12 Step HIPAA Compliance Website Checklist

Duty of Care for HIPAA Compliance

Companies subject to HIPAA regulations are referred to as covered entities. This encompasses doctors, pharmacies, and nursing homes that transfer medical information, often referred to as electronic medical records (EMR), electronic health records (EHR), or protected health information (PHI). Covered entities also include health insurance companies, HMOs, government agencies that subsidize health care (Medicare), and military and veterans’ organizations.

Sharing this information has become an important part of modern healthcare, but HIPAA compliance also creates a burden for medical providers. We can’t stress this enough: Covered entities bear the final responsibility for their compliance with all HIPAA regulations and guidelines. We want you informed about the challenges you face, so we offer this HIPAA compliant website checklist to get you started.

HIPAA projects come in many shapes and sizes. From a simple online pharmacy to a complex doctor-patient portal to a mobile application, they all have the same regulations regarding PHI. Clarity has built many of these projects, and we are comfortable helping you navigate the HIPAA compliance waters.

Privacy Rule Considerations

In addition to all of the privacy protection mentioned above, healthcare providers must consider other patient privacy concerns. For instance, they can share information with family members in certain circumstances.[1] An example is if the patient is mentally incapacitated or if the patient is a minor. Generally, HIPAA regulations prevent sharing or exposing confidential information in electronic, written, and oral forms. This means that websites have a duty even when discussing health records over the phone where they could be overheard by unauthorized people. In some cases, outside service providers may need access to information to provide medical services, so these cases are exempted from the privacy restrictions. The privacy rule applies to computer information about patients, conversations between doctors and medical staff, billing information, medical charts, and prescription information.

Security Rule Considerations

National standards of security protect information in medical private practice databases, eCommerce customer lists where medical records are part of the database, medical clearinghouses, pharmacies, insurance companies, and other covered entities and business associates. The HIPAA security rule has three components: technical safeguards, administrative safeguards, and physical safeguards. Some of the major highlights of security-rule regulations include — but aren't limited to — the following points:

Breach Notification Rule Considerations

Breaches occur when unauthorized people gain access to protected health information in some manner that's not permitted under the HIPAA Privacy Rule. These breaches include unauthorized access to physical areas, inadvertent disclosures, stolen or misplaced documents, and digital hacks. If any of these situations occur, covered entities must:

• Determine if PHI is compromised
• Assess the type and amount of data involved
• Find out who used the PHI illegally or to whom information was disclosed
• Chronicle steps taken to mitigate the breach
• Ascertain if the breach was closed or information returned before being used
• If the breach occurred inadvertently under a covered associate’s or entity’s authority
• Send notices of breach incidents to each patient's last known address by First Class mail or email if electronic notifications are authorized
• Write notices in easy-to-understand language and include a summary of how the situation occurred, the date of exposure, and other relevant details

Specific Concerns for Covered Entities & Business Associates

Covered entities and associates must consider not only whether their websites are compliant with HIPAA regulations but also whether all forms of their digital presence online are compliant. Technology advances often result in web pages in social media that act as customer service extensions. Any transmission of data or storage of protected information offsite or in the Cloud must be compliant. Fortunately, eCommerce companies don't need to be overwhelmed by restrictions and compliance issues because they can hire third-party consultants like Clarity. We specialize in HIPAA compliance and secure portals to transfer PHI.

Website Design

Major eCommerce companies usually employ a team of designers for their websites, stores, and online catalogs, and if the website is required to comply with HIPAA, these professionals should know this information and act accordingly. However, that's not the way things always work. Designers can overlook key elements, and unless your designer is familiar with HIPAA rules, it's in the company's best interest to confirm compliance.

Design issues related to HIPAA compliance include:

• Ensuring that information being transmitted is always encrypted
• Implementing safeguards to prevent tampering
• Hosting websites on servers that are secured with HIPAA security rules or a HIPAA Business Associate Agreement
• Limiting access to PHI to authorized staff
• Backing up all PHI information in ways that ensure the data is recoverable

Integrate HIPAA with eCommerce

It’s important to remember that a website isn’t just about protecting HIPAA-protected information. The medical field is a business, after all, and the eCommerce side has to be considered as well. It’s especially critical to choose the right eCommerce and HIPAA development partner to create the most secure portals and websites possible.

Clarity has been designing and building HIPAA compliant portals that incorporate eCommerce platforms for more than 15 years. We understand the challenges that come with our clients' projects and the need to secure private information, whether health-related or financial. Tell us what you need protected and we’ll protect it.