5 Ways Business Associates and Covered Entities Can Prepare for HIPAA Compliance
by Sarah Harvey / October 25th, 2018
In an industry that is based on customer trust, the healthcare industry must take the appropriate measures to ensure HIPAA compliance. The integrity of the industry relies on keeping Protected Health Information (PHI) just that: protected. HIPAA non-compliance means more than just organizational, financial, and reputational implications for healthcare organizations, it could be life-threatening to patients. And with more and more healthcare security breaches being reported to the HHS, it’s more important than ever for covered entities and business associates to be HIPAA compliant.
How Can Business Associates and Covered Entities Prepare for HIPAA Compliance?
To start preparing for HIPAA compliance, we suggest that organizations begin with conducting a risk analysis. Understanding the risks associated with using PHI is critical to understanding where your organization has the greatest exposure. A formal risk analysis is a starting point for understanding what risks threaten your organization. These are the three basic steps to a risk analysis:
- Plan: Determine your goals, identify your team, establish your scope, and begin to gather information that you’ll need during the analysis.
- Conduct: Identify potential threats and vulnerabilities, determine the likelihood of threat occurrence, determine the potential impact of threat occurrence, evaluate current controls, determine the level of risk, and finalize documentation.
- Use: Create an internal report, give management the chance to analyze the findings, take corrective action, and provide direction for monitoring and auditing activities.
Once a risk analysis has been conducted, business associates and covered entities should review contracts. This is because, in order to maintain compliance, business associates and covered entities must enter into a Business Associate Agreement. A Business Associate Agreement must include the following elements:
- Uses
- Least Accesses Necessary
- Safeguards
- Incident Reporting
- Disclosure
- Privacy Rule Considerations
- HHS Availability
- Subcontractors
- Termination
Are you ready to begin your journey toward HIPAA compliance?
