This is a close read of the HIPAA Security Rule.  The following article provides an outline of the different sections and compliance requirements for each one.  We intend this to offer a way to get started.  You may want to assign a Privacy Officer to examine this and all HIPAA rules thoroughly and help you put an action plan in place.  

HIPAA established the Security Rule to ensure that all covered entities have implemented safeguards to protect the confidentiality, integrity, and access of PHI.

There are two types of implementation specifications: “required” and “addressable.”  Wherever the Security Rule reads “required,” that specification must be implemented; whereas, if it says “addressable,” there is some wiggle room in exactly how you comply with that specific standard.

To meet the addressable specifications you can either a) implement as directed in the rule; b) implement one or more alternatives that will give you the same results; c) not implement at all.  If you decide on the latter, it’s advisable to create documentation that outlines how you came to that decision; i.e., the factors you considered and the results of a risk assessment you used to base your decision.

It’s important to emphasize that the addressable specifications are not optional.  You just have a little more flexibility in how you implement those pieces.

The Security Rule has three parts:

1)   Technical Safeguards

2)   Physical Safeguards

3)   Administrative Safeguards

Technical Safeguards

HIPAA Technical Safeguards include:

1.      Access control
2.      Audit controls
3.      Integrity
4.      Person or entity authentication
5.      Transmission Security

There are four required standards to meet under the Technical Safeguards.

1.     Access Control:  Unique User ID-  Every user must be assigned a unique ID that is used to track activity.
2.     Access Control:  Emergency Access Procedure- Have procedures that allow you to access ePHI in the case of an emergency.
3.     Audit Control:   Activity Oversight- You must have a system in place to record and review all ePHI activity logs.
4.     Person or Entity Authentication-  You must confirm that a person who desires access to ePHI is who they say they are.

There are also five addressable Technical Safeguard standards.

1.    Access Control: Automatic Log-off-  Set up auto log off systems for all workstations.
2.    Access Control:  Encryption- Have a system to encrypt and decrypt ePHI.
3.    Integrity: Mechanism to Authenticate ePHI- Authenticate ePHI to verify its integrity.
4.    Transmission security:  Integrity Oversight- Ensure that ePHI is not modified without detection.
5.    Transmission security: Encryption Control- Develop a system that encrypts ePHI whenever  deemed appropriate.

For reference: HIPAA Security Technical Safeguards

Physical Safeguards

The four standards to address here are:

1.     Facility Access Controls
2.     Workstation Use
3.     Workstation Security
4.     Device and Media Controls

Under these sections, there are four required implementation standards to note:

1.      Workstation Use – you must create policies and procedures that outline the proper functions to be performed by electronic devices and the appropriate business use of workstations.
2.      Workstation Security- similar to the one above, this standard asks you to implement safeguards for workstations that contain ePHI and limit access to authorized users.
3.      Device and Media Control- Media Re-Use- implement procedures for ePHI removal before the device or media is available for re-use.
4.      Device and Media Control- Disposal- Implement policies and procedures for the final disposal of ePHI and any hardware associated with its storage.

Next, you have six remaining addressable Physical Safeguard implantation standards:

1.      Facility Access Controls: Contingency Operations- Create and implement a disaster plan for emergencies to restore any lost data.
2.      Facility Access Controls: Facility Security Plan- Implement policies and procedures to protect the facility and it’s equipment from access, tampering, and/or theft.
3.      Facility Access Controls: Access Control and Validation Procedures-  Implement procedures to control and validate a person’s facility access based on their role or function; i.e., staff and visitor badges, control of access to software testing & editing.
4.      Facility Access Controls: Maintenance Records-  Implement policies and procedures to document repairs and upgrades to the physical components related to security; i.e. Hardware, locks, bolts, and doors.
5.     Device and Media Controls: Accountability-  Maintain documentation for hardware and electronic media   

assigned to people responsible for them.

6.     Device and Media Controls: Data Backup and Storage-  Create a retrievable, exact copy of ePHI, as needed, before movement of equipment or hardware.

For reference: HIPAA Security Series, Security Standards: Physical Safeguards (PDF)

Administrative Safeguards

The administrative piece is vital when starting a HIPAA compliance program.  Over half of the HIPAA Security requirements are under this section.  The administrative safeguards are “administrative actions, policies and procedures to manage the selection, development, implementation and maintenance of security measures to protect ePHI and to manage the conduct of your workforce in relation to protected information.”

You are required to designate a privacy officer, complete document a risk assessment annually, train employees, review policies and procedures, and complete Business Associate Agreements or BAAs, with all your partners handling PHI.

There are nine standards in the Administrative Safeguards section.  They are:

1.     Security Management Process
2.     Assigned Security Responsibility
3.     Workforce Security
4.     Information Access Management
5.     Security Awareness and Training
6.     Security Incident Procedures
7.     Contingency Plan
8.     Evaluation
9.     Business Associate Contracts and Other Arrangements

There are eleven required Administrative safeguard standards.

1.     Security Management Process: Risk Assessment-  Conduct and document a risk analysis to review ePHI storage and use to assess where their are vulnerabilities in your systems.
2.     Security Management Process: Risk Management-  Implement measures to reduce a risks
3.     Security Management Process: Sanction Policy-  Implement appropriate sanctions against employees who fail to comply with security protocols
4.     Security Management Process: Information Systems Activity Reviews-  Regularly review system activity, logs, audit trails, and the like.
5.     Assigned Security Responsibility: Officers-  Designate in house HIPAA Security and Privacy Officers.
6.      Information Access Management: Multiple Organizations-  Ensure that ePHI is not accessed by other partner entities like a parent company, a subsidiary, contractors, or subcontractors- that shouldn’t have access.
7.     Security Incident Procedures: Respond and Document-  Respond and document all security incidents.
8.     Contingency Plans: Contingency Plans-  Implement policies and procedures that ensure the availability of ePHI backups and the retrieval of any lost data.
9.     Contingency Plans: Emergency Mode-  Establish procedures to allow for critical business operations to protect ePHI in the event of an emergency.
10. Evaluations:  Perform cyclical evaluations to make changes to in your business operations should any HIPAA laws change.
11. Business Associate Agreements (BAAs):  Implement contractual agreements to ensure your partners’ compliance with all HIPAA laws.  Choose partners who have similar agreements in with others in place.

There are also seven addressable standards under the Administrative Safeguards.

1.     Workforce Security: Employee Oversight-  Implement policies and procedures to ensure all members of your workforce have appropriate access when their role calls for it and has that access removed when necessary.
2.     Information Access: Access Authorization-  Implement policies and procedures for granting access to ePHI that monitor and allow access to ePHI.

3.     Security Awareness and Training: Security Updates-  Cyclically send security reminders to about security and privacy policies to all employees.
4.     Security Awareness and Training: Protection Against Malware-  Create policies and procedures that safeguard your systems against malicious software.
5.     Security Awareness and Training: Log-in Oversight-  Implement monitoring of logins and reports of inconsistencies within your systems.
6.     Security Awareness and Training: Password Controls-  Assure that there are systems in place for creating, protecting, retrieving, and editing passwords.
7.     Contingency Plans: Update and Review-  Assess the relative criticality of specific applications and data in support of other contingency plan components.

For reference: HIPAA Security Series, Security Standards: Administrative Safeguards (PDF)