{"id":3095,"date":"2021-08-31T09:18:38","date_gmt":"2021-08-31T13:18:38","guid":{"rendered":"https:\/\/medent.com\/news\/?p=3095"},"modified":"2021-08-31T09:30:11","modified_gmt":"2021-08-31T13:30:11","slug":"guest-post-finding-confidence-in-your-hipaa-security-privacy-and-breach-compliance","status":"publish","type":"post","link":"https:\/\/medent.com\/connect\/2021\/08\/31\/guest-post-finding-confidence-in-your-hipaa-security-privacy-and-breach-compliance\/","title":{"rendered":"Guest Post: Finding Confidence in your HIPAA Security, Privacy and Breach Compliance"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

HIPAA compliance can be difficult to approach on your own. Healthcare providers and their business associates are required to perform an annual HIPAA Security Risk Assessment (SRA) to ensure that proper physical, administrative, and technical controls are in place to protect health information. By performing a security risk assessment, not only will you be prepared to pass an audit, but you can also protect your organization and its housed information from cybersecurity and privacy threats (after all, that is the point of the SRA and the mandate to perform one each year).<\/p>

In the event of a HIPAA audit, the first thing that will be examined by the OCR is whether a quality security risk assessment was performed for the audit year. The key word there is \u201cquality.\u201d Anyone can perform a security risk assessment (many use spreadsheets and paper documents to manage their annual SRA, at great difficulty and disorganization), but how can you be sure that your risk assessment is qualitative enough to survive the heavy scrutiny of a federal audit? If you are not too confident in the quality of your SRA, you are not alone. During each of our webinars, we ask a few questions to gauge whether those attending have performed an SRA, and if they have, whether they are 100% confident they would pass an OCR audit. In every webinar, we see similar results. Nearly 60% of respondents that completed an SRA are not 100% confident they would pass an OCR audit. You might say, \u201cwell, that\u2019s unfair to ask if someone is 100% confident in something, most people are not that confident about anything.\u201d<\/p>

Staying up to date on all the latest HIPAA regulations, privacy laws, and state regulations can be difficult. Often, our clients feel less than confident in their HIPAA compliance because they \u201cdon\u2019t know what they don\u2019t know.\u201d That is why it is particularly important to look for software and services that work with you side by side to simplify and automate your compliance so you can have confidence you are completing all the necessary HIPAA security and privacy requirements.<\/p>

We have found that clients utilizing our industry-leading SRA software, HIPAA One\u00ae<\/a>, have significantly higher confidence in their compliance program and in the possibility of passing and audit because we not only follow the OCR audit protocol and incorporate NIST methodologies into our assessment, we have a team of certified assessors to help walk each client through the process. To anyone who is unsure whether their SRA is will meet all the requirements of a HIPAA SRA, here are a few key objectives to look for. A quality SRA should:<\/p>

    1. Evaluate the organization\u2019s compliance to HIPAA\/HITECH and document the current security controls<\/li>
    2. Identify gaps in compliance and security that pose true business risk<\/li>
    3. Create a practical remediation roadmap or plan<\/li>
    4. Establish a sustainable operating model for information security and privacy<\/li><\/ol><\/li><\/ol>

      If you can check all these boxes, then your SRA is in great shape. The problem is very few organizations have the resources and expertise to meet these criteria, requiring many to outsource their SRA needs to an external organization. So how can you find a software\/tool you can trust? A quality SRA contains features that address HIPAA controls. You should look for an SRA tool that offers:<\/p>