What Are The Three Rules of HIPAA?

the word rules spelled with scrabble tiles

The Health Insurance Portability and Accountability Act (HIPAA) lays out three rules for protecting patient health information, namely:

  • The Privacy Rule 
  • The Security Rule
  • The Breach Notification Rule

A national standard is established when these three rules are followed, and health information that could be used to identify a person is addressed by these standards and privacy procedures.

Failure to adhere to the three HIPAA rules, compliance obligations, and security policy–or any security breach of electronic information systems through unauthorized access to electronic health records, confidential health, and medical history, or electronically protected health information–can result in civil money penalties (and even criminal penalties), a loss of reputation for healthcare professionals due to intentional violations, and even the loss of employment for an employee.

Businesses can face fines of up to $1.5 million for failing to comply with the law and addressable implementation specifications. As a result, if you are one of the covered entities under HIPAA, you must follow the three HIPAA rules and security management processes, taking appropriate corrective action when necessary.

Why are the three rules necessary?

For Private Healthcare Information (PHI): there wasn’t much of a consensus on what the best practices for PHI should be. But things began to change after the introduction of HIPAA.

In the beginning, there were privacy and security rules. Protected health information (PHI) was the focus of HIPAA’s new standards, which applied to the entire healthcare industry.

In addition to this, HIPAA’s primary goal was to improve the patient experience. Covered entities were given a variety of policies and procedures to ensure that their clients’ information was protected without a lot of hassle. Reduced paperwork, in addition to improving workflow, is a benefit to the covered entity.

To meet HIPAA’s requirements, code sets must be used in conjunction with patient identifiers. Health insurance portability is aided as a result of this ease of information transfer. With the Portability and Accountability Act in mind, healthcare providers are attempting to make the patient’s experience more pleasant.

HIPA’s rules also serve some much more minor purposes. Life insurance loans may be exempt from tax deductions, depending on the circumstances. It also improves the efficiency of healthcare services and makes it easier for patients to interact with them.

Who needs to have HIPAA compliance?

Private hospitals, health insurance companies, medical discount providers, and other business associates are all included in the scope of HIPAA’s application.

This type of business is known as  “covered entities,” and must abide by the HIPAA regulations and security standards. Exceptions to the HIPAA rules for covered entities are extremely rare.

A company or organization that provides third-party health and human services to a covered entity must adhere to the HIPAA regulations. As “business associates,” these companies are subject to the same regulations as the covered entities, even though they do not provide direct services.

The business associate agreement must be signed by both business associates and covered entities. Before undergoing any procedures, the confidentiality and integrity of PHI must be preserved, and the business associate agreement does that.

The three main rules of HIPAA

As mentioned earlier in this article, HIPAA legislation is made up of a few rules that outline what you must do to comply with the law. We’ll now discuss them in detail below:

1. The HIPAA privacy rule

HIPAA defines the circumstances under which a person may disclose or use PHI. Everyone has a right to privacy, but as we all know, there are some situations in which the rule might be applied. Those who are covered by this policy must adhere to a set of rules.

The standards set by the privacy rule address subjects such as: 

  • Which organizations must follow the HIPAA standards
  • What is protected health information (PHI)
  • How organizations can share and use PHI
  • Permitted usage and disclosure of PHI
  • Patient’s rights over their health information

In 2003, the HIPAA Privacy Rule was first put into place. That includes healthcare providers, as well as clearinghouses, and other health insurance entities. Healthcare-related business partners joined the list in 2013.

For the most part, the rule on patient privacy restricts the extent to which medical records can be shared without explicit consent. Allows patients and their next of kin (representatives) to access their medical records under the HIPAA privacy rule These requests for access and disclosure must be responded to within 30 days of receipt by the Covered Entities. 

Healthcare entities covered by HIPAA include:

  • Health plans 
  • Health care clearinghouses 
  • Health care providers 

The privacy rule restricts the usage of health information, which could identify a person (PHI). Covered entities cannot use or disclose PHI unless:

  • It’s permitted under the privacy rule, or
  • The individual has authorized it in writing.

