Hipaa Compliant Websites

Duty of Care For HIPAA Compliance

Companies that are subject to HIPAA regulations are referred to as covered entities, and these include organizations like companies that sell healthcare products, pharmacies, nursing homes, and doctor, dentist and psychologist practices that transmit information as electronic medical or health records. Covered entities include health insurance companies, HMOs, government agencies that subsidize health care, military and veterans organizations and even eCommerce companies that sell products like wearable devices that access and monitor people's health.

HIPAA regulations can be extensive, complex and subject to change and interpretation as to the specifics and best practices, so this resource page is only meant as an outline and guide and not a complete checklist. Covered entities bear the final responsibility for their own compliance with all of HIPAA’s regulations and guidelines. The rules are meant to protect privacy and confidential health information while creating a framework for sharing information that provides patient benefits like making faster diagnoses, matching patients with medical technology and collaborating on health care issues. HIPAA regulations, in a simplified version, ask companies to do the following four things:

Four HIPAA Compliance Rules

There are four HIPAA security rules that further define how covered entities and business associates safeguard protected health information. The four rules are:

In the normal course of business operations, only the first three rules apply to covered entities and their business associates. The last rule comes into play only when websites or physical-access points are breached and there's a risk that protected health information has been compromised.

1. PRIVACY RULE CONSIDERATIONS

Most people believe that their medical information is 100-percent protected, but according to the rules of the Health Insurance Portability and Accountability Act or HIPAA, health care providers can share information with family members in certain circumstances of reduced mental or physical capacity in adults or share data with parents or guardians in the cases of minors.[1] Generally, HIPAA regulations prevent sharing or exposing confidential information in electronic, written and oral forms. This means that websites have a duty even when discussing health records over the phone where they could be overheard by unauthorized people. In many cases, outside service providers may need access to information in order to provide medical services, so these cases are exempted from the privacy restrictions. The privacy rule applies to computer information about patients, conversations between doctors and medical staff, billing information, medical charts and prescription information.

2. SECURITY RULE CONSIDERATIONS

National standards of security protect information in medical private practice databases, eCommerce customer lists where medical records are part of the database, medical clearinghouses, pharmacies, insurance companies and other covered entities and business associates. The HIPAA security rule has three components: technical safeguards, administrative safeguards and physical safeguards. Some of the major highlights of security-rule regulations include -- but aren't limited to -- the following points:

3. ENFORCEMENT RULE CONSIDERATIONS

The HIPAA Enforcement Rule mostly concerns penalties and investigations when companies are found to be noncompliant, but eCommerce companies do have some enforcement responsibilities through the administrative section of the security rule. These include getting authorization forms for disclosing information to third-party sources, providing customers with a Notice of Privacy Practices and drawing up Business Associate Agreements for partners to acknowledge their responsibilities under HIPAA.

4. BREACH NOTIFICATION RULE CONSIDERATIONS

Many eCommerce companies will never deal with breach notifications, but many will. Breaches occur when unauthorized people gain access to protected health information is some manner that's not permitted under the HIPAA Privacy Rule. These breaches include unauthorized access to physical areas, inadvertent disclosures, stolen or misplaced documents and digital hacks. If any of these situations occur, covered entities must:

Specific Concerns For Covered Entities and Their Business Associates

Covered entities and associates must consider not only whether their websites are compliant with HIPAA regulations but also whether all forms of their digital presence online are compliant. Technology advances often result in Web pages in social media that act as customer service extensions. Any transmission of data or storage of protected information offsite or in the cloud must be compliant. Fortunately eCommerce companies don't need to be overwhelmed by restrictions and compliance issues because they can hire third-party consultants that specialize in HIPAA compliance and supply specialized HIPAA-compliant components like secure online forms.

 

Website Forms

Even simple opt-in forms on websites must comply with HIPAA regulations if the forms collect any kind of health information. For example, if website forms only ask for names, email addresses, phone numbers and physical addresses, then the forms don't need to be HIPAA compliant. However, if any medical, insurance, social security or other information is required, the form must comply with HIPAA.

Web Design

Major eCommerce companies usually employ a team of designers for their websites, stores and online catalogs, and if the website is required to comply with HIPAA, these professionals should know this information and act accordingly. However, that's not the way things always work. Designers can overlook key elements, and unless your designer is HIPAA-certified, it's in the company's best interest to confirm compliance. Design issues related to compliance include: