HIPAA & HITECH Compliance for File Transfers

What is HIPAA?

HIPAA stands for the Health Insurance Portability and Accountability Act. It sets the standard for protecting sensitive patient data and applies to any company that deals with protected health information (PHI). Without efficient and effective tools, maintaining HIPAA compliance in general and HIPAA compliant file transfers specifically, can become a burden that consume entire days or weeks for your IT team. Finding an effective way to meet these challenges is imperative.

What is HITECH?

HITECH stands for the Health Information Technology for Economic and Clinical Health Act and is directly related to HIPAA. Passed as law in 2009, the HITECH Act urges health providers to:

• Adopt electronic health records (EHR) to improve quality of patient care
• Adhere to expanded data breach notification requirements
• Secure ePHI data using appropriate privacy protections

Meeting HIPAA File Transfer Requirements

The basic goal of HIPAA’s Security Rule is to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). The Security Rule is separated into three types of safeguards: administrative, physical, and technical.

Under these safeguards, organizations can secure data and achieve HIPAA compliant data transfers by:

• Preventing unauthorized access to ePHI from users or software that do not have permissions. §164.312 (a)(1)
• Ensuring users can be tracked and any access or activity on information systems that use ePHI is recorded. §164.312 (a)(2)(i)
• Establishing electronic security protocols to insulate data in motion from unauthorized access as its transferred across electronic networks. §164.312 (e)(1)
• Disconnecting electronic sessions based on predetermined rules. §164.312 (a)(2)(iii))
• Applying procedures to encrypt and decrypt data such as ePHI (electronic patient health information). §164.312 (a)(2)(iv)
• Demonstrating via electronic records that data has not been altered, compromised, or deleted without authorization. §164.312 (c)(2)

This is not a comprehensive list. For more information, see this Summary of the HIPAA Security Rule.

Who Is Impacted by HIPAA and HITECH?

Any organization that exchanges PHI or ePHI must be HIPAA and HITECH compliant.

As healthcare organizations adopt health information technology like electronic health records (EHRs), PHI is subject to risk when transferred between hospitals, clinics, pharmacies and insurers using traditional, unsecure file transfer methods like FTP. It’s critical for organizations to secure this data at rest and in motion and ensure the security standards of HIPAA and HITECH.

HIPAA Fines and Penalties

HIPAA privacy and security compliance is strictly enforced by the Office for Civil Rights (OCR) and can result in substantial penalties. There are four categories of penalties: the type of penalty depends on whether or not the organization was negligent in following HIPAA and whether or not the violation in question was avoidable even with proper HIPAA compliance.

Depending on the type of category the violations fall into, fines vary between $100 per violation (i.e. per record compromised) to $50,000 or more.