What to Know About HIPAA in eCommerce

HIPAA Updates

Watch the video for an in-depth view of HIPAA in eCommerce or continue reading for more HIPAA eCommerce insights.

What Is the Purpose of HIPAA?

HIPAA stands for Health Insurance Policy and Accountability Act. HIPAA defines the regulations and security level necessary for protected health information (PHI) transference over the internet.

Therefore, if your business handles PHI, you need to be HIPAA-compliant. Not being compliant can have dire consequences, such as substantial fines from the government and lost reputation.

The Responsibility of Covered Entities

Companies subject to HIPAA regulations are called covered entities. This encompasses doctors, pharmacies, and nursing homes that transfer medical information, often referred to as electronic medical records (EMR), electronic health records (EHR), or protected health information (PHI). Covered entities also include health insurance companies, HMOs, government agencies that subsidize health care (Medicare), and military and veterans’ organizations.

Sharing this information has become an important part of modern healthcare, but HIPAA compliance also creates a burden for medical providers. It’s crucial to note that covered entities are responsible for their own HIPAA compliance.

How to Have HIPAA-Compliant eCommerce

Consistent Auditing

HIPAA requirements evolve as technology does, and span technical, data, and internal business processes. That’s why there must be constant monitoring and validation in the form of auditing for all HIPAA compliant eCommerce platforms and applications.

Best practices include periodic penetration tests, white-hat hacking, and security audits. Regulations also require some form of validation process for auditing and reviewing what people have access to.

We recommend creating a HIPAA compliant IT checklist with periodic reviews to ensure successful validation of HIPAA compliance.

HIPAA Checklist

Having a plan in place for HIPAA compliant website design and hosting is one of the most important business objectives you’ll ever pursue. Don’t approach this haphazardly; you need to have a personalized HIPAA compliance website checklist to ensure you meet every HIPAA standard. Here are some basic steps to follow in your HIPAA checklist:

1. Research healthcare industry needs
2. Determine if HIPAA is necessary for your business
3. Learn HIPAA website basics
4. Choose your HIPAA compliant solution
5. Find a hosting provider
6. Install a robust SSL certificate
7. Encrypt all web forms
8. Use HIPAA-compliant email encryption and contact forms
9. Securely back up data
10. Protect HIPAA-compliant web servers

Types of HIPAA Rules

Four major types of rules make up HIPAA regulations:

• HIPAA Privacy
• HIPAA Security
• HIPAA Enforcement
• HIPAA Breach Notification

In the normal course of business operations, only the first three rules apply to covered entities and their business associates. The last rule comes into play only when websites are breached and there's a risk that protected health information has been compromised.

Technical Safeguards

The most common concern is technical safeguards, which can be broken into:

• Access Control
• Authentication
• Transmission Security

Tools such as SSL make sure your eCommerce platform sends data securely and that data is encrypted. It also includes access limitations, meaning that only authorized users and devices can access the data. If an unauthorized user tries to get in, the HIPAA application can lock down the system to block them from interacting with it.

HIPAA logging requirements also necessitate extensive information logging, including when the data was available, who accessed it, and when it was accessed. Additionally, it logs all changes made to the data, helping keep track of who is responsible for changes and making any internal privacy breach or user input easier to solve.

HIPAA eCommerce Platform Configuration

This can be challenging to do manually. As such, the eCommerce application itself needs to log interactions with the data, ensure that the data is encrypted correctly during transmission, and protect data at rest.

The eCommerce platform must be configured and validated to be compliant. Clarity uses highly regarded to perform much of this periodic auditing and reviewing. This software provides the most common protection protocols to pass security audits and verification via a summary report to verify HIPAA eCommerce compliance.

Data Management with HIPAA

Keep a Closed Circle of Access

To have the best security possible, make sure that only those who need access have it, and that those who have it can only access what they need. This means having strong access control so that people can only access limited sets of information based on their user role.

Centralized administration roles should only be accessible by the select few, and there should be multifactor authentication or another robust authentication method to get in.

Additionally, when a user will no longer be using the system and requests the removal of their PHI and deletes their account, administrators need to act promptly and remove the patient’s health information, account access, and the account itself from the system.

Have a User-Friendly Interface

This is where more advanced logging of HIPAA eCommerce platforms can be helpful. You want to make the user interface as friendly as possible for users so they can easily remove their information from the system when deleting their account. It’s critical that their sensitive health information stays in their hands.

Encrypt Data

HIPAA auditors need to be able to see the audit logs to confirm that the best practices were employed to protect data at every point. It’s important to make sure that data is encrypted at rest and during transmission—otherwise, you could be in breach of HIPAA laws.