HIPAA Compliance Is an Ongoing Operational Responsibility
Privacy, security, workforce practices, vendor relationships, risk management, and documentation all work together. Annual training on its own is not a compliance program.
The HIPAA Privacy Rule governs how protected health information may be used and disclosed. The Security Rule requires covered entities and business associates to protect electronic PHI through three categories of safeguards.
The Security Rule is flexible by design. It expects each organization to assess its own risks and choose reasonable and appropriate measures for its size and complexity. That flexibility is also why compliance cannot be bought as a template: the safeguards have to fit how your organization actually operates.
Three Categories of Safeguards
Administrative Safeguards
- Risk analysis and risk management
- Assigned security responsibility
- Workforce access management
- Security awareness and training
- Security incident procedures
- Contingency planning
Physical Safeguards
- Facility access controls
- Workstation use and security
- Device and media handling
- Physical access to records and equipment
- Media disposal and reuse
Technical Safeguards
- Access controls and unique user IDs
- Person or entity authentication
- Audit controls
- Integrity protections
- Transmission security
- Information system activity review
Compliance Must Be Demonstrable
§ 164.316: documentation retained six yearsIf a compliance activity is not documented, it is difficult to show that it happened. Organizations should be able to produce evidence that the program operates, not only that it exists on paper.
| Evidence | What it shows |
|---|---|
| Risk assessments | Risks to ePHI were identified and evaluated |
| Risk management records | Identified risks were addressed or accepted with reason |
| Policy revisions | Policies are reviewed and updated as operations change |
| Training records | Each workforce member was trained, and when |
| Incident logs | Potential incidents were identified, assessed, and resolved |
| Access reviews | User access is checked and adjusted on a schedule |
| Vendor and BAA records | Business associates are identified and under agreement |
| Remediation documentation | Issues were tracked through to resolution |
Common Compliance Gaps
- Template policies that were never operationalized
- Old or incomplete risk assessments
- Missing or outdated Business Associate Agreements
- Shared credentials or excessive user access
- Former employees' accounts left active
- Unapproved email, text, or cloud workflows
- Incidents handled informally, with no record
- No tracking of whether issues were fixed
When the Environment Changes
A risk assessment describes your environment at a point in time. Compliance should be revisited whenever that environment changes, including:
- New locations
- New systems or EHR changes
- New vendors
- New workforce roles
- New devices
- Remote access methods
- System integrations
- Acquisitions or mergers
- Major workflow changes
HHS has proposed significant updates to the HIPAA Security Rule. As of this writing they have not been finalized. We track regulatory developments and update client programs as requirements change.
Information on this website is general and educational. It is not legal advice. Consult qualified counsel about your organization's specific legal obligations. For the regulation text, see 45 CFR Part 164 and the HHS HIPAA guidance for professionals.
Evaluate your HIPAA compliance program.
We will review your current safeguards and documentation and show you where the gaps are.