| Do
you need to be HIPAA complaint?
If you work in the Insurance
or HealthCare industry you have heard about HIPAA, the Health
Insurance Portability and Accountability Act.
In fact, if you work in any industry whose
computer systems store and process data such as a patient's
(or client's) medical records number, a Social Security Number,
a patient's home address or diagnosis code, you may be subject
to HIPAA's security regulations.
Beginning April
2005 HIPAA compliance means serious business.
For most businesses this
means that their IT departments, web sites, electronic filing
and other forms of communication needs to be secure, particularly
if Clients or patients data is being communicated. It is
the responsibility of the business owner to ensure compliance
and in most case, the IT/IS department or vendor that will
put the necessary controls in place to ensure compliance.
Most email is
not secure.
At some point all email
travels in the open internet. If the email is not encrypted
or secure then the information contained in that email is
not complaint. Of course, if your emails do not contain sensitive
Client or patient data, then you do not need to take necessary
steps to secure your email. But many agencies and carriers
email sensitive data back and forth presuming erroneously
that the information is secure.
Get SSL for
your website.
If you are asking clients for sensitive information
on your websites, make sure that it is encrypted with an SSL
certificate. Also, ensure that the data submitted by the Client
stays in your database and is viewed only in a secure (SSL)
password protected area. Many websites capture the Client
data and then email it to a specific mailbox. This is not
complaint and is not secure. Email
us for more information.
Some questions to ask of your
organization about HIPAA compliance.
- Do you transmit client/patient information via email?
Is your email secure?
- Do you ask clients to enter confidential information such
as SSN, Tax ID, etc on your website? Is your website secure?
- How do you transfer information to the insurance carrier?
If on their website, is their website secure?
- What steps are you taking to ensure that stored data (backed
up) is kept confidential, available, and that the integrity
of the data is maintained?
- Do you have policies in place that, in the past, have
proved sufficient to fulfill ongoing business needs?
|
