RSI Security

HIPAA Guidelines For Employees

RSI Security

Although HIPAA has been impacting the healthcare industry since the late ’90s, far too many businesses still struggle to comply with the various facets of the law. One particular area of weakness for covered entities involves the protection of their patients’ protected health information [PHI]. Time and again, they fail to adequately safeguard the personally identifiable information that has been entrusted to their keeping. Naturally, such lax defenses can result in a host of issues such as data theft, fraud, loss of client trust, fines, and even jail time. 

Over the years, one of the main causes of noncompliance with HIPAA is the result of human error. In most cases, employees unknowingly open up the floodgates to prying eyes or cybercriminals due to a simple lack of understanding, education, or forethought. Although such actions are rarely malicious, ignorance is not an excuse readily accepted by Health and Human Services [HHS]. Therefore, it’s crucial that you ensure that your team members are complying with the rules and regulations of HIPAA.

Check out our HIPAA guidelines for employees here! 

 

Are Employers Bound by HIPAA? 

If your business falls outside of the realm of healthcare, you may be asking your HR team, “Are employers bound by HIPAA?” Although you may not be a covered entity, you still collect your employee’s health information for things such as Workers Comp or Americans with Disabilities Act [ADA]. 

Generally speaking, HIPAA only applies to “covered entities.” These are defined as:

  1. Health plans
  2. Healthcare providers that electronically store, share, or send PHI
  3. Healthcare clearinghouses

In short, HIPAA typically does not apply to the direct act of collecting your employee’s personal health information; however, it will apply to the health care entity from whom you are gathering such information. 

 

Assess your HIPAA / HITECH compliance

 

According to the boundaries set forth by HIPAA, covered entities are only allowed to disclose protected patient health information when permitted by the individual. In a broad sense, a covered entity can disclose PHI for the purposes of treatment; after that, limitations on revelation grow more stringent. Typically, what can be disclosed is subject to the “minimum necessary” limitation established in HIPAA. Per HIPAA Section 164.512:

A covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, use or disclosure permitted by this section, the covered entity’s information and the individual’s agreement may be given orally. 

 

 

Business Associates 

In 2009, the American Reinvestment and Recovery Act (ARRA) expanded HIPAA’s umbrella to cover business associates, which are defined by HHS as: “A person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.  A member of the covered entity’s workforce is not a business associate.  A covered health care provider, health plan, or health care clearinghouse can be a business associate of another covered entity.” 

Examples of business associate’s functions and activities can include:

Therefore, business associate services can cover any of the following occupations:

 

HIPAA Guidelines for Employees

What is PHI?

If your business is a covered entity or a business associate, it’s essential that you and your employees take special care of your client’s protected health information. But what’s considered PHI? Per the HIPAA Journal it’s: 

Any identifiable health information that is used, maintained, stored, or transmitted by a HIPAA-covered entity or a business associate of a HIPAA-covered entity, in relation to the provision of healthcare or payment for healthcare services. It is not only past and current health information that is considered PHI under HIPAA Rules, but also future information about medical conditions or physical and mental health-related to the provision of care or payment for care. PHI is health information in any form, including physical records, electronic records, or spoken information.

The 18 identifiers that qualify as PHI are: 

 

Administrative Safeguards

If you are a covered entity or business associate, the Security Rule dictates that your business input the following administrative safeguards:

 

 

 

 

If your business handles sensitive client information on a regular basis, you are bound by the law to protect that information. By mandating HIPAA compliance training, you take proper preventative precautions and, in the case of failures, can then demonstrate to outside sources that you did everything in your power to train your employees to act correctly. 

 

 

Common Employee HIPAA Violations and Faux Pas 

As mentioned, employees are the most common cause of HIPAA violations. The vast majority of such cases of malfeasance are simply the result of laziness and a lack of training. Employees don’t know better, even though they should, and then act out of incompetence. With this in mind, it’s your duty to regularly educate your employees about the dangers of HIPAA noncompliance both for them personally and the business they work for. 

HIPAA compliance training is meant to teach employees to properly handle ePHI so that they:

  1. Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit;
  2. Identify and protect against reasonably anticipated threats to the security or integrity of the information;
  3. Protect against reasonably anticipated, impermissible uses or disclosures; and
  4. Ensure compliance by their workforce.

 

To help you in the task of creating an employer HIPAA compliance checklist, it’s crucial that you are aware of common violations that employees typically engage in as well as preventive actions you can take. These include: 

Snooping was the largest single cause of exposure of patient health information according to the survey with 27% of having experienced a breach when an employee viewed medical records of friends and family, while 35% occurred when employees checked the medical records of their work colleagues.

An employee who illegally accesses client PHI for non-work-related purposes is acting both unprofessionally and cavalierly. Whether they do so out of malice, curiosity, or friendship, doing so is illegal and can cause serious harm to your business. 

Steps you can take to prevent such actions include restricting access to patients’ or employee’s records unless explicitly required for work purposes. 

As an employer, encourage your employees to close their computers if they are working from home and need to step away from their tasks. In addition, ensure that all devices have dual-authentication passwords, encryption, and other such security protocols. 

 

 

Alert and Train Your Employees 

It’s vital that your employees are aware that their actions, whether intentional or not, can have serious ramifications on not only themselves but the business and its patients as well. Should they be found guilty of a breach in HIPAA, particularly one that they were fully aware of violating, they may be faced with stiff penalties such as monetary fines and jail time.

If you wish to protect your business, you need to take proper precautions to ensure that your employees have been adequately trained in accordance with HIPAA guidelines. You can do so by enlisting RSI security to evaluate your organization’s process, controls, policies, and training procedures. Our comprehensive audit can help you identify gaps between practices and HIPAA requirements and then provide prescriptive actions and employee training.

Interested? Reach out today and we can help you ensure that employees aren’t your business’ bane. 

 

Speak with a HIPAA / HITECH expert today!

 

Download Our Complete Guide to Navigating Healthcare Compliance Whitepaper

Not sure if your HIPAA or healthcare compliance efforts are up to snuff? Unsure about where to even start? Download RSI Security’s comprehensive guide to navigating the HIPAA and healthcare compliance labyrinth. Upon filling out this brief form you will receive the whitepaper via email.

Sources 

Cornell Law School. 45 CFR 164.512. Uses and disclosures. https://www.law.cornell.edu/cfr/text/45/164.512

HHS. Business Associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

HIPAA Journal. What is Considered PHI Under HIPAA? (2017). https://www.hipaajournal.com/considered-phi-hipaa/#targetText=PHI%20is%20health%20information%20in,when%20it%20includes%20individual%20identifiers.

HHS. Summary of HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

Northern Illinois University Division of Information Technology. HIPAA Security Rule: Explanation and Guidance. https://www.niu.edu/doit/policies_root/HIPAA%20Security%20Rule.shtml

HIPAA Journal. Employees Snooping Most Common Cause of HIPAA Security Breaches. (2013). https://www.hipaajournal.com/employee-snooping-common-cause-hipaa-security-breaches/

Exit mobile version