Health-related data is moving more and more from paper to electronic records, determining changes in how healthcare organizations or other industries processing healthcare records are managing and protecting their data today. Businesses that are involved in any way with the use or management of PHI (personal health information) of individuals, need to ensure that they secure their sensitive data against\u00a0loss or leakage, by following security guidelines, like HIPAA, in order to avoid penalties.<\/p>\n
Health Insurance Portability and Accountability Act of 1996, HIPAA, provides data privacy and security measures for protecting medical information. The legislation is designed to protect the ePHI (electronic protected health information) of individuals, like Social Security Numbers, medical ID numbers, credit card numbers, drivers\u2019 license numbers, home address, telephone numbers, medical records,\u00a0and other critical data.
\nIn 2009, the legislation was updated with HITECH (Health Information Technology for Economic and Clinical Health), that brings additional compliance standards to businesses linked to healthcare.<\/p>\n
The\u00a0organizations\u00a0affected by HIPAA are those that create, store, process, transmit or touch protected health information of individuals.
\nThis legislation does not only apply to healthcare companies, but also to businesses that are associated with them, like attorney firms, IT companies, accounting firms, billing companies, health insurance companies, community health management information systems, etc.<\/p>\n
Read our\u00a0Case Study<\/a>\u00a0on a healthcare provider\u00a0that\u00a0managed to meet the strict HIPAA laws for protecting patient data\u00a0with Endpoint Protector DLP.<\/p><\/blockquote>\n
The HIPAA key points<\/h2>\n
The three rules of HIPAA: Privacy, Security, and Breach Notification\u00a0are meant to protect the privacy and security of health information and provide individuals with certain rights to their health\u00a0records.<\/p>\n
According to\u00a0cms.gov<\/a>:<\/p>\n
The Privacy Rule<\/em><\/h3>\n
It sets national standards for when protected health information (PHI) may be used and disclosed.<\/em>
\nPHI includes information related to:<\/em><\/p>\n\n
- The individual\u2019s past, present, or future physical or mental health or condition<\/em><\/li>\n
- The provision of healthcare to the individual<\/em><\/li>\n
- The past, present or future payment for the provision of healthcare to the individual<\/em><\/li>\n
- PHI includes many common identifiers, such as name, address, birth date, and Social Security number.<\/em><\/li>\n<\/ul>\n
The Security Rule<\/em><\/h3>\n
It specifies safeguards that covered entities and their business associates must implement to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).<\/em>
\nCovered entities must:<\/em><\/p>\n\n
- Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain or transmit<\/em><\/li>\n
- Identify and protect against reasonably anticipated threats to the security or integrity of the ePHI<\/em><\/li>\n
- Protect against reasonably anticipated, impermissible uses or disclosures<\/em><\/li>\n
- Ensure compliance by their workforce<\/em><\/li>\n<\/ul>\n
The Breach Notification Rule<\/em><\/h3>\n
It requires covered entities to notify affected individuals, U.S. Department of Health & Human Services (HHS), and in some cases, the media of a breach of unsecured PHI.<\/em>
\nMost notifications must be provided no later than 60 days after the discovery of a breach. Notifications of smaller breaches affecting fewer than 500 individuals may be submitted to HHS annually.<\/em><\/p>\nData Breaches and Penalties<\/h2>\n
A recent\u00a0study<\/a>\u00a0shows that 2016 was the year with the all-time highest number of HIPAA violation cases, since 2009. The most causes of the data breaches were bad security policies or the lack of interest in data security issues. Phishing e-mails, credit card data breach, stolen laptops, patient data leakage, etc., are just a few examples of last year\u2019s main causes of data breaches in healthcare.
\nPenalties for HIPAA non-compliance can reach from $50K to $1.5 million per year.<\/p>\nHow DLP helps\u00a0meeting HIPAA compliance<\/h2>\n
In the healthcare industry, it\u2019s absolutely necessary to ensure that the information is secured and it can only be accessed on a \u201cneed to know\u201d basis.\u00a0Healthcare and personal records mustn’t leave the health provider’s or associated companies’ premises unless it is encrypted or transmitted to secure, authorized channels.\u00a0Data Loss Prevention solutions<\/a>\u00a0are a big help in that direction.<\/p>\n
DLP\u00a0allows organizations\u00a0to monitor and control data movement.\u00a0It\u00a0can scan documents before\u00a0they are being transferred and block them in case they contain sensitive information, such as Health Insurance Numbers, Social Security Numbers, Addresses, etc.
\nWith a DLP solution,\u00a0IT Administrators can detect and prevent\u00a0users\u00a0from sending e-mails that could contain PHI, detect and prevent from copying\u00a0PHI on\u00a0portable\u00a0storage devices, get reports with detected incidents, and many other actions.<\/p>\nHere’s a breakdown of policies performed by\u00a0Endpoint Protector<\/a>\u00a0DLP with regards to healthcare sensitive data:<\/p>\n
\n
- Tracking and blocking of transfers of documents containing FDA recognized drugs, pharmaceutical firms, ICD-10 and ICD-9 codes and diagnosis lexicon<\/li>\n
- Monitoring and blocking transfers of information containing Personally Identifiable Information: e-mail, address, phone number, Social Security Number (SSN), driver license, tax ID, passport number, and others<\/li>\n
- Detecting and blocking HIPAA protected information in e-mail body (Outlook, Mozilla Thunderbird, IBM Lotus Notes) and attachment (Outlook, Mozilla Thunderbird, IBM Lotus, Windows Live Mail, Opera Mail, and other e-mail clients)<\/li>\n
- Scanning documents and content for specific healthcare keywords added by IT Administrators in dictionaries and stopping transfers in case confidential data is found<\/li>\n
- Using report-only policies to monitor users’ activity related to data transfers and restrict transfers based on discovered information<\/li>\n
- Creating whitelists based on file, file location, network share, e-mail domain and URL name so employees can conduct their daily tasks without interruptions<\/li>\n
- Including in HIPAA policies other exit channels besides e-mail such as: web-browsers, cloud file sharing, instant messaging, social media, portable storage devices, network shares, copy\/paste, printers or print screens<\/li>\n<\/ul>\n
Besides Data Loss Prevention solutions,\u00a0organizations in\u00a0the\u00a0healthcare industry,\u00a0but not limited\u00a0to this, must have a layered protection,\u00a0using\u00a0multiple security\u00a0tools,\u00a0starting from antivirus software, firewalls, to encryption,\u00a0Mobile Device Management<\/a>, and others.\u00a0Above all these, periodical risk assessments and audits (preferably with external auditors) must be performed, not only to assess the level of compliance, but also the efficiency of implemented security solutions.<\/p>\n","protected":false},"excerpt":{"rendered":"
Health-related data is moving more and more from paper to electronic records, determining changes in how healthcare organizations or other industries processing healthcare records are managing and protecting their data today. Businesses that are involved in any way with the use or management of PHI (personal health information) of individuals, need to ensure that they … <\/p>\n