HIPAA Security Best Practices 

Privacy Rules & Information 

Data Security Requirements

The security rule is very detailed. It is an outline of requirements set to ensure that the data itself is protected and adheres to EMR HIPAA compliance that prevents unintended access to the ePHI. This includes any kind of interaction that might occur with the data, including collection and transition, before becoming data at rest. 

This also includes ensuring access to the data is locked down and heavily restricted, keeping access to a minimum. This means employees at the data center would have a set of rules and restrictions surrounding their access, and all interaction with it follows HIPAA logging requirements. A continual audit of the data should also be standard. This puts a process in place to resolve any incidents where the data is accessed when it should not have been. The general idea behind the security rule is to reduce any exposure to the data unless it’s absolutely necessary. If someone does need to access it, they may need to sign a business associate agreement (BAA). 

EHR/EMR HIPAA Compliance Guidelines

What is PHI data, and what qualifies as protected health information? Per the Health Information Technology (HIT) guideline, PHI is defined by Health and Human Services as “individually identifiable health information, including demographic information that relates the individual's past, present, or future physical or mental condition.” [1] Additionally, it is any information that, on a reasonable basis, can help identify the individual. This includes data like a medical record, lab record, hospital bill, patient's name, and other identifying information present in the EMR/EHR. Other important PHI includes the social security number, address information, and phone number. Though not medical in nature, they are tied to the data that is health-related, making it PHI. 

PHI isn’t just limited to aspects of a person’s health. Any information they provide, such as information entered into a contact form on the website, is also covered. The reasoning behind this: Someone would not want potentially embarrassing information to leak out regarding the type of specialist they plan to visit. That’s why it’s so important to invest in ERM integration that includes HIPAA compliant web forms for your website.