What is required for HIPAA compliance?
Here's a brief overview of the HIPAA requirements for covered businesses:
- Implement policies and procedures to protect the privacy of protected health information (PHI);
- Implement data security measures to ensure the confidentiality, integrity, and availability of electronic PHI (e-PHI) through administrative, physical, and technical safeguards;
- Provide notice of privacy practices to patients, detailing how their information can be used and their rights concerning their PHI.
- Ensure patients' rights to request privacy protections, access their PHI, request amendments to their PHI, and receive an accounting of disclosures;
- Use or disclose the minimum amount of PHI necessary to accomplish the intended purpose;
- Train workforce members on HIPAA policies and procedures and manage them to ensure compliance;
- Enter into contracts with business associates to ensure they protect the PHI they create, receive, maintain, or transmit;
- Implement procedures to identify, respond to, and document security incidents and breaches and notify affected individuals and authorities as required;
- Maintain documentation of HIPAA compliance efforts, including policies, procedures, and training materials, for a minimum of six years;
- Regularly review and update HIPAA policies and procedures to comply with changes in the law and ensure continuous protection of PHI.
GDPR vs. HIPAA: Similarities and Key Differences
The main difference between the GDPR and HIPAA is that HIPAA applies only to the processing of health data, while the GDPR applies to all personal data. And this looks like a huge difference.
However, when comparing the requirements of both laws about health data, it becomes clear that they follow very similar, if not the same, standards for health data protection.
Now onto the details. Both laws require the following:
- The implementation of robust data security measures to prevent data breaches and unauthorized access to protected data;
- Process only the minimum amount of data for the purposes you have for processing.
- Responding to requests to know, access, or erase their data and other types of requests by patients and data subjects;
- Serving data subjects with privacy notices explaining data privacy practices;
- Data breach reporting;
- Having data breach notification policies in place;
- Training the workforce on data security and privacy;
- Have written contracts with data processors or business associates, i.e., third-party persons who get access to the protected data.
In addition, the GDPR also requires appointing a Data Protection Officer and bans unsafe international data transfers.
Unlike HIPAA, GDPR sets requirements related to conducting a data protection impact assessment for processing sensitive data. It may not be explicitly required in every single case, but it will be a good practice in all cases.
HIPAA is focused on health-related data only. It does not apply to all the personal information, but only to the one related to patients.
