Test Your Knowledge
HIPAA Security Quick Reference
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting sensitive patient health information. This guide covers the Security Rule requirements, breach notification obligations, and a practical compliance checklist for healthcare IT professionals.
Key Definitions
| PHI | Protected Health Information - any individually identifiable health information held or transmitted by a covered entity (includes name, DOB, SSN, medical records, billing info linked to health data) |
| ePHI | Electronic PHI - PHI that is created, stored, transmitted, or received electronically |
| Covered Entity | Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically |
| Business Associate | Any person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity (cloud providers, billing companies, IT contractors) |
| BAA | Business Associate Agreement - required contract between a covered entity and business associate that establishes permitted uses and disclosures of PHI |
| Minimum Necessary | Only the minimum amount of PHI needed to accomplish the intended purpose should be used or disclosed |
The 18 PHI Identifiers
HIPAA defines 18 types of information that qualify as PHI when linked to health data:
Names
Geographic data
Smaller than state level
Dates
Birth, admission, discharge, death
Phone numbers
Fax numbers
Email addresses
SSN
Medical record numbers
Health plan beneficiary #
Account numbers
Certificate/license #
Vehicle identifiers
Device identifiers
Web URLs
IP addresses
Biometric identifiers
Full-face photographs
Any other unique ID
Security Rule: Three Safeguard Categories
The HIPAA Security Rule requires covered entities and business associates to implement safeguards in three categories to protect ePHI:
Administrative Safeguards (§164.308)
Security Management Process
Conduct risk assessments, implement risk management policies, apply sanctions for violations, and review system activity.
Assigned Security Responsibility
Designate a security official responsible for developing and implementing security policies and procedures.
Workforce Security
Implement procedures for authorization, supervision, clearance, and termination of workforce members who access ePHI.
Information Access Management
Implement role-based access controls. Grant access only to ePHI necessary for job functions.
Security Awareness Training
Provide regular security training including phishing awareness, password management, log-in monitoring, and malware protection.
Contingency Plan
Establish data backup, disaster recovery, and emergency mode operation plans. Test and revise periodically.
Physical Safeguards (§164.310)
Facility Access Controls
Limit physical access to facilities with ePHI. Implement badge access, visitor logs, and locked server rooms.
Workstation Use & Security
Define proper workstation use policies. Implement physical safeguards to restrict access to workstations with ePHI.
Device and Media Controls
Govern receipt, removal, disposal, and re-use of hardware and electronic media containing ePHI. Require encryption and secure wiping.
Technical Safeguards (§164.312)
Access Control
Implement unique user identification, emergency access procedures, automatic logoff, and encryption/decryption of ePHI.
Audit Controls
Implement hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI.
Integrity Controls
Implement policies and procedures to protect ePHI from improper alteration or destruction. Use checksums and digital signatures.
Transmission Security
Implement technical measures to guard against unauthorized access to ePHI transmitted over networks. Use TLS/encryption.
Authentication
Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be. Use MFA where possible.
Breach Notification Rule
When a breach of unsecured PHI occurs, specific notification requirements apply:
| Requirement | Timeline | Details |
|---|---|---|
| Individual Notice | 60 days | Written notice to affected individuals within 60 days of discovering the breach |
| HHS Notification | 60 days / Annual | Breaches affecting 500+ individuals: notify HHS within 60 days. Smaller breaches: annual log submission. |
| Media Notice | 60 days | Breaches affecting 500+ residents of a state: notify prominent media outlets in that state |
| Business Associate | 60 days | BAs must notify the covered entity of breaches without unreasonable delay (max 60 days) |
Safe Harbor: If PHI is encrypted per NIST standards and the encryption key is not compromised, the data is considered "secured" and breach notification is not required.
Business Associate Agreements (BAAs)
A BAA is required whenever a covered entity shares PHI with a third party. Key requirements:
- Define permitted and required uses/disclosures of PHI
- Require the BA to implement appropriate safeguards
- Require the BA to report breaches and security incidents
- Require the BA to ensure any subcontractors also sign BAAs
- Require return or destruction of PHI at contract termination
- Authorize termination if the BA violates the agreement
Penalty Tiers for Non-Compliance
| Tier | Knowledge Level | Per Violation | Annual Maximum |
|---|---|---|---|
| Tier 1 | Unaware (and would not have known by exercising reasonable diligence) | $137 - $68,928 | $2,067,813 |
| Tier 2 | Reasonable cause (not willful neglect) | $1,379 - $68,928 | $2,067,813 |
| Tier 3 | Willful neglect (corrected within 30 days) | $13,785 - $68,928 | $2,067,813 |
| Tier 4 | Willful neglect (not corrected) | $68,928+ | $2,067,813 |
Criminal penalties: Knowingly obtaining or disclosing PHI can result in fines up to $250,000 and up to 10 years imprisonment.
Healthcare IT Compliance Checklist
Risk Assessment & Management
- Conduct annual risk assessment identifying threats to ePHI
- Document risk analysis results and remediation plans
- Review and update policies at least annually
- Maintain an inventory of all systems that store, process, or transmit ePHI
- Evaluate risks when implementing new systems or technologies
Access Controls & Authentication
- Assign unique user IDs to every workforce member
- Implement role-based access control (RBAC) for ePHI systems
- Deploy multi-factor authentication for remote access
- Configure automatic session timeout/logoff
- Implement emergency access ("break the glass") procedures
- Review access rights quarterly and upon role changes
Encryption & Data Protection
- Encrypt ePHI at rest (AES-256 recommended)
- Encrypt ePHI in transit (TLS 1.2+ required)
- Encrypt portable devices and removable media
- Implement secure email for PHI transmission
- Use NIST-validated encryption modules
Audit & Monitoring
- Enable audit logging on all systems with ePHI
- Log access to patient records (who, when, what)
- Review audit logs regularly for unauthorized access
- Retain audit logs for at least 6 years
- Implement intrusion detection/prevention systems
- Monitor for unusual data access patterns
Backup & Disaster Recovery
- Perform regular backups of ePHI (encrypted)
- Store backups in a secure, off-site location
- Test restoration procedures at least annually
- Document and test disaster recovery plan
- Define RPO (Recovery Point Objective) and RTO (Recovery Time Objective)
HIPAA vs. Other Frameworks
| Aspect | HIPAA | GDPR | PCI DSS |
|---|---|---|---|
| Scope | Healthcare data (PHI) in the US | Personal data of EU residents | Payment card data globally |
| Applies To | Covered entities & BAs | Any organization processing EU data | Any org handling cardholder data |
| Breach Notification | Within 60 days | Within 72 hours | Varies by card brand |
| Max Penalty | ~$2M/year + criminal | 4% of global revenue | $100K/month + penalties |
| Encryption | Addressable (strongly recommended) | Appropriate technical measures | Required for stored/transmitted data |
Frequently Asked Questions
What is the HIPAA Security Rule?
The HIPAA Security Rule establishes national standards to protect electronic protected health information (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.
What are the HIPAA safeguard requirements?
HIPAA requires three categories of safeguards: administrative (risk analysis, workforce training, contingency planning), physical (facility access controls, workstation security, device disposal), and technical (access controls, audit controls, transmission security, encryption).
What happens if an organization violates HIPAA?
HIPAA violations can result in civil penalties from $100 to $50,000 per violation (up to $1.5 million per year), criminal penalties including fines up to $250,000 and imprisonment, and mandatory breach notification to affected individuals, HHS, and media for breaches affecting 500+ individuals.
Need Detailed HIPAA Implementation Guides?
For comprehensive tutorials and compliance audit preparation:
Visit FixTheVuln.com →