12 Step HIPAA Compliance Website Checklist

Understanding What HIPAA Means for Your Site

Every medical practice, clinic, pharmacy, nursing home, and healthcare provider must adhere to HIPAA rules when they have an online presence that transfers medical information. Healthcare organizations failing to do so could lead to substantial fines from the government.

Even worse, you’ll lose the trust of your patients and ruin your good reputation. Customers trust their health to physicians and caregivers, and they want to feel just as confident that their health information is in good hands. That’s why you need to invest in a robust HIPAA compliant website if you plan to transfer or store electronic protected health information, or ePHI.

Duty of Care for HIPAA Compliance

Covered entities are companies subject to HIPAA regulations. This encompasses doctors, pharmacies, and nursing homes that transfer medical information, often referred to as electronic medical records (EMR), electronic health records (EHR), or (electronic) protected health information (PHI or ePHI). Covered entities also include health insurance companies, HMOs, government agencies that subsidize health care (Medicare), and military and veterans’ organizations.

Sharing this information has become an important part of modern healthcare, but HIPAA compliance also creates a burden for medical providers. We can’t stress this enough: Covered entities bear the final responsibility for their compliance with all HIPAA guidelines and regulations.

Here we offer a HIPAA compliant checklist so you can be prepared for HIPAA requirements for your website.

12-Step HIPAA Checklist

1. Create a HIPAA Compliance Website Checklist

The first step in a HIPAA compliant checklist is creating a checklist that serves needs specific to your company. Having a plan in place for HIPAA compliant website design and hosting is one of the most important business objectives you’ll ever pursue. Don’t approach this haphazardly; you need to have a personalized HIPAA compliance website checklist to ensure you meet every HIPAA standard.

2. Research Healthcare Industry Needs

When considering the needs of your website, you must first consider the HIPAA laws in place that affect every healthcare provider and then personalize your plan to comply. Simple, unsecured websites are no longer an option, even if you just include a contact form for patients to fill out. Be sure to find trusted information so that you can find an IT partner familiar with HIPAA compliance.

3. Determine if HIPAA Is Necessary

HIPAA compliant websites are only necessary if it is used to collect, store, process, display, or transmit ERM/EHR/PHI. HIPAA does not cover physical health records or electronic records that are stored in a single location with no means of web transfer. But because HIPAA was designed to improve healthcare by providing easy access to information, there aren’t many computer systems that don’t require strict HIPAA compliance.

4. Learn HIPAA Website Basics

Before you understand how to make your website HIPAA compliant, familiarize yourself with HIPAA requirements, which state that healthcare websites must:

• Implement rules and safeguards to protect patient health information.
• Limit sharing of confidential data to authorized stakeholders who directly help patients in some way.
• Ensure any business associates or corporate partners also safeguard PHI and share information only when done so in each patient's best interests.
• Limit who can access PHI and train employees about security and confidentiality best practices.

5. Research and Follow HIPAA Rules

HIPAA rules don’t stop with information protection; it’s also adamant about tracking information access. They also require covered entities to keep track of who has viewed PHI, why they are accessing it, what they are accessing, and if the information has been transferred in any way. Working with an eCommerce and HIPAA integration company that has experience protecting both is a must.

6. Encrypt HIPAA Compliant Patient Intake Forms

A web form is any information-collecting form that is filled out by a patient or client. Common examples include desktop or mobile forms that collect medical and health insurance information. This information is then collected to create long-term and centralized medical records.

HIPAA compliant web forms ensure that the connection between the browser and the website is encrypted, so information entered on the site or web forms is protected against unauthorized access. You must make sure your HIPAA compliant website is hosted by a company that knows what it’s doing when transferring forms to the HIPAA web server. Clarity is ready to make your forms HIPAA secure.

7. Use HIPAA Compliant Contact Forms

Any page that allows patients to submit information can be considered a contact form. This includes pre-visit health surveys, patient portals, and live chat facilities. Even the simplest contact form has to be secure; a person contacting a doctor will not want anyone to have easy access to their inquiries regarding particular health problems.

