HIPAA - EthicalHat

HIPAA Compliance Advisory

The Health Insurance Portability and Accountability Act or HIPAA is a US Federal law that was created to improve the flow of healthcare-related information and make patient information more secure. The law, which came into effect in 1996, covers five main action areas. These are:

Health care Access, Portability and Renewability
Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform
Tax-related health provisions governing medical savings accounts
Application and enforcement of group health insurance requirements
Revenue offset governing tax deductions for employers

The law applies to the following entities:

Hospitals, physicians and other health care providers who handle electronic health care information
Health insurance providers
Third parties that process or deal with health care information

How EthicalHat can help you with HIPAA Compliance?

Getting management’s support

Meeting all HIPAA compliance requirements can be a costly process in terms of time and resources and cannot be achieved without the management’s support. EthicalHat’s security experts can educate senior executives and management about why compliance is important and necessary and how to go about achieving it.
Developing an internal security policy

We can help you develop an internal security policy based on the specific compliance requirements that apply to your organization. We do this by carrying out a HIPAA-based gap analysis exercise to identify what your security setup is lacking and how it can be strengthened. This will also help you plan and improve your resource allocation for security.
Inventorizing the flow of Electronic Protected Health Information (ePHI)

HIPAA Compliance requires you to carefully record and document the flow of all protected health information to and from your organization – whether the information is being exchanged with partners or flowing between different information systems. EthicalHat can help you set up a process to maintain proper records and update these regularly.
Managing employees’ confusion about and resistance to HIPAA

Implementing a security policy based on HIPAA can be challenging in that the employees affected by it may initially be resistant to any new processes that require the auditing or monitoring of their work or controlling the degree of access they have. Our HIPAA experts can help you deal with such issues by conducting employee workshops to educate them about the necessity for HIPAA-mandated controls and the adverse consequences of non-compliance. In addition to providing information to employees, we also take their feedback on the policy and how it affects their everyday work-related activities.
Carrying out periodic risk assessments

We also conduct periodic risk assessments to identify the gaps in your security-related processes and control-implementation. Additionally, we help you determine the severity of the threats to your information security and suggest ways to mitigate risks.
Making recommendations for risk mitigation

The risk assessment results are used to draw up a list of recommendations and controls for making your IT environment and information sharing mechanisms more secure. Implementing these controls can help prevent data leaks, protect patient information, mitigate risks and bring you closer to compliance.
Documentation

HIPAA requires covered entities to document all relevant security policies and processes that then need to be reviewed on a regular basis. EthicalHat can help you prepare these documents after a thorough gap analysis and risk assessment. We also make sure that these policy documents are approved by senior management and audit-ready.
Making sure you remain compliant

After implementing the security policy and meeting all relevant HIPAA compliance requirements, you need to make sure that you continue to update your policies and procedures based on organizational changes and evolving legal requirements. We can partner with you to make sure that you continue to meet compliance needs in the future.