Making sure your company is HIPAA Compliant absorbs time, personnel, and other valuable resources from your business. This is why Nevada IT Solutions provides a detailed solution that offers a user-friendly procedure, that is accurate and headache free.

With Nevada IT Solutions, you can stop worrying if your compliance efforts are going to waste. Let us give you comfort as we guide you and your business down the path of compliance. You will know your patients and organization are protected and will be able to have peace of mind knowing your data isn’t being compromised.

What Is HIPAA Compliance?

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996, which was enacted by Congress to protect sensitive patient data.

The act contains a “Privacy Rule” and a “Security Rule,” which in turn protects the privacy of and sets standards for the security of electronic protected health information (e-PHI). Taken together, these rules establish national standards for how companies working with sensitive patient data must ensure confidentiality, availability, and integrity.

HIPAA sets the standard for protecting sensitive patient data by requiring companies that deal with protected health information (PHI) to ensure that all the required physical, network, and process security measures have been put into place and are continuously followed.

Who Must Be HIPAA Compliant?

The HIPAA Privacy Rule focuses on the saving, accessing, and sharing of medical and personal information of any patient or individual.

The two groups that HIPAA applies to would be covered entities (CE), and business associates (BA). Covered entities involve anyone who is providing treatment, payment, and operation in healthcare, while business associates focus on patient information or anyone who provides support in treatment, payment, or operations.

Did you know that it isn’t just your business that must be HIPAA Compliant, but includes the people you do business with? Business associates of businesses, or subcontractors, must also be in compliance. Below are a few examples of both groups, but for more information on covered entities and business associates, visit The Department of Health and Human Services (HHS).

Examples of Covered Entities:

• Doctors
• Dentists
• Pharmacies
• Health Insurance Companies
• Company Health Plans

Examples of Business Associates:

• CPA
• Attorney
• IT Providers
• Billing & Coding Services
• Laboratories

Is Your Business HIPAA Compliant?

It is relevant to know who you are hosting your sensitive data with.

In fact, you are required to host this data with a HIPAA-compliant hosting provider, who is required to have administrative, physical, and technical safeguards in place.

Physical Safeguards

This includes limited facility access and control with authorized access in place. All companies that are required to be HIPAA compliant must have policies about the use and access of company workstations and electronic media. Included in these policies  are the actions of transferring, removing, disposing, and re-using of electronic media and electronic protected health information (ePHI).

Technical Safeguards

Technical safeguards require that only those authorized to access electronic protected health data have the authorization to access control. Accessing control includes the use of unique user identifications, emergency access procedures, as well as an automatic log off encryption and decryption. It is also a requirement that tracking logs or audit reports are kept for records of activity on hardware and software. This is helpful to locate the source if there is ever a security violation.

Technical Policies

The purpose of technical policies are to confirm that ePHI is not being altered or destroyed. Data backup solutions should always be in place to ensure that any electronic media errors can be fixed quickly and any patient health information can be recovered accurately and intact.

Network (or Transmission) Security

This safeguard is required in order to protect ePHI data from unauthorized public access, which includes all methods of transmitting data by email, Internet, private network, or cloud.