HIPAA regulations and their importance for document management

Companies that handle healthcare information whether to or from the US have to comply with HIPAA regulations. Get an overview of all the important provisions and understand the role of HIPAA compliance in document management.

What is HIPAA?

The acronym HIPAA stands for Health Insurance Portability and Accountability Act. HIPAA is based on a US law from 1996 that is designed to regulate the handling of healthcare information and patient data. It requires entities that store, process, and transmit protected healthcare information to comply with certain privacy standards and take relevant security measures to protect this information.

The US Department of Health and Human Services (HHS) is responsible for implementing the law.

Objectives of HIPAA regulations

HIPAA regulations aim to achieve the following objectives:

• Create legally binding policies for managing healthcare data
• Modernize the flow of information in the healthcare sector
• Improve efficiency
• Promote secure and effective interoperability (exchange and communication between systems and organizations)
• Provide portability (i.e. the ability to take benefit entitlements when changing employers) and thus prevent gaps in health insurance coverage

What does HIPAA say?

HIPAA requirements range from ensuring the privacy of patients to security controls designed to protect personal information and rules for dealing with violations and security breaches. The law consists of several sections, or rules:

• HIPAA privacy rule: This section regulates which healthcare data have to be protected and defines the applicable data protection standards. It also covers exceptions when patient data can or must be provided without consent. This can include, for example, victims of domestic violence, legal proceedings, and organ donation.
• HIPAA security rule: The HIPAA law defines specific safeguards that organizations must take to protect healthcare information and control access to it. This can include, for example, ensuring the principles of information security (i.e. confidentiality, integrity and availability), identifying potential security risks and threats, and training employees on HIPAA compliance.
• Breach notification rule: In the event of security breaches, companies are obligated to notify the affected patients and the healthcare authorities. The exact reporting requirements depend on the number of people affected.

In addition, HIPAA describes the rights and obligations of authorities when enforcing regulations (enforcement rule). The law also sets forth requirements for interoperability. This can include, for example, ensuring that healthcare providers are clearly identifiable.

HIPAA and GDPR

HIPAA is often understood as the US equivalent of the EU’s General Data Protection Regulation (GDPR). However, there are important differences:

• GDPR applies to all personal data, while HIPAA covers only healthcare data.
• HIPAA regulations cover more than just aspects of data privacy. For example, they also contain guidelines on interoperability and the rights of authorities. These are not found in GDPR.
• HIPAA and GDPR both require technical and organizational measures. However, these are defined more specifically in HIPAA than in the GDPR.

If you process healthcare data from the US or the EU, you should take a close look and pay attention to the details of the respective regulations.

Information protected under HIPAA

Hey Doxi, what information is protected?

Who has to comply with HIPAA requirements?

HIPAA requirements apply to healthcare service providers, healthcare plans, and healthcare clearinghouses that work with protected healthcare data. These are known as covered entities. All business partners and business associates who have access to patient information and assist in treatment, payment, or operations must also comply with HIPAA legal requirements. This includes, for example, tax consultants, lawyers, IT service providers, hosting and cloud providers, as well as accounting services and document storage companies.

The following types of businesses and organizations fall under HIPAA law:

Healthcare insurance companies

• Healthcare providers (physicians, dentists, therapists, nurses, etc.)
• Healthcare facilities (hospitals, clinics, nursing homes, etc.)
• Pharmacies
• Long-term care facilities
• Research institutions
• Public health authorities
• Employers
• Schools and universities

Does HIPAA also apply to foreign organizations?

HIPAA is a US law that primarily applies to US stakeholders in the healthcare sector. However, it can also be relevant for non-US organizations and businesses, if they deal with the healthcare data of US citizens.

This can be the case when a foreign company that operates in the US processes American patient data, for example, when working with a US healthcare facility.

In another example, a company might transfer healthcare data from the US across borders to another country. In this case, all country-specific laws must be followed, including HIPAA regulations.

