Health Insurance Portability and Accountability Act Security Rule
US federal law that establishes national standards to protect electronic personal health information (ePHI). Covers administrative, physical, and technical safeguards.
Access Control — Unique User Identification
Assign a unique name and/or number for identifying and tracking user identity.
Access Control — Encryption and Decryption
Implement a mechanism to encrypt and decrypt ePHI.
Audit Controls
Implement hardware, software, and/or procedural mechanisms that record and examine activity in systems containing ePHI.
Person or Entity Authentication
Implement procedures to verify that a person seeking access to ePHI is the person claimed.
Transmission Security
Implement technical security measures to guard against unauthorized access to ePHI transmitted over electronic networks.
Security Management Process — Risk Analysis
Conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.
Workforce Security
Implement policies and procedures to ensure all workforce members have appropriate access to ePHI and prevent those who shouldn't from gaining access.
Information Access Management
Implement policies and procedures for authorizing access to ePHI consistent with HIPAA's minimum necessary standard.
Security Awareness and Training
Implement a security awareness and training program for all workforce members.
Security Incident Procedures
Identify and respond to suspected or known security incidents; mitigate harmful effects; document incidents and outcomes.
Contingency Plan
Establish and implement policies and procedures for responding to emergencies or other occurrences (e.g., fire, vandalism, system failure, natural disaster) that damage ePHI systems.
Business Associate Contracts
Obtain satisfactory assurances from business associates that they will appropriately safeguard ePHI; document via Business Associate Agreement (BAA).
Facility Access Controls
Implement policies and procedures to limit physical access to ePHI systems and the facility in which they are housed.
Device and Media Controls
Implement policies and procedures governing the receipt and removal of hardware/electronic media containing ePHI into and out of the facility.
Audit Controls
Implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Business Associate Technical Requirements
Establish written contracts requiring business associates to comply with HIPAA Security Rule technical requirements equivalent to the covered entity.
Policies and Procedures
Implement reasonable and appropriate policies and procedures to comply with HIPAA Security Rule standards and implementation specifications.
Documentation Retention
Retain HIPAA documentation for 6 years from date of creation or last effective date, whichever is later.
Breach Definition + Risk Assessment
Determine whether an impermissible use or disclosure constitutes a breach requiring notification via the 4-factor risk assessment.
Patient Notification of Breach
Notify affected individuals of a breach of unsecured PHI within 60 days of discovery.
Media Notification for Large Breaches
For breaches affecting 500+ individuals in a state/jurisdiction, notify prominent media outlets in that state/jurisdiction within 60 days.