Large and medium-sized Healthcare organizations spend around $40K a year to conduct HIPAA risk assessment and compliance audits, and they have a dedicated security officer or privacy officer on staff. But small medical practices can’t afford that!
How can YOU know where you stand, and avoid HIPAA violations?
Controlling and documenting who has access to Protected Health Information (PHI), may be a manageable task. But actually enforcing the HIPAA security rule across your network, servers, devices and applications is beyond most medical practice owners, even many IT support staff. Truth is most practices are out of compliance, and don’t even know it. To know where you stand, you must conduct regular a HIPAA risk assessment – ideally annually.
Many small practices are so overwhelmed they simply do nothing!
If you haven’t audited your IT infrastructure for HIPAA compliance against the HIPAA security rule, within the last 18 months, you could easily be at risk of HIPAA violations. For example, if you have begun using Wi-Fi and mobile devices in your medical practice, since your last assessment, your risk exposure has likely doubled. Did you implement extra measures to lock down personal devices, and wipe the disk if it gets lost, stolen or passed down to another user?
Be honest now, when did you last do a proper risk assessment?
There are so many angles – so many ways to run foul of the law. So really, when did you last check yourself out? Do you think cyber criminals have stood still since you did? The only way to truly know where your IT Security stands is a regular risk assessment.
The HIPAA Security Rule decoded
- Administrative Safeguards (HIPAA § 164.308)
- Physical Safeguards (HIPAA § 164.310)
- Technical Safeguards (HIPAA § 164.312)
- Organizational Requirements (HIPAA § 164.314)
- Policies, Procedures and Docs (HIPAA § 164.316)
How does the HIPAA Security rule translate into your everyday use of IT and the security measures you take?
Read a plain-English overview of how these “rules” relate to your IT and security policies, and learn what elements we examine to check for non-compliance or vulnerabilities.
What is involved in a HIPAA Risk Assessment?
We will assess the IT security measures in place to protect electronic Protected Health Information (ePHI), identify any aspect of your IT security that is lacking, and give you a point-by-point remediation plan to get you back into compliance.