The privacy rule does not restrict de-identified health information. 

2. The HIPAA security rule

The HIPAA Security Rule sets out the minimum standards for protecting electronic health information (ePHI). To access that information in electronic format, even those who are technically capable of doing so would have to meet those standards.

The HIPAA security rule covers the following aspects:

  • The organizations that may need to follow the security rule and be deemed covered entities.
  • Safeguards, policies, and procedures that can be put in place to meet HIPAA compliance
  • Health care information that is under the protection of the security rule

To put it simply, anyone who is part of the BA or CE and can access, alter, create or transfer recorded ePHI will be required to follow these standards. These technical safeguards will involve NIST-standard encryption in case the information goes outside the firewall of the company. 

In addition to technical safeguards, the security rule will include several physical safeguards. If you’re in a public area, you won’t be able to see the screen because of a workstation layout. Only a specific area within the company’s network allows you to do this.

Administrative safeguards are also checked, and they are combined with the security rule and the privacy rule. A privacy officer and a security officer are required to conduct regular (an ongoing process) audits and risk analyses as part of these safeguards.

These evaluations are critical to the safety of the system. When considering possible threats to the PHI, they don’t care if it’s just a theory. Consequently, they plan to implement a risk management plan based on it to avoid any potential risks that could occur in the future. 

A covered entity must take the following steps to ensure the security of all ePHI they create, send, or receive:

  • Ensure the confidentiality integrity and availability of the PHI
  • Protect against improper uses and disclosures of data
  • Protect the ePHI against potential threats, safeguarding their medical records
  • Train employees so that they are aware of the compliance factors of the security rule
  • Adapt the policies and procedures to meet the updated security rule

Confidentiality, integrity, and availability rules in health care must be met by the covered entity.

3. The HIPAA breach notification rule

Occasionally, there may be a breach. The breach notification rule comes into play here. The Department of Health and Human Services must be informed as soon as possible if there has been a data breach. Regardless of the nature of the breach, this must be done within 60 days of its discovery, this is where a good risk management plan comes in handy.

If a breach during administrative actions involves a person‘s personal information, that person must be notified within 60 days of the discovery of the breach.

In the event of a large-scale breach that affects more than 500 patients in a specific jurisdiction, the media should be informed as well.

An immediate announcement of a privacy violation is required by the HIPAA rule for breach notification. The Office for Civil Rights may impose fines if you don’t comply.

Alternatively, the Covered Entity may decide not to send a breach notification if it can show that the critical element of the PHI has not been compromised. A violation of privacy and security rules would be warranted if they are found to have been compromised.

Reportable Breaches and Exceptions

A breach of PHI occurs when an organization uses or improperly discloses PHI. However, they are only required to send alerts for PHI that is not encrypted. In addition to this, there are three additional circumstances in which the breach notification rule is more lenient, during such compliance violations and PHI breaches.

  1. If it was unintentional or done in good faith, and was within the scope of the authority.
  2. If it was done unintentionally between two people permitted to access the PHI.
  3. If the organization has a good faith belief that the person to whom the disclosure was made would not be able to retain the PHI.

Under such a case, the organization should ensure that such incidents don’t reoccur and take corrective action plans. Breach alerts are required only for unsecured PHI. If you secured it as specified by this guidance, then you don’t need to send the alerts. 

Partner with Wheelhouse IT 

You may believe that you can meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA) on your own, and you may be right. A HIPAA-verified Managed Service Provider (MSP) makes it much easier to achieve HIPAA compliance than if you were to do it on your own.

