HIPAA Compliance Checklist

As more data transitions to digital formats, the risk of a potential breach increases. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) compliance requirements handle administrative, physical, and technical safeguards for protected health information (PHI).

A knowledgeable HIPAA compliance officer and sophisticated IT infrastructure can help you execute them seamlessly. Follow this checklist to improve your compliance.

Administrative Safeguards

Administrative safeguards manage data security through responsibility designation, training, and planning. All covered entities should:

• Conduct risk assessments and gap analysis.
• Develop risk management and mitigation policies.
• Design emergency and contingency plans for disaster recovery and business continuity.
• Create an incident reporting and response protocol to contain them.

Physical Safeguards

Physical measures include those surrounding structures and devices. Some steps include:

• Positioning workstations for maximum data protection and confidentiality.
• Instituting controls for personal mobile devices if permitted to access PHI.
• Limiting physical access to on-site infrastructure to prevent theft or tampering.
• Creating a master inventory of all hardware and its location.

Technical Safeguards

Technical safeguards control data access, transmission, and integrity. Activities include the following:

• Institute access control methods, such as unique user names, passwords, and the principle of least privilege.
• Establish activity logs and audit controls to document who is accessing what information, when, and why.
• Restrict third-party access to PHI.
• Establish data authentication systems to confirm unauthorized alteration or destruction.
• Deploy encryption, decryption, and detection tools for external communications.

HIPAA Privacy Rule To-Do’s

Under the privacy rule, healthcare organizations must:

• Train staff on what information to protect and how.
• Take steps to maintain data integrity.

HIPAA Breach Notification Rule To-Do’s

To limit the potential and impact of a breach, establish processes and systems to:

• Detect and respond to security incidents.
• Organize a post-breach plan at each organizational level.
• Establish a reporting protocol for who, when, and how to notify.

HIPAA Omnibus Rule To-Do’s

The omnibus rule focuses on extending compliance obligations to related business partners. Your checklist for compliance includes:

• Identify business partners who create, maintain, send, receive, process, or access electronic PHI.
• Sign a business associate agreement with each partner detailing their HIPAA-compliant requirements.
• Conduct due diligence about business partners around HIPAA compliance certification.

Learn More About HIPAA Compliance with Agio

Our experts love IT infrastructure so much that we monitor it around the clock. We can help your business with our HIPAA compliance services.

Focus on what you do best while we make your technology faster, easier, and safer. Talk with a team member at 844-974-4877 or connect with us online today.