{"id":8047,"date":"2022-07-07T08:18:10","date_gmt":"2022-07-07T08:18:10","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=8047"},"modified":"2022-07-07T08:21:34","modified_gmt":"2022-07-07T08:21:34","slug":"what-is-hipaa-compliance-for-startups","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/what-is-hipaa-compliance-for-startups\/","title":{"rendered":"What is HIPAA Compliance for Startups?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8047\" class=\"elementor elementor-8047\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Any startup who works with a United States healthcare organisation of any kind must demonstrate HIPAA compliance. <\/span><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/index.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">HIPAA<\/span><\/a><span style=\"font-weight: 400;\">, the Health Insurance Portability and Accountability Act set out in US law in 1996 requires anyone who touches the protected health information of users to appropriately protect the privacy and security of this data. Done properly, demonstrating HIPAA compliance for startups will have benefits for the entire organisation.<\/span><\/p><p><span style=\"font-weight: 400;\">Under HIPAA, <\/span><a href=\"https:\/\/www.hipaajournal.com\/what-is-considered-protected-health-information-under-hipaa\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">protected health information<\/span><\/a><span style=\"font-weight: 400;\"> (PHI) is any health information that can be tied to an individual. Under the HIPAA regulations, protected health information is a combination of health information such as a diagnosis, treatment information, test results, or prescriptions, combined with information that identifies the patient such as their name, location, contact details, payment details, and more. Furthermore, if identifiers are removed, the data is no longer restricted under HIPAA.<\/span><\/p><h2><span style=\"font-weight: 400;\">HIPAA Compliance Requirements<\/span><\/h2><p><span style=\"font-weight: 400;\">HIPAA is designed to protect user health information held in electronic systems. HIPAA&#8217;s compliance requirements are set out in a series of rules:<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><b>HIPAA Privacy Rule<\/b><span style=\"font-weight: 400;\"> sets out requirements for appropriate safeguards to protect patient privacy, and limits the uses of this information without explicit consent from the user. The privacy rule also gives patients rights in requesting their data.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><b>HIPAA Security Rule<\/b><span style=\"font-weight: 400;\"> sets out requirements for administrative, physical, and technical safeguards to protect the confidentiality, integrity, and security of PHI. These security safeguards include risk analysis and management, employee training and discipline, security policies including incident response policies, physical security protections, encryption, access, control, and authentication, and more.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><b>HIPAA Breach Notification Rule<\/b><span style=\"font-weight: 400;\"> defines breaches and sets out requirements for organisations in the event of a breach.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><b>HIPAA Enforcement Rule<\/b><span style=\"font-weight: 400;\"> sets out how HIPAA will be enforced, including monetary penalties for violations of the rules.<\/span><\/p><h2><span style=\"font-weight: 400;\">Why is HIPAA compliance for startups important?<\/span><\/h2><p><span style=\"font-weight: 400;\">HIPAA applies to anyone who routinely handles (stores, transfers, processes) protected health information (PHI) belonging to US citizens. This includes \u2018business associates\u2019 of healthcare settings, including software development companies who develop products or provide services to the healthcare providers defined as \u2018covered entities\u2019.<\/span><\/p><p><span style=\"font-weight: 400;\">As business associates, HIPAA compliance for startups require them to demonstrate that they are HIPAA compliant to their customers. Failure to demonstrate this compliance opens the company up to the risk of a fine from HIPAA.\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">How to achieve HIPAA compliance certified status<\/span><\/h2><p><a href=\"https:\/\/www.hipaajournal.com\/what-is-hipaa-certification\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">HIPAA certification<\/span><\/a><span style=\"font-weight: 400;\"> is not required by law under HIPAA, but it does have <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/benefits-of-iso-27001-cybersecurity-framework\/\"><span style=\"font-weight: 400;\">practical benefits for organisations<\/span><\/a><span style=\"font-weight: 400;\"> including the requirements to consider security risk, and implement policies, procedures, and controls to protect PHI.<\/span><\/p><p><span style=\"font-weight: 400;\">HIPAA compliance for startups can be achieved in two ways: a point in time HIPAA compliance audit and accreditation by a third party auditor (with no legal standing); or recognition that the organsation\u2019s workforce have achieved a level of HIPAA knowledge and compliance with their security policies and procedures.<\/span><\/p><p><span style=\"font-weight: 400;\">Startups who are defined as business associates under HIPAA may choose to undertake a third party HIPAA compliance audit to ensure that their products, services, policies, and procedures meet HIPAA\u2019s standards.<\/span><\/p><p><span style=\"font-weight: 400;\">It is important to note that HIPAA compliance verification does not remove the obligation to be HIPAA compliant going forward, and does not guarantee that an organisation will not be found to have a security violation going forward.<\/span><\/p><h2><span style=\"font-weight: 400;\">The seven elements of effective compliance<\/span><\/h2><p><span style=\"font-weight: 400;\">While the route to compliance is not prescribed, the HHS Office of Inspector General set out the seven elements of effective compliance to provide the skeleton for a HIPAA compliance program. These seven elements will be used by <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">HIPAA compliance companies<\/span><\/a><span style=\"font-weight: 400;\"> to assess HIPAA compliance for startups.<\/span><\/p><ol><li><b> Implementing written policies, procedures and standards of conduct<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">Auditors will be looking for evidence that the <\/span><a href=\"https:\/\/www.hipaajournal.com\/hipaa-compliance-checklist\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">administrative, technical, and physical safeguards<\/span><\/a><span style=\"font-weight: 400;\"> specified in the HIPAA Security Rule have been addressed. As these safeguard areas are general, many organisations find that a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/youre-going-for-iso-27001-certification-now-what\/\"><span style=\"font-weight: 400;\">framework such as ISO 27001<\/span><\/a><span style=\"font-weight: 400;\"> provides helpful guidance on controls.