Protecting patient privacy and securing sensitive health information is paramount in the healthcare industry.  As a HIPAA-covered entity (CE), it is crucial to have robust policies and procedures in place to ensure compliance with HIPAA regulations.  In this blog post, we will explore seven essential policies and procedures that every HIPAA CE should have.  These policies include privacy, security, breach notification, employee training, business associate agreements, access and authorization, and data retention.  By implementing these policies, CEs can safeguard PHI, maintain compliance, and uphold the trust and confidentiality of patient data.

HIPAA Policies vs.  Procedures

One of the most common questions in business, in general, is, “What’s the difference between a policy and a procedure?”  It’s easy to get mixed up without a clear understanding of their differences.  Many businesses that do not understand what should be contained in each end up placing things in policies that should be in procedures, and vice versa.  So, before we get into the seven HIPAA policies, let’s do a quick refresher on what constitutes a policy and what constitutes a procedure.

A policy is a high-level statement or principle that provides guidance and direction for an organization.  It outlines the goals, objectives, and rules governing a particular area of operation.  Policies are broad in nature and define the overall approach and intentions of the organization.  For example, a privacy policy establishes the organization’s commitment to protecting patient confidentiality and sets the framework for handling sensitive health information.

On the other hand, a procedure is a detailed step-by-step set of instructions that outlines how a specific task or activity should be performed.  Procedures provide specific guidelines on how to implement the policies effectively.  They describe the actions, methods, and responsibilities that individuals or teams should follow to achieve the desired outcome.  For instance, a procedure might outline the steps to securely access and transmit electronic patient records or provide instructions on incident response in the event of a security breach.

Policies provide the guiding principles and rules, while procedures give specific instructions and actions to carry out those principles in practice.  Policies set the direction, while procedures define the operational details necessary to adhere to the policies.  Both policies and procedures are essential for maintaining consistency, compliance, and effective operations within an organization.

Policy Structure & Taxonomy

As with most requirements in HIPAA, CEs are given a lot of latitude when it comes to the structure and naming of their policies and procedures.  Indeed, there are no explicit requirements to have policies X, Y, and Z.  Instead, HIPAA provides the requirements for what policies should cover.  As such, CEs and BAs can organize their policies in a way that makes sense for their organization.  Some organizations may elect to structure their policies in such a way that one policy covers multiple topics (for instance, a Security Policy may cover everything related to the technology stack in use at the company), while others may find it more advantageous to parse out the same information into multiple policies.

Ultimately, how your organization approaches this will vary depending on several factors, such as company size, departmental hierarchy, and existing policies & procedures.  As you continue reading, keep in mind that the following seven policies could potentially be organized in many ways; the important thing to keep in mind is what the policies cover, not necessarily what they’re called.

Privacy Policy

The first policy every CE should have is a Privacy Policy.  This policy sets out the entity’s approach to protecting patient privacy and confidentiality.  It could be argued that a Privacy Policy is the basis by which all other policies are informed and created.

A robust Privacy Policy should outline the types of patient information the entity collects and why it’s necessary to collect it.  It should also cover who can access this information, how it is used, and how it’s shared with third-party business associates (BAs).

Other essential elements of a good Privacy Policy include an explanation of patient rights, such as the right to access their data, to restrict the use of their data, and to make changes or corrections to their data.  We’ll discuss the notice of privacy practices at the end of this article.

In short, a Privacy Policy outlines how protected health information (PHI) is collected, used, disclosed, and maintained within the organization.

Security Policy

The Security Policy is one of the most critical policies that every HIPAA-CE should have.  This policy outlines the steps a CE must take to ensure the confidentiality, integrity, and availability of the PHI they handle.

To be effective, a Security Policy should have the following elements:

1. Risk Assessment: The policy should include a comprehensive evaluation of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.  This assessment helps identify areas that require enhanced security measures and guides the development of appropriate safeguards.
2. Administrative Safeguards: This section should address administrative controls and procedures, including the designation of a security officer, roles and responsibilities of personnel, workforce training and security awareness programs, incident response and contingency plans, and policies for managing security incidents.
3. Physical Safeguards: This section should outline physical security measures, such as access controls to facilities and workstations, visitor management, secure storage of physical records, and procedures for the disposal and destruction of physical media containing ePHI.
4. Technical Safeguards: The policy should detail technical security controls, such as access controls to electronic systems, user authentication and authorization, encryption of ePHI, audit controls, integrity controls, transmission security, and measures for monitoring and protecting electronic systems containing ePHI.
5. Incident Response: This section should reference the plan that a CE has in place for identifying, reporting, and responding to security incidents, including the steps to be taken in the event of a suspected or confirmed breach of ePHI.  This includes incident containment, investigation, documentation, and the notification process.
6. Policy Review and Updates: Regular review and update processes should be established to ensure that the security policy remains current, aligns with changes in technology and regulatory requirements, and reflects lessons learned from security incidents or audits.  The policy should outline how often it will be reviewed and who will be responsible for its maintenance.

