Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is critical for any business that collects, stores or uses patients' personal health information. Failure to meet regulatory expectations can result in consequences that may negatively impact healthcare operations or damage public reputation.
For companies just getting started with HIPAA regulations, it's easy to feel overwhelmed. In this piece, we'll break down HIPAA basics, dive into key concepts including HIPAA security and privacy rules and explore how LastPass can help your company stay compliant.
What Is HIPAA?
HIPAA stands for the Health Insurance Portability and Accountability Act. The Act was designed to streamline the creation, storage, and transmission of healthcare data by creating a national standard for electronic health records (EHRs). While this speaks to the "portability" aspect of the law, Congress recognized that EHRs naturally introduced potential risks to patient data. As a result, the law was amended to include privacy and security rules — the "accountability" portion of HIPAA.
Together, portability and accountability make it possible for patients to receive improved care without putting their personal data at risk.
Overview of the Health Insurance Portability and Accountability Act
HIPAA was signed into law in 1996. The Department of Health and Human Services (HHS) published the final Privacy Rule in December 2000, and in August 2003 compliance became mandatory for most health plans and providers. The Security Rule was introduced in 2003, and compliance became mandatory as of April 20, 2005.
Key principles and regulations of HIPAA
Several key principles and regulations of HIPAA are relevant for business.
The first is portability. HIPAA was enacted in part to address growing concerns around the transfer and security of protected health information (PHI), which includes patients' personal details such as their names, birthdates, and health insurance information, along with data about their diagnoses, treatment plans, and possible outcomes. HIPAA helped standardize the creation and transmission of EHRs, which streamlined the process for healthcare providers to view and share these records as required. The Act also made it easier for patients to access their own data on demand.
The second principle of HIPAA is privacy. While EHRs make it simpler for patients and providers to access and transmit data, they also introduce potential risks — if malicious actors compromise health data, they could hold it for ransom or use it to carry out identity theft. To help mitigate this risk, HIPAA requires healthcare providers to obtain patient consent before PHI is disclosed. HIPAA privacy applies to both standard PHI and electronic personal health information (ePHI). The Privacy Rule was created to codify privacy expectations and best practices.
The final core principle of HIPAA is security. Security refers to the protection of ePHI within an organization. Under the Security Rule, ePHI must remain accurate and accessible without compromising its confidentiality. To achieve this goal, companies must deploy administrative, physical, and technical safeguards.
It's also worth mentioning that HIPAA impacts organizations differently depending on their role in handling patient data. HIPAA breaks down regulatory responsibility into three categories:
- Covered Entities
Covered entities are defined under HIPAA as health plans, health care clearinghouses, and health care providers who transmit any electronic PHI. A covered entity may be an institution, such as a hospital, an organization such as a health insurance provider, or a person such as a doctor.
- Hybrid Entities
Hybrid entities are organizations that handle PHI in some parts of their business operations but not others. For example, a university that has a medical research center on-site is considered a hybrid entity. The medical research center is subject to HIPAA regulations because it collects and transmits patient data. The rest of the university, meanwhile, is not required to meet HIPAA standards.
- Business Associates
Business associates (BAs) are companies that work with covered entities to process, analyze, or store data. These associates are required to comply with HIPAA policies and must sign business associate agreements (BAAs) which specify the policies and processes they will put in place to keep PHI safe. While BAs can be sanctioned under HIPAA for failure to protect PHI, covered entities may also be at risk of non-compliance if they were aware of business associate practices that put data at risk and took no steps to address the issue or terminate the BAA.
Importance of HIPAA compliance for businesses
HIPAA compliance is critical for companies. Failure to meet HIPAA obligations can result in three potential consequences.
First are fines for civil violations. These violations are typically tied to ignorance or willful neglect. There are four tiers of civil violation. Tier 1 violations occur when companies are unaware of HIPPA breaches and have exercised due diligence to lower the risks of these breaches. The penalty is a minimum of $100 per violation up to $25,000 per year. Tier 4 violations, meanwhile, are tied to willful neglect with no attempt to resolve the breach after it has occurred. In this case, fines are a minimum of $50,000 per violation up to $1.5 million per year.
