Mattakushi432 HIPAA Compliance Patterns
Disclaimer: This is informational only and does not constitute legal or compliance advice. Engage qualified HIPAA counsel and compliance experts for your specific situation.
Who Must Comply
Covered Entities (CEs)
- Health plans (insurance, HMOs, employer-sponsored)
- Healthcare clearinghouses
- Healthcare providers who transmit health info electronically
Business Associates (BAs)
Any person/entity that performs functions on behalf of a CE that involve creating, receiving, maintaining, or transmitting PHI.
Examples: EHR vendors, cloud storage providers, billing companies, coding services, IT support with PHI access, analytics firms processing health data, lawyers reviewing medical records.
Sub-Business Associates: BAs that engage subcontractors who access PHI must have BAAs with them too.
Protected Health Information (PHI)
Individually identifiable health information related to:
- Past, present, or future physical or mental health
- Healthcare provision
- Payment for healthcare
18 HIPAA Identifiers
- Names
- Geographic data (smaller than state, including zip codes)
- Dates (except year) related to individual
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers
- Device identifiers
- Web URLs
- IP addresses
- Biometric identifiers (fingerprints, voice)
- Full-face photos
- Any other unique identifying number or code
ePHI: Electronic PHI — same definition, applies to Security Rule.
De-Identification Methods
- Expert determination: Statistical expert certifies very small re-identification risk
- Safe harbor: Remove all 18 identifiers AND no actual knowledge of re-identification
HIPAA Rules
Privacy Rule
Controls use and disclosure of PHI.
Permitted Uses Without Authorization:
- Treatment, payment, healthcare operations (TPO)
- Public health activities
- Victims of abuse/neglect
- Health oversight activities
- Judicial/administrative proceedings
- Law enforcement (limited)
- Research (with IRB waiver or de-identification)
- Serious threat to health/safety
Minimum Necessary Standard:
- Disclose only the minimum PHI necessary for the purpose
- Implement policies for routine disclosures
- Review non-routine requests individually
Patient Rights:
- Access their PHI (within 30 days, extendable to 60)
- Request amendment
- Accounting of disclosures
- Request restrictions (must honor if CE doesn't need for TPO and patient pays out-of-pocket)
- Request confidential communications
- Complain to CE and HHS
Security Rule
Applies to ePHI only.
Administrative Safeguards
- Security officer designated
- Workforce training on security policies
- Access management procedures (granting, modifying, terminating)
- Security incident response procedures
- Contingency plan (BCP/DR)
- Evaluation of security measures (annual risk analysis)
- Business Associate contracts
Physical Safeguards
- Facility access controls (badge, key, visitor log)
- Workstation use policies (screen locks, clean desk)
- Workstation security (physical security of devices)
- Device and media controls (encryption, disposal, reuse procedures)
Technical Safeguards
- Access controls (unique user IDs, emergency access procedure, auto-logoff, encryption/decryption)
- Audit controls (hardware and software activity logs)
- Integrity controls (authentication mechanisms, checksums)
- Transmission security (encryption in transit, TLS 1.2+)
Breach Notification Rule
Breach Definition: Impermissible use/disclosure of unsecured PHI that compromises privacy or security.
Unsecured PHI: PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction.
Risk Assessment (4 Factors)
- Nature and extent of PHI involved (identifiers + likelihood of re-identification)
- Who used or accessed the PHI
- Whether PHI was actually acquired or viewed
- Extent to which risk has been mitigated
Low probability of compromise → not a breach (document assessment).
Notification Timeline
- Individuals: Within 60 days of discovery
- HHS:
- 500+ affected: Simultaneously with individual notification
- <500 affected: Annual log, submitted within 60 days of calendar year end
- Media: 500+ residents of a state/jurisdiction → notify prominent media outlets
Notification Content
- Description of the breach
- Types of PHI involved
- Steps individuals should take to protect themselves
- CE's steps to investigate and mitigate
- Contact information
Business Associate Agreements (BAAs)
Required before sharing PHI with any BA.
Mandatory BAA Elements
- Permitted uses and disclosures of PHI
- Prohibition on non-permitted uses/disclosures
- Appropriate safeguards requirement
- Reporting breaches to CE
- Compliance with minimum necessary standard
- Making PHI available for patient access requests
- Subcontractor requirements (flow-down)
- Return or destroy PHI at termination
- Government access for compliance purposes
BAA with Cloud Providers
AWS, GCP, Azure, and many SaaS vendors offer standard BAAs. Request from their sales/legal team. Note:
- IaaS providers operate under "conduit" or full BA model depending on access
- Review what the BAA covers (region, services)
- Some services may be excluded from BAA coverage
Technical Implementation Checklist
Encryption
- Data at rest: AES-256 minimum
- Data in transit: TLS 1.2+ (prefer TLS 1.3)
- Key management: Hardware security modules (HSM) for critical keys
- Device encryption: Full-disk encryption on all laptops/mobile devices
- Backup encryption: Same standards as production
Access Control
- Unique user accounts (no shared accounts)
- MFA for all remote access
- Role-based access control (RBAC)
- Automatic session timeout (15–30 minutes)
- Privileged access management (PAM) for admin accounts
- Access review quarterly minimum
Audit Logging
- All access to PHI logged (read and write)
- Login/logout events
- Failed authentication attempts
- Configuration changes
- Log integrity protection (tamper-evident)
- Retention: 6 years minimum
- Regular log review procedures
Vulnerability Management
- Monthly vulnerability scanning
- Annual penetration testing
- Patch management SLA (critical: 30 days, high: 60 days)
- Third-party component inventory (SBOMs)
Risk Analysis Requirements
HIPAA requires a documented, thorough, accurate, organization-wide risk analysis:
- Scope: All ePHI created, received, maintained, or transmitted
- Threat identification: Natural, human, environmental
- Vulnerability identification: Technical, physical, administrative
- Control assessment: Current security measures
- Likelihood determination: Probability of threat exploiting vulnerability
- Impact determination: Magnitude of harm if PHI compromised
- Risk level: Combination of likelihood and impact
- Risk treatment: Accept, mitigate, transfer, avoid
- Documentation: Written, retained 6 years
- Review: Annual or on significant change
Common HIPAA Violations and Penalties
| Tier | Culpability | Per Violation | Annual Cap |
|---|---|---|---|
| 1 | Unknowing | $100–$50,000 | $25,000 |
| 2 | Reasonable cause | $1,000–$50,000 | $100,000 |
| 3 | Willful neglect, corrected | $10,000–$50,000 | $250,000 |
| 4 | Willful neglect, uncorrected | $50,000 | $1,500,000 |
State AGs can also bring civil actions. Criminal penalties apply for knowing violations.
Quick Compliance Checklist
- Covered entity / BA determination completed
- Privacy policies and procedures documented
- Security policies and procedures documented
- Notice of Privacy Practices (NPP) published
- BAAs signed with all business associates
- Workforce training completed and documented
- Security officer designated
- Risk analysis completed and documented
- Audit logs enabled and retained 6 years
- Encryption implemented (at rest and in transit)
- Breach response procedure documented and tested
- Patient rights request procedures implemented
- Annual policy review scheduled