Filter by Category

How to Build a Framework for HIPAA and HITECH Compliance

A checklist is flanked by a shield and a question mark.

HIPAA, established in 1996, was signed into law to outline the appropriate ways to use and disclose patient health information. Read on to learn how to develop a HIPAA- and HITECH-compliant IT framework for your organization.

Why Does HITECH Exist?

HITECH laws were enacted to up the ante on healthcare organizations to meet HIPAA legal compliance for data security and privacy, which, of course puts an additional burden on IT to make sure all bases are covered.

Regardless of the rigors of enacted laws, compliance doesn't happen overnight. It takes diligence and continued effort to understand and address all necessary requirements. To avoid the potential penalties of breaking HIPAA and HITECH laws, losing the confidence of patients and partners, and incurring hefty penalties, a focused, deliberate, measured plan is essential.

Getting Started with HITECH and HIPAA Compliance

In addition to becoming familiar with HIPAA and HITECH regulations (a good place to start is the HHS.gov website), it's critical to meet with your security and management team and make decisions as to how your organization can best protect sensitive healthcare information.

Step 1: Update or Document Your Policies and Procedures

One of the first places to start this process is to fully document your department's own security policy and procedures. This provides the foundation from which to train internal users in understanding and complying with HIPAA and HITECH. In fact, having your security policies documented is a requirement of HIPAA and HITECH.

If you don't currently have your security policies and procedures documented, one option for finding a good template is to Google the term, "IT Security Policies and Procedures." You will find free downloadable templates that give you a basic outline to follow.

Related Reading: How to Create a Cybersecurity Policy for Your Organization

If you already have this document in place, keep in mind it needs to be treated as a living document, to be changed and updated often as circumstances and requirements change. Make a point to do a yearly or bi-yearly review.

Step 2: Implement Data Security Tools

Of course, documentation of security policies is only a start. You need to procure and implement proven security tools across your enterprise to protect your data -- whether the data resides on a server or is being transmitted across a network or the Internet.

Related Reading: Can HIPAA-Certified Solutions Really Guarantee Compliance?

Here's a barebones list of necessary IT security tools for ensuring compliance:

  • Firewall: This security measure prevents intrusion into the private network from unauthorized outside viewers.
  • Email encryption: To meet privacy requirements, email communications that contain private data must be encrypted.
  • Malware protection: This step keeps spyware/malware from infecting PCs and servers containing private data.
  • FTP communications: Managed file transfer solutions are designed specifically to provide encryption, logging, and automation tools that make sure the sensitive data is secured and tracked while in motion, while reducing the time to manage all incoming and outgoing transactions
  • Backup protection: Backup files and tapes need to be encrypted and otherwise secured to make sure sensitive data can't fall into the wrong hands
  • Data shielding: Sensitive fields need to be encrypted or hidden to ensure that it can't be viewed or extracted by unauthorized viewers. A good data encryption product can also encrypt data on backup tapes as well sensitive data that might be shown in on-screen applications.
  • Physical facility protection: Server rooms, fax/copy/printer rooms, and workstations must all be considered when protecting sensitive data that is printed on paper or residing on servers or PCs.
  • Telephone and online communications: Anyone involved in telephone, online chat, or discussion groups needs to be trained to be sensitive to privacy regulations and exposing sensitive information.

Related Reading: How Cloud Technology is Transforming the Healthcare Industry

As you can see, there are several aspects of compliance to HITECH and other laws that need to be considered and addressed. Healthcare professionals and organizations need to take their patients' privacy seriously, whether in the hospital, physician office, or in electronic format on servers and digital communications with others.

Need to Meet HIPAA and HITECH Compliance Requirements?

Discover how to safely meet HIPAA and HITECH compliance standards with the guide HIPAA Data Security Best Practices.


Latest Posts


The Surprising Relationship Between Data Privacy Laws and File Sharing

October 21, 2021

Data is more distributed than ever before, thanks in part to data privacy acts. But how do data privacy acts impact file sharing and distribution?


Why Are Reviews Important?

October 19, 2021

We know that trying to find the right MFT solution can be a complex process. When you’re shopping around for the right fit, be sure to check out the reviews available to you on the key platforms.


Heads up! New Canadian Data Privacy Act is Around the Corner

October 13, 2021

Canada’s data privacy laws may soon be changing. Brush up on what’s expected to change and how your organization can comply with stronger security safeguards.


The 5 Biggest Cybersecurity Threats of 2022: How to Avoid Cybersecurity Attacks

October 12, 2021

Learn about the biggest threats to cybersecurity in the year 2022 and how to protect your organization from cybersecurity attacks tomorrow.


How Windows Works with GoAnywhere MFT

October 7, 2021

Improve your Windows secure file transfer when you use GoAnywhere MFT’s SFTP server. Learn how running managed file transfer (MFT) on Windows streamlines and simplifies your processes.