To keep your organization and in-house IT department HIPAA compliant, you can rely on Wheelhouse IT. Some of the benefits of working with us include:

  • Conducting HIPAA security risk assessments
  • Encrypting all PHI and stored data
  • Implementing backup and disaster recovery plans to keep data secure
  • Identifying system vulnerabilities and providing high-quality solutions
  • Providing the necessary technology to ensure data security
  • Providing services such as Remote Monitoring Management (RMM), cloud-to-cloud backup, and authentication and access control

WheelHouse IT is ready to help your business navigate HIPAA compliance.

If you are looking for the assistance of an MSP for your HIPAA compliance needs, book time on our calendar below.

The Silent Threat Looming Over Small Medical Practices: A Closer Look at the Importance of HIPAA Compliance

Medical Record Breach

In recent news, McLaren Health, a large health system with 15 hospitals in Michigan, faced a crippling ransomware attack in August 2023. Affiliates of the ALPHV/BlackCat ransomware group were responsible, boasting that they managed to siphon off the sensitive data of nearly 2.5 million patients. But while such incidents often make the headlines because they involve big names, it’s essential for smaller medical practices to recognize that they’re not immune to such risks.

Why Should Smaller Practices Be Concerned?

The magnitude of the McLaren Health breach might feel distant for a small practice, but the principles of the attack and the vulnerabilities exposed are the same, regardless of size. Many smaller medical practices mistakenly believe they’re “too small” to be targeted. However, cybercriminals are often more attracted to smaller entities because they perceive them as having weaker security defenses.

Understanding the Full Impact of Such Breaches

The fallout from the McLaren Health incident was immense. Patient names, IDs, Social Security numbers, and a plethora of other sensitive information were compromised. This breach led to a series of class action lawsuits, accusing the health system of not having the necessary safeguards in place.

Imagine the ramifications for a smaller practice. While the number of affected patients might be lower, the proportional damage to the practice’s reputation and finances could be devastating.

 

 

A Wake-Up Call to Medical Professionals

If you’re a medical professional, especially within a smaller practice, it’s time to ask some hard questions. Are you confident in your current security measures? Are your patient’s privacy and your reputation protected from potential breaches? The HIPAA Journal’s confirmation of the depth of the McLaren breach underscores the critical nature of these questions.

Michigan Attorney General Dana Nessel’s statement rings true for all medical entities, big or small: “Organizations that handle our most personal data have a responsibility to implement safety measures that can withstand cyber-attacks.”

The Potential Financial and Legal Impacts

Beyond the obvious ethical responsibility to protect patient data, there are real financial and legal consequences. McLaren Health is battling multiple lawsuits, with plaintiffs alleging negligence, breach of fiduciary duty, and violations of various acts, including the Health Insurance Portability and Accountability Act (HIPAA).

Smaller practices need to understand that in the eyes of the law, their responsibility is the same as that of larger entities. The potential fines, legal battles, and reputational damage could irreparably harm a small medical practice.

Secure Your Practice with WheelHouse IT

With a strong emphasis on healthcare IT solutions, WheelHouse IT understands the unique challenges that medical practices face. If you’re concerned about the safety of your patient data or if you’re unsure about your HIPAA compliance status, now is the time to act.

The digital realm is fraught with risks, but with the right precautions and an expert IT partner, you can ensure the safety of your patient data and the reputation of your practice. Let’s work together to ensure you’re not just compliant, but truly secure.

Rory Signature
Rory A. Cooksey is the Director of Growth for WheelHouse IT

MGM A Wake-up Call for Business Leaders

MGM Grand Las Vegas Hotel and Casino

MGM, one of the leading resort giants, is reeling from the aftermath of a damaging cyberattack that occurred in September. The assailants successfully accessed a vast amount of personally identifiable information (PII) from MGM’s clientele, an incident that the company anticipates will lead to a staggering $100 million loss.

In a recent filing with the Securities and Exchange Commission (SEC), MGM detailed the uncertainty surrounding the comprehensive costs of this breach. The silver lining, if any, for the company is its belief that its cyber insurance policy might absorb the majority of the financial fallout.