8. Protect HIPAA Compliant Web Servers

PHI must be protected at every step. HIPAA compliant servers must include the most secure protection available while PHI is in the Cloud, but it also must be secure during any sort of internet transfer. That includes end to end encryption for any information that is sent back to the or between healthcare providers.

• Collecting PHI – If your website collects any individually identifiable medical information, such as symptoms, conditions, or requested healthcare services, you are collecting PHI. That information must be ferried securely to the web server.
• Storing PHI – Whether you store the PHI on your own server or on a third-party server, you must ensure that the security of the information is HIPAA compliant and that regular maintenance is done to keep it so.
• Transmitting PHI – PHI must also be secure and encrypted when it is transferred in any way. This includes direct transfer between servers, via email, or any other digital transference. 

9. Install a Robust SSL Certificate

Secure Sockets Layer (SSL) is the industry standard for transferring data over internet channels, usually between a web server and a browser. SSL certificates make sure that data is encrypted from end-to-end and is not readable by third parties. The “s” in https// that is found on most websites indicates that any information transferred on that site will be secure. Some of the best low-cost—or even free—SSL Certificate providers are:

• Comodo
• SSL For Free
• Cloudflare
• Let’s Encrypt
• Instant SSL

Be careful; free SSL certificates often don’t offer the most stringent security and aren’t always HIPAA compliant. Properly installing an SSL can be tricky business as well. Since it’s one of the most important parts of this HIPAA compliant website checklist, you’ll probably want to trust this step to a company familiar with HIPAA compliant database design. We’ll take care of it for you.

10. Choosing Your HIPAA Compliant Solution

Who you work with can determine whether or not you truly have a HIPAA compliant website. As you saw from the previous points, the website must be secure from many angles. Clarity provides HIPAA compliant solutions to seamlessly secure PHI that's transmitted to and from your website, all the while adhering to HIPAA compliant server requirements.

11. Finding a Hosting Provider

Don’t trust just anyone with your web hosting. HIPAA compliant web hosting requires some of the most robust security available. Since security is so important to your business, make sure you find one that specializes in HIPAA compliant web hosting.

12. Securely Back Up Data

Backing up patients’ PHI—perhaps a lifetime’s worth of data—is a must. But backups usually mean that data is being duplicated from server to another. Protection must be just as protected during the backup as when it’s on the original server.

The Four HIPAA Compliance Rules

There are four HIPAA security rules that further define how covered entities and business associates safeguard protected health information (PHI). The four rules are:

• HIPAA Privacy Rule
• HIPAA Security Rule
• HIPAA Enforcement Rule
• HIPAA Breach Notification Rule

In the normal course of business operations, only the first three rules apply to covered entities and their business associates. The last rule comes into play only when HIPAA websites are breached and there's a risk that PHI has been compromised.

HIPAA compliant solutions come in many shapes and sizes. From a simple online pharmacy to a complex doctor-patient portal to a mobile application, they all have the same regulations regarding PHI. Clarity has built many of these projects, and we are comfortable helping you make your website HIPAA compliant and ensuring the privacy and security of patient information.

1. Privacy Rule Considerations

In addition to all of the privacy protection mentioned above, healthcare providers must consider other patient PHI privacy concerns. For instance, they can share information with authorized individuals such as family members in certain circumstances [1]. An example is if the patient is mentally incapacitated or if the patient is a minor.

Generally, HIPAA compliance rules prevent healthcare providers sharing or exposing confidential information in electronic, written, and oral forms. This means that those in the healthcare industry have a duty even when discussing health records over the phone where they could be overheard by unauthorized people. In some cases, outside service providers may need access to information to provide medical services, so these cases are exempted from the privacy restrictions. The Privacy Rule applies to computer information about patients, conversations between doctors and medical staff, billing information, medical charts, and prescription information.

2. Security Rule Considerations

National standards of security protect information in healthcare organization databases, eCommerce customer lists where medical records are part of the database, medical clearinghouses, pharmacies, health insurance companies, and other healthcare providers and business associates.

