CHRIS: So again, this is saying you have to consider these things and you're going to want to document them and you're going to want to be at or above industry best practices for what's reasonable for your organization. And I'm not going to pretend to be a lawyer and try to interpret what this means for your organization. I can tell you, though, that, generally speaking, our objective, when we're working with clients, is to adopt industry HIPAA best practices and utilize those. And this really makes sense because of the way these rules are stated, to just go a little bit above and beyond, if not as much as you substantially can.
If you're documenting that and memorializing it and focusing on these aspects, that we need to ensure the confidentiality, integrity and availability, protect against reasonably anticipated threats to your HIPAA compliant website (security issues or integrity issues with people accessing stuff they shouldn't be able to), protect against impermissible uses or disclosures and ensure compliance by the workforce. So if you have those principles and you're focusing on doing this within the context of what your organization can do and the potential risks to ePHI, you’re really getting at the heart of the Security Rule.
Now, what are some of the mechanics of this? What do they really talk about as mechanical aspects? This gets into the risk analysis and management. So you've got to perform risk analysis and overall security management. They talk about how there should be a risk analysis process that at least includes the following: evaluating the likelihood and impact of potential risk to ePHI data, implementing appropriate security measures to address those risks identified.
Again, you can use these free tools that are on the HHS official HIPAA website. They literally have multiple versions, one from NIST, one from HHS. And these are awesome tools. If you feel like, “Man, I'm lost, I don't feel comfortable doing this,” try downloading one of those tools and going through it. It literally has a step by step set of instructions.
As Ron mentioned earlier, with Accountable HQ, we also have a video walking you through that step by step and do a simulated example going through this assessment. So please, please do not let yourself feel overwhelmed by this information. You can walk through this and get through this process. So you want to evaluate the likelihood and impact and then implement measures to address those risks that you identify, document the chosen security measures, and then maintain continuous and reasonably appropriate security protections.
They're basically saying assess the risk, come up with the plan, implement it, document that plan, and then keep doing that. That's the summary. And then some of the things that they go into are extremely helpful. I'm just going to sort of bullet through these. There are different categories of aspects they talk about.
One is administrative safeguards: HIPAA security management process, security personnel, information access management, workforce training and management, and evaluation. And these are probably some of the biggest challenges that folks have. I would say training your team is one of the biggest weak spots with any security in general. Having a process and constantly evaluating and then having some form of feedback loop around who has access to what information, being able to modify their roles, and having a dedicated person. They say a covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.
Now, a lot of times people will hear that and they'll think someone has to do this as a full-time job. That's not the case. They can do other things. But generally speaking, based on the size of your organization, you know you're going to need someone who has the time and resources to be responsible for developing and implementing your security policies and procedures.