Next are fines and penalties for criminal violations. These violations occur when PHI is obtained with permission or used with malicious intent. There are three tiers of criminal violations. A tier 1 violation occurs when an individual deliberately obtains or discloses PHI without authorization. Consequences include a $50,000 fine and up to 1 year in jail. A tier 3 violation, meanwhile, happens when someone obtains PHI for personal gain or has malicious intent. In this case, they could face a $250,000 fine and up to 10 years in jail.
Finally, failure to comply with HIPAA regulations can result in reputation damage. If patients can't trust that providers are capable of safeguarding their data, they may take their business elsewhere. Consider recent research, which found that 56% of consumers are "not at all likely" to trust a company that can't protect their personal data. If organizations can't fulfill their obligations under HIPAA, patients will find other providers that can.
Depending on the type of service provided and the type of data handled, HIPAA compliance will look slightly different for every organization. To help streamline the creation of compliance processes, the HHS Office of Inspector General (OIG) created the Seven Elements of an Effective Compliance Program. They are:
- Implement written policies and procedures.
- Designate a compliance officer and create a compliance committee.
- Conduct regular workforce training and education.
- Ensure consistent communication across the organization.
- Monitor and audit internal operations.
- Enforce standards using clear disciplinary guidelines.
- Respond immediately when unauthorized use is detected.
HIPAA Privacy Rule
Also called the Standards for Privacy of Individually Identifiable Health Information, the Privacy Rule has the dual purpose of ensuring that patients' personal data is protected while also streamlining the flow of health information.
Understanding the HIPAA Privacy Rule
The Privacy Rule defines PHI as information that:
- Includes or relates to an individual's past, present, or future mental or physical health
- Describes the provision of health care to the individual
- Documents the past, present, or future payment for healthcare services
The Privacy Rule specifies when organizations can disclose data, what information they can share, and who can request this information. For example, the individual who is the subject of the information — the patient or client — can access this data. Information may also be shared with companies that provide treatment, payment, or other healthcare operations for the patient.
Rights and protections for individuals under HIPAA
As noted by the HHS, health information "cannot be used or shared without your written permission unless the law allows it." Legal uses cases include data share to coordinate care, facilitate payments, or protect public health. In the case of public health reporting, data must be de-identified so it cannot be traced to a specific individual.
This means that health information typically can't be shared with your employer or for the purposes of marketing or sales unless you give your permission. There are certain circumstances where information can be shared without your consent. For example, if you are seriously injured and unconscious, your healthcare provider can make the decision to share your health information if it is in your best interests.
HIPAA Security Rule
The HIPAA Security Rule is also known as the Security Standards for the Protection of Electronic Protected Health Information. It is a national set of security standards for protecting the transmission, storage, and use of electronic health data.
Exploring the HIPAA Security Rule requirements
To meet HIPAA Security Rule requirements, companies must satisfy four conditions.
- They must ensure the confidentiality, integrity, and availability of all electronic PHI they create, receive, or use.
- They must identify potential threats to this data and implement IT solutions to protect against these threats.
- They must protect against reasonably anticipated disclosures, such as accidental misuse or data sharing.
- They must ensure that their workforce understands these conditions and is trained to comply with data handling expectations.
LastPass features that support HIPAA security compliance
There are several LastPass features that help support HIPAA compliance, including:
- Password management
- Password protection
- Multifactor authentication
- Deep and dark web scanning
Steps to achieve HIPAA-compliant password management with LastPass
To achieve HIPAA-compliant password management with LastPass, follow these steps:
1) Create a secure, encrypted vault
LastPass creates an encrypted vault for your password and login credentials. The vault can only be decrypted by your Master Password, which only you know.
2) Save and autofill your credentials
When credentials are changed or updated, LastPass saves them to your vault. The next time you log into a verified webpage or service, LastPass will autofill your credentials. If the site is unrecognized — due to spoofing or other threats — your credentials will not autofill.
3) Generate strong passwords
With the LastPass password generator, you can easily create new passwords or update existing ones. These passwords are strong, unique, and are never repeats of your previous passwords.
The LastPass password manager helps meet Security Rule requirements by reducing the risk of account compromise which could lead to unauthorized access.
