What Should a HIPAA Compliance Program Include?

Many healthcare organizations have pieces of a HIPAA program: a policy binder, an annual training module, an IT vendor, and a Notice of Privacy Practices in the waiting room. Those pieces matter, but on their own they do not make a program. A working program connects them, assigns responsibility for them, and keeps evidence that they operate.

This article outlines the components most programs need. The specifics depend on your organization's size, systems, and risks.

Designated responsibility

HIPAA requires a covered entity to designate a privacy official responsible for its privacy policies and procedures (45 CFR 164.530(a)), and to identify a security official responsible for the Security Rule (45 CFR 164.308(a)(2)). In a small practice, one person may hold both roles. What matters is that someone is clearly accountable and has the time and support to do the work.

Risk analysis and risk management

The Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to electronic PHI, and security measures that reduce those risks to a reasonable and appropriate level. The risk analysis is the foundation of the security program. If it is out of date, decisions built on it may be too. See What Is a Security Risk Analysis? for more.

Policies and procedures

Policies should cover how your organization uses and discloses PHI, responds to patient rights requests, protects electronic systems, manages access, handles devices and media, works with vendors, and responds to incidents. The common failure is a set of template policies that nobody adapted to the organization's real workflows. A policy that does not match practice can create more risk than it removes.

Workforce training and sanctions

Every workforce member needs training on the policies relevant to their role, and the Security Rule requires a security awareness and training program. Organizations also need a sanctions policy for workforce members who violate policies. Training records, including dates and attendees, are among the first documents requested in most reviews.

Access management

Access to PHI should be limited to what each role needs. That means unique user accounts, role-based permissions, prompt removal of access when staff leave, and periodic review of who has access to what.

Business associate management

Vendors that create, receive, maintain, or transmit PHI on your behalf are generally business associates and need a Business Associate Agreement. A program should keep an inventory of these vendors and their agreements. See When Is a Business Associate Agreement Needed?

Incident response and breach notification

Staff need a simple way to report potential incidents, and the organization needs a defined process to investigate them, assess whether a breach occurred, meet notification requirements when they apply, and document the outcome. See What to Do After a Potential HIPAA Incident.

Contingency planning

The Security Rule requires plans for responding to emergencies that damage systems containing electronic PHI, including data backup, disaster recovery, and emergency mode operation. Ransomware has made this requirement far more practical than it once seemed.

Documentation and retention

HIPAA requires covered entities to document their policies, procedures, and required activities, and to retain that documentation for six years from the date it was created or last in effect, whichever is later (45 CFR 164.316(b)). Documentation is how an organization shows that its program operates.

Ongoing maintenance

A program is not a one-time project. Policies, risk assessments, and training need to be revisited regularly and whenever the environment changes: a new location, a new EHR, new vendors, remote work, or an acquisition.

There is also a practical incentive to keep security practices current. A 2021 amendment to the HITECH Act directs HHS to consider whether an organization had recognized security practices in place for the previous 12 months when it determines penalties and audit outcomes.

Where to start

If you are unsure where your program stands, begin with three questions. When was your last risk analysis? Do your policies describe what your staff actually do? Could you produce training records and Business Associate Agreements today if asked? The answers usually show where to focus first.