The compromised data includes customer names, contact details such as phone numbers, emails, postal addresses, genders, birth dates, and driver’s license numbers. More alarmingly, a subset of customers also had their Social Security and passport numbers fall into the wrong hands. The variation in the types of information accessed differs from one individual to another. On a positive note, MGM has assured its customers that critical data like passwords, bank account numbers, and payment card details remained untouched. Additionally, there hasn’t been any identified incident of identity theft or fraudulent activities stemming from this breach.

MGM has been proactive in its response. Collaborating with top-tier cybersecurity experts, the company is working diligently to fortify its digital defenses, signaling its commitment to preventing future breaches. Interestingly, MGM has remained silent on the topic of ransom demands. Yet, sources like The Wall Street Journal suggest that MGM stood its ground, refusing to cave to the hackers’ demands. This is in contrast to Caesars Entertainment, another victim of a similar attack, which is rumored to have parted with a significant sum to stop the exposure of their stolen data.

A Legal Nightmare: The Ripple Effect of the Attack

In the aftermath of the cyber intrusion, MGM finds itself embroiled in six class action lawsuits filed in Nevada District Court. These suits argue that MGM and Caesars Entertainment neglected to secure the personal identifiable information of their loyalty program members. The allegations are grave, suggesting that both entities’ oversights led to sensitive customer data being hijacked by malicious ransomware culprits.

Highlighting the global nature of cyber threats, Eastern European hacker groups, namely ALPHV and Scattered Spider, have declared their involvement in these attacks.

Why This Should Alarm Business Leaders Everywhere

This incident isn’t just a cautionary tale for MGM and similar entities; it’s a stark warning for businesses across the board. Here’s why:

  1. Financial Implications: MGM’s projected loss of $100 million demonstrates that the financial repercussions of a cyberattack can be debilitating. It’s not just about immediate losses; a company’s brand value and future revenue can also take a significant hit.

  2. Legal Challenges: The six class action lawsuits against MGM underscore the growing trend of businesses being held legally accountable for data breaches. This adds an extra layer of potential financial and reputational damage.

  3. Trust and Loyalty at Stake: A company’s relationship with its customers is built on trust. Once that trust is broken, as seen with MGM’s breach, regaining it is a Herculean task.

  4. Global Threat Landscape: The involvement of international hacker groups signifies that cyber threats are borderless. Businesses must be prepared for attacks from any corner of the world.

In conclusion, MGM’s predicament serves as a potent reminder of the dire consequences that arise from not adequately securing one’s digital assets. In an era where data is king, businesses must invest robustly in cybersecurity measures to safeguard their customers, reputation, and bottom line.

Rory Signature
Rory A. Cooksey is the Director of Growth for WheelHouse IT

The Growing Influence of AI in Sophisticated Social Engineering Attacks

Robot hands point to laptop button advisor chatbot robotic artif

In the rapidly evolving world of technology, Artificial Intelligence (AI) has emerged as the pivotal factor driving revolutionary changes, notably in the realm of cybersecurity. By leveraging AI’s unmatched ability to process vast amounts of data and adapt dynamically, cyber adversaries are now unveiling a new age of social engineering attacks. Where once these tactics depended predominantly on human touch, they are now being automated, becoming remarkably concealed in the process.

Deciphering the Impending Risk

At its core, social engineering is the art of exploiting human emotions and trust to deceive. It masterfully plays upon our feelings, beliefs, and perceptions. With AI in the mix, the scale and precision of these deceitful maneuvers are amplified exponentially.

  • Deepfakes – A New Face of Deception: The rise of deepfakes, AI-engineered videos and images, presents a novel set of challenges. By eerily replicating familiar personalities, deepfakes have the power to disseminate deceptive narratives, fuel political unrest, or even facilitate targeted extortions.

  • The AI-Powered Charade on Social Media: Ever-increasing numbers of AI-controlled bots are populating social media networks, perfectly imitating real users. Their primary objectives are multi-fold – from influencing public sentiment and magnifying controversial subjects to spreading blatant untruths. The sophistication with which they mimic human behavior makes them exceptionally hard to identify.

