CHRIS: We have a series of videos that go into the different Cloud hosting providers and general infrastructure side of complying using HITRUST. Whether you're AWS. or Google Cloud or Azure, we have detailed information on complying with HIPAA using HITRUST within all of those environments. So that might be really helpful.
Ultimately, a lot of folks that are watching this, you might be overwhelmed just by hearing me talk about all these details. Usually, the best thing that you can do is to work with an expert who specializes in this and even share this video with them if you'd like, we would love for you to take advantage of it and utilize it. We have detailed guides, and obviously we're going from the HHS offical HIPAA website and essentially bringing you a summary of that so you can collaborate with folks like ourselves. We offer a complimentary discovery, and we really encourage you to use the resources on the HHS website. Reach out to folks like us who offer these complimentary discoveries and just get answers to the questions that you have so that you can sleep well at night when it comes to the Security Rule,
There are some details and complexities. But also keep in mind that, right out of the gate, they state very clearly that it is variable based on what your organization can bear. They don't want to inhibit your ability to implement new technology and improve the care that you're giving patients. So there has to be a healthy balance there. Any thoughts on this one, Ron, before we move on to HIPAA enforcement?
RON: Gosh, yeah, there's so much there. I think you said it really well. I love the bank example. I always use an x-ray technician example, right? An x-ray technician, when they take my x-ray and they evaluate it and they upload the results, they obviously need access to my record. But they shouldn't be able to go into my record and see that whatever I have—diabetes or whatever—they shouldn't be able to have access to that other information. And that's what they're talking about, to get very specific. A teller would never have access to go look in my safe deposit box. So that's where people, especially with the size of the organization, get hung up.
I've been going to [my doctor] for 20 years, it's him and his nurse. The great thing about him is, he's old-school, he's got the folders. So every time he walks in, he reaches back and grabs my two-inch folder. everything is printed out, and it's there. Well, [the Security] Rule doesn't apply. Most of this rule doesn't apply to him, because if you remember what Chris said, it was the ePHI data and the electronic distribution and the ease of being able to breach, gain access to that information and wrongfully share that information.
Well, if he only has a printed copy in his office and it's physically locked and he and his nurse are the only two that have access to that, there's a lot less risk there. So that's what they're saying is that you can go in and say, “Okay, well, maybe instead of spending $20,000—and I'm making up numbers here—to set up all these different roles, maybe I only allow the PAs and the doctors, who do have the right to see everything, access to the record. And then the x-ray technician will give me the results and I, as the PA, would upload that into Ron’s [record]. Then I have to spend a whole bunch of money creating and monitoring all these different roles.