Good to know: In July 2023, the European Commission adopted the adequacy decision for the EU-US Data Privacy Framework (successor to the EU-US Privacy Shield). This agreement between the US and the EU regulates the protection of any personal data of EU citizens transferred to certified US companies.

What are the consequences of non-compliance?

Businesses that are covered entities and do not comply with HIPAA legal requirements may face hefty civil penalties and/or significant criminal penalties. The amount of a HIPAA penalty depends on the severity of the violation. In addition to fines of up to $50,000 per violation, prison sentences are also possible. In extreme cases, the business affected may have to cease operating.

Violations can also harm reputations and erode the trust a business has built. HIPAA requires HHS to post online any violations that affect 500 or more people. The list of data breaches is available through the Office for Civil Rights (OCR) portal and is known as the HIPAA Wall of Shame. Affected persons can also report possible violations via the portal.

Why is HIPAA compliance important?

HIPAA compliance is important not only to avoid hefty fines. Trust also plays a crucial role, especially in the healthcare sector. When you comply with HIPAA requirements, your customers can trust that you are protecting their data securely.

Healthcare data also contain very valuable information that is both mission-critical for your business and highly attractive for attackers. In addition to healthcare information, these data also include information about a person's identity and sensitive financial data. They can be used, for example, for identity theft and targeted phishing attacks.

Due to the high level of security threats and their high value, healthcare data are worth protecting especially well.

7 Elements of a HIPAA compliance program

According to the HHS, the following seven elements are a minimum requirement for an effective HIPAA compliance program:

1. Implement written policies, procedures and standards
2. Appoint a compliance officer
3. Provide effective training and education for staff
4. Develop effective communication channels
5. Regularly conduct internal monitoring, audits, and reporting
6. Enforce disciplinary policies for compliance violations
7. Respond promptly to potential violations and carry out corrective actions

What is the HITECH Act?

When HIPAA was passed in 1996, organizations managed patient information primarily through physical paper records. As technology advanced and the internet spread, the electronic health record (EHR) has become increasingly popular in the healthcare sector. To accelerate this development and adapt security precautions to the requirements of the digital world, HIPAA regulations have been revised several times.

In 2009, the Health Information Technology for Economic Clinical Health Act (HITECH Act) came into force as an amendment to HIPAA. This law is intended to promote the use of EHRs, reduce paper records, and simplify communication between healthcare systems. At the same time, the HITECH Act tightens enforcement of the law, increases penalties for violations, and expands data protection and security requirements, especially for business partners of covered entities. The HITECH Act was added to HIPAA’s legal framework in 2013 as the HIPAA Omnibus Rule.

HIPAA-compliant DMS – does it exist?

Software providers do not fall under covered entities but they are considered their relevant business partners. This means that they have to create the conditions to enable organizations and companies in the healthcare sector to use their software, for example, for HIPAA-compliant document management.

In the US, software can be certified, but not by a government accreditation body. This also does not mean that the software is HIPAA compliant, only that it enables users to work in accordance with HIPAA requirements. Similarly, software itself is not GDPR-compliant. Rather it supports GDPR-compliant work through configuration options and the way the system is used.

Document management in healthcare with SER

A document management system (DMS) is an important tool that makes it easier to manage healthcare information. It makes paper files a thing of the past. In the electronic Doxis patient record, you can easily store all the relevant information and documents, create individual case files, archive laboratory reports, endoscopy images, X-ray images and other images, and get an overview of the patient's medical history at any time.

Thanks to the range of integration options, Doxis can be connected readily to other systems such as HIS, ERP, PACS and RIS, so that all the information is brought together centrally. You can also preview special document types such as X-ray images directly in the DMS. The information can also be accessed via mobile devices, which makes medical visits easier, for example.

Another benefit of Doxis is its digital patient record, which provides a secure connection to the electronic patient record (ePA); in 2021, health insurance companies in Germany started providing customers with access to their electronic patient record via app.

At SER, we believe it is important to provide a solution that meets all the industry-specific standards and also enables you to work hassle-free in a GDPR- and HIPAA-compliant environment.

Frequently Asked Questions about HIPAA