<\/span><\/p><p><span style=\"font-weight: 400;\">Administrative safeguards:<\/span> <span style=\"font-weight: 400;\">Risk analysis and management; Sanctions for employees who don\u2019t comply with policies; Regular review of system activity; PHI access rights; Awareness and training (password controls, log-in monitoring, training reminders); Incident protocols; and Contingency planning<\/span><\/p><p><span style=\"font-weight: 400;\">Physical safeguards:<\/span> <span style=\"font-weight: 400;\">Office\/ facility access; Office\/ facility security; Device\/ computer security and access; and Physical PHI storage (device disposal, data backup, etc.)<\/span><\/p><p><span style=\"font-weight: 400;\">Technical safeguards: Unique user identification; Automatic log-off; Encryption and decryption; Auditing app and backend activity; MFA and other authentication; and Integrity controls<\/span><\/p><p><span style=\"font-weight: 400;\">In addition, organisations must be able to show that they have a full set of relevant security policies in place, and they may be asked to produce evidence of security risk analysis activity, asset and device audits, and even a HITECH Subtitle D audit. They will also be required to show that they have remediation processes in place to address any gaps discovered during the audit.<\/span><\/p><ol start=\"2\"><li><b> Designating a compliance officer and compliance committee<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">Organisations must designate a compliance officer who takes overall responsibility for achieving HIPAA compliance. This officer must also be backed up by a group of other key figures across the organisation who oversee the work of the compliance officer but are also in a position to lead the necessary security culture across the organisation.<\/span><\/p><ol start=\"3\"><li><b> Conducting effective training and education<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">HIPAA contains a strong emphasis on employee responsibilities towards protecting PHI. Organisations who are aiming for HIPAA compliance will need to demonstrate that employees are will trained in their security responsibilities, that they understand the security policies and procedures in place, and that they follow these rules.<\/span><\/p><ol start=\"4\"><li><b> Developing effective lines of communication<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">Organisations are required to maintain effective lines of communication with suppliers and customers to ensure that the entire supply chain has effective security controls in place to ensure HIPAA compliance. This includes <\/span><a href=\"https:\/\/www.hipaajournal.com\/hipaa-business-associate-agreement\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">HIPAA Business Associate Agreements<\/span><\/a><span style=\"font-weight: 400;\"> between the startup and their relevant covered entity, or between different organisations along the supply chain.<\/span><\/p><ol start=\"5\"><li><b> Conducting internal monitoring and auditing<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">The organisation must be able to demonstrate that they monitor the success of their security programme and that they conduct audits of systems and processes to ensure that they meet the organisation\u2019s needs. HIPAA guidance doesn\u2019t specify how organisations can demonstrate this, but one way to demonstrate the effectiveness of the programme and to verify that all systems are in compliance is through a thorough <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">security assessment<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">Furthermore, the organisation is required to carry out a documentation audit to ensure the documentation required by HIPAA is maintained and accurate.<\/span><\/p><ol start=\"6\"><li><b> Enforcing standards through well-publicized disciplinary guidelines<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">As mentioned in element 3 above, HIPAA places great emphasis on employee responsibilities towards protecting health information. Here, organisations are expected to demonstrate that security responsibilities are reflected in employee contracts and associated disciplinary policies and guidelines, which must make it clear to all employees that failure to follow security policies will be disciplined.<\/span><\/p><ol start=\"7\"><li><b> Responding promptly to detected offenses and undertaking corrective action<\/b><\/li><\/ol><p><span style=\"font-weight: 400;\">The organisation must have an <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/\"><span style=\"font-weight: 400;\">incident response plan<\/span><\/a><span style=\"font-weight: 400;\"> which contains procedures for responding effectively to a data breach or other reportable HIPAA violation.<\/span><\/p><h2><span style=\"font-weight: 400;\">Beginning the HIPAA compliance for startups journey<\/span><\/h2><p><span style=\"font-weight: 400;\">HIPPA compliance for startups may feel like a long journey to take, but it is a necessary one if they work with any US-based organisation involved in any part of the healthcare system.<\/span><\/p><p><span style=\"font-weight: 400;\">The important thing is to take it step by step and engage outside help if required. In addition, answering the questions that HIPAA asks can help the organisation become more secure overall, ultimately improving their standing with customers across all sectors.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Any startup who works with a United States healthcare organisation of any kind must demonstrate HIPAA compliance. HIPAA, the Health Insurance Portability and Accountability Act set out in US law in 1996 requires anyone who touches the protected health information of users to appropriately protect the privacy and security of this data. Done properly, demonstrating&hellip;<\/p>\n","protected":false},"author":10,"featured_media":8078,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8047"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=8047"}],"version-history":[{"count":31,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8047\/revisions"}],"predecessor-version":[{"id":8079,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8047\/revisions\/8079"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/8078"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=8047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=8047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=8047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}