HIPAA Compliance Features for LastPass
LastPass HIPAA compliance features include:
Secure password management for HIPAA compliance
Password management processes such as unique password generation and autofill only on verified sites help improve password protection and keep key credentials safe.
Multi-factor authentication and access controls
With multi-factor authentication (MFA) from LastPass, users must provide an additional verification factor — such as a one-time text code or fingerprint — along with their credentials to gain access. In addition, single sign-on (SSO) access controls give administrators granular control over who has access to what, and provide complete transparency into user access requests.
Auditing and reporting capabilities for compliance
LastPass allows administrators to create and view reports using the Admin Console. This provides visibility into current password conditioning including potential breaches, weak passwords, and other potential problems.
LastPass also scans for compromised or stolen passwords across the public, deep, and dark web.
How LastPass Ensures HIPAA Compliance
LastPass can also help companies remain compliant with both the Privacy and Security rules.
Encryption and data protection measures
Robust encryption of stored passwords and regular audits of our security infrastructure help ensure that your passwords are protected from potential compromise. This both ensures compliance with Security Rule expectations and reduces the risk of Privacy Rule violations.
Secure sharing and collaboration features
Password policy changes or updates can affect organizations at large. For covered entities, however, this can pose a HIPAA problem: If new passwords are shared insecurely, they could put PHI at risk. With secure password sharing from LastPass, IT admins can share passwords with users without exposing plaintext, and revoke credentials at any time. LastPass also enables the secure sharing of other data such as WiFi info, banking details, and tax documents.
Employee training and awareness programs
With LastPass University, covered entities can train administrators and end users to improve password protection, spot potential threats, and keep data safe.
Benefits of Using LastPass for HIPAA Compliance
Using LastPass for HIPAA compliance offers benefits including:
Enhanced security and privacy for sensitive healthcare data
Secure passwords and robust data encryption keep attackers from gaining access to user accounts, in turn reducing the risk of a PHI breach and HIPAA non-compliance.
Streamlined password management and access control
With simplified password management and on-demand access control, IT administrators can ensure that staff are using robust passwords they haven't used before. If users don't update their passwords or attempt to access resources without permission, admins can revoke access.
Simplified compliance reporting and audit trails
Built-in reporting capabilities give IT admins the visibility they need to track access requests, failed logins, and other relevant data. These reports provide audit trails in the case of regulatory requests to demonstrate security due diligence.
HIPAA Compliance Best Practices with LastPass
With LastPass, your organization is better prepared to navigate HIPAA compliance best practices, such as:
Regular password policy updates and enforcement
Strong and unique passwords are a key part of meeting Security Rule expectations. With regular updates and centralized enforcement, IT admins are better prepared to reduce potential risk.
Role-based access controls and permissions
Using role-based access controls, admins can ensure that only the right people have access to the right data at the right time. This helps limit the chance of potential Privacy Rule violations due to authorized PHI access or sharing.
Ongoing monitoring and incident response procedures
Incidents happen. And when they do, HIPAA requires companies to take action. In addition to reporting a breach, businesses must also demonstrate due diligence in efforts to contain and remediate the issue. Failure to do so can result in significant fines or sanctions.
Get Started with LastPass for HIPAA Compliance
Ready to get started with LastPass? Here's how.
Choose the right LastPass plan for your organization
LastPass has multiple plans to suit organizations of differing sizes. For example, a small clinic might choose the LastPass Teams plans, whereas a hospital may be better served with a Business plan. Providers or researchers working independently, meanwhile, may opt for the Premium plan.
Implement LastPass in your healthcare environment
Next up is implementation. Getting started is easy. First, integrate your existing directory service, such as Microsoft Active Directors. Then, set policies for individuals, groups, or everyone in your organization. Next, configure MFA and then add your first SSO application. Finally, invite employees to start using LastPass
Ensure seamless user adoption and training
Last but not least? Leverage LastPass university to help streamline user adoption and provide regular training around security best practices for better data protection and improved HIPAA compliance.
HIPAA compliance is critical for covered entities, hybrid entities, and business associates to keep PHI safe and earn patients' trust. Need help navigating HIPAA and protecting PHI? Start your free LastPass trial today.
