Recently, a healthcare insurance company in the US had to shell out a hefty fine of $1.5 million and, at the same time be listed on OCR’s “Wall of Shame” for its failure to carry out a comprehensive security evaluation. In yet another incident, a small orthopedic practice that failed to procure the services of a specialized provider to secure its network and in the process compromised the security of patient data faced similar punitive actions by HHS. The two instances highlight the consequences that healthcare organizations have to face when they undermine the importance of HIPAA security compliance.
But the bigger question is how do you ensure that your practice doesn’t get tangled in such mess? As per experts, being pro-active and preempting possible HIPAA security breaches is the best way forward. How do you do that? Here is a detailed break-up-
Security Audits
Perform regular security risk analysis of your practice and see to it that there are no major hick-ups that can take you down. Start by ensuring that all the portable devices are encrypted and take necessary steps to safe guard them against fire, floods, earth quake and so on.
Also have timely and accurate back up of data, and ensure that computers are theft-proof by incorporating appropriate firewalls and other security measures. Furthermore, make sure that your employees have minimum level of access to patient information and there is appropriate termination procedure when the employee quits the job.
Employee Training
Put in place a comprehensive training regime that continuously updates employees about latest security practices and helps them spot phishing scams, suspicious links in emails and other people with fraudulent intentions. Also educate them about the risks of carrying out their tasks on public Wi-Fi, and sharing information on social networks, and ensure that they don’t commit this costly mistake.
Patient Information Encryption
Encrypt all the patient data that resides on computers and other portable devices. Be it scanned images, word documents, excel spreadsheets or EHRs, ensure that only individuals with appropriate administrative access can access them.
Employee Data Theft Prevention
As per recent reports, employee data theft is one of the biggest causes of HIPAA security violations in the industry. Hence put in place appropriate monitoring mechanisms that ensure that employees only get access to information that they need to perform their duties. Monitoring and maintaining an up-to-date data log can be very helpful with this regards.
Breach Response Plan
Create a comprehensive response plan outlines every minute details including identifying the authorities who will be part of the response team and the actions that they should take to address the breach. Also ensure that the response plan is updated periodically so that you can handle future challenges.
These actions may seem to be primitive, but they are very effective in preventing HIPAA security violations. What’s more, sticking to these steps will help you to win over the trust and confidence of your patients. This is because they start seeing you as one of those rare organizations which is committed to safe-guard records and maintain confidentiality of patients at all costs.