AI’s Magnification of Repercussions

  • Tarnishing Brands and Identities: The conventional misinformation campaigns had their bounds. However, AI, through its deep data analysis, can tailor misinformation to resonate with specific demographics. AI-generated content, especially deepfakes, can create an unsettling ambiguity, blurring the demarcation between truth and fabrication, resulting in significant reputation setbacks.

Crafting a secure future in this dynamic landscape demands a comprehensive understanding of these threats and the development of robust countermeasures. As we move forward, partnering with experts like WheelHouse IT can be instrumental in safeguarding against the evolving challenges presented by AI in cybersecurity.

Rory Signature

Why You Need an Incident Response Retainer!

A small business owner sitting at their desk

Oh, hello there, curious minds! Rory here, dropping by to spill some tea on the utterly riveting topic of Cyber Incident Response Retainers. Sit tight; it’s about to get wild!

So, ever been to a bonkers party and thought, “Wish they hired some bouncers”? Well, enter the world of Cyberattacks, where the parties are uninvited, and the damages are through the roof. The bouncers here? They’re your Cyber Incident Response Retainers.

What’s this Fancy Retainer Thing?

Picture this: You pay a fee, and a team of external cyber guardians promises to come to your rescue when the digital boogeyman hits. They’re like your cybersecurity Avengers, ensuring that the cyber nuisance doesn’t snowball into a full-blown crisis. This agreement, my friends, is what the cool kids call an Incident Response Retainer.

It’s not just about having a hero squad on speed dial. It’s about having a deal that outlines how fast your cyber defenders will swoop in and how much of their time they’ll dedicate to saving your digital day – all at a rate pre-negotiated, typically with your cyber insurance carrier. And if you’ve got a retainer, the onboarding process with your response team is usually smoother, letting them familiarize themselves with your unique digital landscape before the chaos hits.

Why Bother with Retainers?

“Cyber Incidents? Those will never happen to us!” said no one ever. Cyber mishaps are more a matter of ‘when’ than ‘if.’ Even with your very own in-house security gurus or outsourced managed security service provider, when the going gets tough, external experts might just be the additional muscle you need.

Plus, many cyber insurance policies are playing hard to get. They want to see a commitment – an Incident Response Retainer – even to consider having a relationship with you! It’s like being asked if you have a job on the first date.

And guess what, these retainers aren’t just for the big leagues. Small companies might think, “We’re small fries; who’d bother hacking us?” But in reality, they are often the ones who can’t afford not to have a retainer. Large organizations might have the bandwidth and frequency of incidents to keep an internal team on their toes, but even they might need external reinforcement when things hit the fan.

So, What’s Inside the Retainer Box?

If an IR Retainer was a pizza, it would be loaded! You get a full-blown strategy, 24/7 access to cyber wizards, established communication channels, support for remediation, a plethora of forensic tools, training programs, and more. It’s like having a comprehensive survival kit in the wild wild web.

To Buy or To Build?

Oh, the eternal conundrum! To concoct your own cyber-secure concoction or to outsource the magic potion? While some may prefer concocting their spells, others might find solace in having a third-party wizard to whip up the magic, especially considering potential legal liabilities. It’s essential to weigh the pros and cons, consult your legal team, and ensure all actions align with your insurance carrier’s whims and fancies.

Final Nuggets of Wisdom

Whether you’re a colossal corporation or a budding startup, Cyber Incident Response Retainers can be your secret sauce in navigating the tumultuous seas of the internet. They can be the beacon of light, showing the way when the digital darkness hits.

So, there you have it! The world of IR retainers unveiled by yours truly. Remember, in the cyber jungle, it’s better to have a retainer and not need it than to need a retainer and not have it. Stay cyber-savvy, folks!

 

Rory Signature