The HIPAA Security Rule has three components: technical safeguards, administrative safeguards, and physical safeguards. Some of the major highlights of Security Rule regulations include—but aren't limited to—the following points:

• Performing periodic risk analysis to determine physical and digital vulnerabilities of PHI
• Reducing risks to acceptable levels
• Regularly reviewing system activities, digital logs, and audit trails
• Authorizing and supervising the employees who have access to PHI
• Protecting PHI from unauthorized parent companies, subcontractors, and partner organizations
• Sending regular updates to staff members about security issues and training employees to recognize malware, malicious software, and other virtual and real-world threats
• Implementing a system of access controls
• Providing encryption and decryption tools, especially when you transmit PHI
• Facilitating safeguards like automatic logoffs
• Establishing mandatory policies for using workstations and mobile devices

3. Enforcement Rule Considerations

The HIPAA Enforcement Rule mostly concerns penalties and investigations when companies are found to be noncompliant, but eCommerce companies do have some enforcement responsibilities through the administrative section of the security rule. These include getting authorization forms for disclosing information to third-party sources, providing customers with a Notice of Privacy Practices, and drawing up Business Associate Agreements for partners to acknowledge their responsibilities under HIPAA.

4. Breach Notification Rule Considerations

Breaches occur when unauthorized people gain access to protected health information in some manner that's not permitted under the HIPAA Privacy Rule. These breaches include unauthorized access to physical areas, inadvertent disclosures, stolen or misplaced documents, and digital hacks. If any of these situations occur, covered entities must:

• Determine if PHI is compromised
• Assess the type and amount of data involved
• Find out who used the PHI illegally or to whom information was disclosed
• Chronicle steps taken to mitigate the breach
• Ascertain if the breach was closed or information returned before being used
• If the breach occurred inadvertently under a covered associate’s or entity’s authority
• Send notices of breach incidents to each patient's last known address by First Class mail or email if electronic notifications are authorized
• Write notices in easy-to-understand language and include a summary of how the situation occurred, the date of exposure, and other relevant details

Specific Concerns for Covered Entities & Business Associates

Covered entities and associates must consider not only whether their websites are compliant with HIPAA requirements but also whether all forms of their digital presence online are compliant. Technology advances often result in web pages in social media that act as customer service extensions. Any transmission of data or storage of protected information offsite or in the Cloud must be compliant. Fortunately, eCommerce companies don't need to be overwhelmed by restrictions and compliance issues because they can hire third-party consultants like Clarity. We specialize in HIPAA compliance and secure portals to transfer PHI.

HIPAA Compliant Website Design

Major eCommerce companies usually employ a team of designers for their websites, stores, and online catalogs, and if the website is required to adhere to HIPAA compliance rules, these professionals should know this information and act accordingly. However, that's not the way things always work. Designers can overlook key elements, and unless your designer is familiar with what HIPAA requires, it's in the company's best interest to confirm HIPAA compliance rules to make a HIPAA compliant website viable.

Design issues that should be added to a HIPAA compliance checklist include:

• Ensuring that health data being transmitted is always encrypted
• Implementing safeguards to prevent tampering with health logs
• Hosting websites on web servers that are secured with HIPAA compliance rules or a HIPAA Business Associate Agreement
• Limiting access to PHI to authorized staff
• Backing up all PHI information in ways that ensure the data is recoverable

Integrate HIPAA with eCommerce

It’s important to remember that a website isn’t just about protecting HIPAA-protected information. The medical field is a business, after all, and the eCommerce side has to be considered as well. It’s especially critical to choose the right eCommerce and HIPAA development partner to create the most secure portals and websites possible.

Clarity has been designing and building HIPAA compliant portals that incorporate eCommerce platforms for more than 16 years. We understand the challenges that come with our clients' projects and the need to secure and transmit PHI, whether health-related or financial. Tell us what you need protected and we’ll protect it.