013

Why HIPAA Compliance Is More Important Than Ever

The public is highly concerned about the privacy of healthcare information.

In fact, nearly one in eight patients have withheld information from a provider due to privacy and security concerns (http://www.modernhealthcare.com/article/20130906/blog/309069998), according to a study published recently by the Journal of the American Medical Informatics Association.

In response to this concern about privacy, the federal government has taken steps to strengthen the Health Insurance Portability and Accountability Act (HIPAA) and ratchet up its enforcement. Key changes, which went into effect September 23, included heftier fines and extending coverage to “business associates.” The latter “includes any company that may perform services or provide products for covered entities,” Human Resource Executive online reported  (http://www.hreonline.com/HRE/view/story.jhtml?id=534356071&topic=Main). Essentially, if you come into contact with Protected Health Information (PHI), you need to be HIPAA compliant or risk facing significant financial penalties.

As a result, HIPAA compliance is more important than ever. Of course, there are a lot of requirements to fulfill in order to be HIPAA compliant. The “HIPAA Compliance Checklist” (http://luxsci.com/blog/hipaa-compliance-checklist-what-you-need-to-do.html) published by LuxSci—a web and email hosting service that specializes in privacy and security—includes 18 administrative requirements, seven physical requirements and eight technical requirements.

While it is vital to consider the details, making a security culture a broad strategic priority is an important key for an organization to achieve HIPAA compliance, as Kaiser Permanente’s James Brady argued on the Healthcare Information and Management Systems Society (HIMSS) blog (http://blog.himss.org/2013/10/16/psst-security-culture-the-key-to-hipaa-compliance/). Brady cited a recent study by the Ponemon Institute that found that hackers and criminal insiders were responsible for 37 percent of data breaches, while an additional 35 percent involved a negligent insider (such as an employee or contractor with authorized access).

One aspect of maintaining a security culture is to work with partners who also make PHI privacy and security a high priority, and avoid those who don’t. Another is by taking advantage of solution providers who offer tools that can help you with security and regulatory compliance. For example, companies can improve their HIPAA compliance with BenefitWerks’ HR and benefits administration solutions, which improve the accuracy and integrity of HR data as well as the ability to share it with insurance carriers and other key vendors.

For much more information about HIPAA, see the U.S. Department of Health & Human Services’ web page on health information privacy: http://www.hhs.gov/ocr/privacy/.