By having a well-crafted Security Policy, a CE can help safeguard the sensitive PHI they handle and maintain compliance with HIPAA regulations.  It is also essential for CEs to regularly review and update their policies to ensure they remain relevant and effective in the constantly evolving digital landscape.

Breach Notification Policy

A breach notification policy outlines how a CE should respond in the event of a breach of protected health information (PHI).  A breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule, which compromises the security or privacy of the PHI.

A breach notification policy should include the following:

1. Definitions of what constitutes a breach, including the type of information covered.
2. Guidelines for how the CE will investigate a potential breach.  It’s important to note that the breach notification policy is not the place for your incident response plan. Instead, it should reference the incident response plan, which should stand alone as its own document.  Check out our article on creating an effective incident response plan for more information.
3. Notification procedures for informing affected individuals, the Department of Health and Human Services (HHS), and potentially the media, depending on the scope of the breach.
4. Procedures for mitigating the harm caused by the breach, such as offering credit monitoring or identity theft protection services.
5. Responsibilities of CE employees in the event of a breach.
6. Recordkeeping procedures for documenting all breach-related activities.

Any failure to follow breach notification requirements can lead to severe financial penalties and damage to the CE’s reputation.

Employee Training & Awareness Policy

One of the most important aspects of maintaining HIPAA compliance is ensuring that all employees of a CE are well-trained and aware of the necessary policies and procedures.  A comprehensive Employee Training & Awareness Policy should be implemented to achieve this.

This policy should outline the specific training requirements that all employees must undergo, including an overview of HIPAA regulations, privacy and security best practices, and breach notification protocols.  It should also detail the frequency of training sessions and the types of training methods that will be used.

To ensure that employees fully understand the importance of HIPAA compliance, it is also important to include clear consequences for failing to comply with these policies.  This can include disciplinary action, termination of employment, or other sanctions.

In addition to training, the Employee Training & Awareness Policy should outline how employees will be made aware of any updates or changes to HIPAA regulations or policies.  This can include regular newsletters or company-wide meetings.

Employees should undergo refresher training at least annually, when significant updates are made to company policy or healthcare regulations or when an employee moves into a different department.  Our article on the basics of HIPAA security awareness training provides details on what HIPAA awareness training should cover.

Business Associate Agreement (BAA) Policy

One of the most important policies that every HIPAA-CE should have is a Business Associate Agreement (BAA) policy.  A BAA policy outlines the requirements for the CE’s BAs to ensure that they are also complying with HIPAA regulations.  HIPAA defines a BA as a person or organization that performs functions or services on behalf of a CE that involve the use or disclosure of PHI.  Some examples of BAs include billing companies, third-party vendors, and IT companies.

To ensure that PHI is protected and secured, a BAA policy should have the following elements:

1. Identification of BAs: A BAA policy should reference separate documentation that identifies all the BAs that the CE is working with and ensure that they are compliant with HIPAA regulations.  It is not recommended that BAs be listed in the BAA policy since the list of BAs will likely change over time.
2. Requirements of BAs: The BAA policy should provide a high-level list of the requirements that BAs must adhere to in order to remain a vendor/provider of the CE.
3. Due diligence on BAs: The BAA policy should reference a procedure or process that the CE uses to perform due diligence reviews of every BA.  Actions such as assessing privacy and security practices, reviewing BAs own policies and procedures relating to PHI, and reviewing a BAs risk assessment reports are all actions that should be taken.
4. BAA retention: The BAA policy should state where the BAAs are stored and managed and by whom.

Since every BAA may differ slightly in its structure, it may not be feasible to include a sample BAA within the policy.  However, the policy should clearly state the different sections that every BAA policy must have (which should, at a minimum, include all the required elements of a BAA as mandated by HIPAA regulations).  Check out our article on business associate agreements for an in-depth look at what the agreements should contain.

Access & Authorization Policy

Access and authorization are critical components of HIPAA compliance.  This policy outlines the requirements and processes that CEs must follow to control access to PHI.

The Access & Authorization Policy should clearly define who has access to PHI and under what circumstances.  The policy should also specify the access levels for each employee and how to obtain and revoke access as necessary.

The policy should outline the authorization process, including the criteria that must be met before granting access to PHI.  This should include training requirements, background checks, and other qualifications as deemed necessary.

Additionally, the policy should detail the measures in place to protect against unauthorized access to PHI.  This includes monitoring systems and reviewing access logs regularly. 

