Health Insurance Portability and Accountability Act (HIPAA) Consulting Services
Security and Privacy Rule
Readiness, Implementation, Audit and Program Management

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 in the United States introduced the HIPAA Security Rule, which is a supplement to the HIPAA Privacy Rule. The Security Rule addresses the safeguards and measures that covered entities and their business associates must put in place to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI), while the Privacy Rule focuses on safeguarding the privacy of people's health information. Maintaining the trust of patients and clients while guaranteeing the security of electronic health information requires compliance with the HIPAA Security Rule. Similar to the HIPAA Privacy Rule's penalties and fines, non-compliance can result in severe punishment.

There are two categories of entities here:

• Covered Entities and Business Associates.
• Covered entities are health plans, health care clearinghouses, and health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.
• Business Associates perform certain functions that involve the use or disclosure of protected health information either through services provided to or action taken on behalf of a covered entity.

A HIPAA Business Associate may include:

• A third-party claims processor
• An accounting firm who must access patient data in order to provide services to a healthcare provider
• The attorney for a healthcare provider
• Consultants
• Healthcare clearinghouses that translate claims from non-standard formats to standard formats
• Freelance medical transcriptionists
• Pharmacy benefits managers

According to the Health Insurance Portability and Accountability Act (HIPAA), individually identifiable health information created, obtained, maintained, or transmitted by covered companies and their business partners is referred to as Protected Health Information (PHI). PHI is defined as any information—oral, written, or verbal—that relates to a person's past, present, or future physical or mental health condition, to the provision of healthcare to that person, or to the payment for healthcare services that person receives. PHI is delicate and needs to be safeguarded to protect people's privacy and confidentiality.

The penalties for non-compliance with HIPAA regulations ranges from $100 to $50,000 per violation, depending on the severity of the violation.

A HIPAA risk assessment, also referred to as a HIPAA security risk assessment or a HIPAA risk analysis, is a procedure used by covered entities and their business partners to find potential holes and threats to the privacy, security, and accessibility of protected health information (PHI). A crucial step in adhering to the Health Insurance Portability and Accountability Act (HIPAA) Security Rule is the risk assessment.

The main objectives of a HIPAA risk assessment are as follows:

• Identify Risks
• Evaluate Existing Security Measures
• Determine Risk Levels
• Develop Mitigation Strategies
• Maintain Compliance

The Office for Civil Rights (OCR), which upholds HIPAA standards, and the U.S. Department of Health and Human Services (HHS) do not offer or support any formal HIPAA compliance certification programs. The implementation of HIPAA compliance is a continuous self-assessment process that is the responsibility of covered businesses and their business associates.

The HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, which specify the rules for protecting Protected Health Information (PHI) and guaranteeing the privacy and security of individual health information, must all be followed in order to be in compliance with HIPAA.

There is no formal certification, however some businesses and private individuals could assert to have programs that offer "HIPAA certification" or "HIPAA compliance certification." However, since there is no formal government-issued HIPAA compliance certification, it is imperative to exercise caution when dealing with such claims.

The general rule is 2-6 months depending upon the number of gaps identified and the management budget to close those gaps.