What is HIPAA compliance
The acronym HIPAA stands for “Health Insurance Portability and Accountability Act”, which became law in 1996 in the U.S. HIPAA compliance refers to the three main rules around how companies use individuals’ health information and personally identifiable information (PII).
Any company that receives, stores, or deals with individuals’ personal information related to healthcare, diagnosis, lab results, prescriptions, and so on, must maintain a state of compliance with HIPAA rules. This applies to doctor’s offices and healthcare providers but may extend to medical device companies, fitness apps, or social platforms where users share their health information.
What are the Three Rules of HIPAA Compliance?
HIPAA compliance can be summarized by adherence to the three rules: the Privacy Rule, the Security Rule, and the Breach Notification Rule.
- The Privacy Rule — Privacy policies, including forms that identify where and how doctors can leave messages for individuals, are just the start of the data protection that’s required under the Privacy Rule. PII must be stripped from aggregated data, and individual results should only be available to people on a need-to-know basis. The storage and encryption of this data is also part of the Privacy Rule.
- The Security Rule —- From the physical security of facilities to processes and automation to support the security of information, the Security Rule covers all areas of data security. Information access management (IAM) that restricts data access by user roles is an important part of this. HIPAA compliance also requires employee training around security, and an incident response plan.
- The Breach Notification Rule — This rule is pretty self-explanatory. Any data breach of personal health information — impacting over 500 people — must be reported to the affected individuals no later than 60 days after the breach.