Data Retention & Disposal Policy

The final essential HIPAA policy and procedure that every CE needs is a Data Retention & Disposal Policy.  This policy outlines how long you should keep sensitive patient information, how to dispose of it securely, and how to comply with state and federal regulations for records retention.

To begin, this policy should detail how long you need to keep specific records based on state and federal regulations.  These requirements can vary based on the type of record and how long it is considered necessary to keep them.  For example, the federal government mandates keeping medical records for a minimum of six years, and after that, they can be securely destroyed.

It’s important to include steps in the policy to ensure that any personal health information is destroyed securely and cannot be accessed by unauthorized individuals.  A straightforward procedure for disposal, whether through shredding or electronic destruction, should be established.  This is particularly important since an unauthorized disclosure of medical records can lead to identity theft, malpractice, and severe consequences for the entity responsible for the breach.

The Data Retention & Disposal Policy should also highlight what items are to be securely disposed of.  Examples could include paper records, electronic health records, billing information, and other related documents that could expose sensitive information about a patient.

The importance of regularly reviewing and updating this policy can’t be understated.  With constantly evolving state and federal regulations and emerging data breaches, it’s crucial to stay current on keeping sensitive patient information secure and protecting the entity from severe consequences.

Bonus: Notice of Privacy Practices

The Notice of Privacy Practices (NPP) is a vital document that outlines the privacy practices of a CE regarding the use and disclosure of protected health information (PHI).  It serves as a communication tool to inform individuals about their privacy rights, how their PHI may be used and shared, and the CE’s obligations under HIPAA.  Although the NPP is not a policy per se, it is a critical piece of documentation that every CE must have.

The NPP is typically provided to patients or individuals at their first encounter with a healthcare provider, such as during registration or onboarding processes.  It is crucial for CEs to develop a comprehensive and easily understandable NPP that adheres to HIPAA requirements.

The NPP should include the following key information:

1. Description of Privacy Rights: The NPP should clearly explain the individual’s rights regarding their PHI.  This includes the right to request restrictions on the use or disclosure of PHI, access their own medical records, request amendments to their records, and receive an accounting of disclosures made by the CE.
2. Permitted Uses and Disclosures: It should outline the circumstances under which the CE may use and disclose PHI without the individual’s authorization.  This includes treatment, payment, healthcare operations, and other permitted uses as defined by HIPAA.  The NPP should also describe any special circumstances where authorization may be required for certain uses or disclosures.
3. Authorization Process: The NPP should explain the process for obtaining an individual’s authorization when their PHI is to be used or disclosed for purposes not covered by permitted uses.  It should outline the required elements of a valid authorization and provide instructions on how to revoke an authorization if desired.
4. Complaint Process: The NPP should inform individuals of their right to file a complaint with the CE and/or with the Office for Civil Rights (OCR) if they believe their privacy rights have been violated.  It should provide contact information for the designated privacy officer or other relevant personnel responsible for handling privacy complaints.
5. Notice Updates: The NPP should include a statement indicating that the CE reserves the right to update or revise the notice and provide instructions on how individuals can obtain the most current version of the NPP.

The HHS website has an excellent set of resources that you can use as a template for your notice of privacy practices.

By providing a clear and comprehensive NPP, CEs promote transparency and empower individuals to make informed decisions about their healthcare and the use of their PHI.  It establishes trust between patients and healthcare providers while demonstrating compliance with HIPAA regulations and commitment to protecting patient privacy.

Conclusion

In conclusion, maintaining compliance with HIPAA regulations is of paramount importance for CEs in the healthcare industry.  By implementing robust policies and procedures, including a comprehensive security policy, organizations can protect ePHI and ensure the confidentiality, integrity, and availability of patient data.  Additionally, the Notice of Privacy Practices (NPP) serves as a critical tool for informing individuals about their privacy rights and how their PHI will be used and disclosed.

Through a combination of strong security measures, clear communication of privacy practices, and ongoing commitment to compliance, CEs can safeguard patient information, build trust, and fulfill their legal and ethical obligations under HIPAA.  By prioritizing HIPAA compliance, organizations can demonstrate their dedication to maintaining the confidentiality, security, and privacy of sensitive health information, ultimately benefiting both patients and the healthcare industry as a whole.

[DIVIDER]

Contact us today to learn more about how MediGuard by Axeleos can help you navigate the complex landscape of HIPAA regulations.  Our experts specialize in developing tailored security policies, conducting risk assessments, and implementing robust security measures to safeguard your organization.  Don’t compromise on the security and privacy of your patient data—reach out to us now and let us guide you towards HIPAA compliance and peace of mind. Contact us today to schedule a consultation and discover how MediGuard can empower your organization in maintaining HIPAA compliance.