Jeremy Wanamaker | May 25, 2021
Share On:
Network technology is shaping the healthcare industry, enabling doctors and nurses to provide faster, more personalized care at lower costs.
While technology has helped improve healthcare outcomes, they can also make achieving compliance with the Healthcare Insurance Portability and Accountability Act (HIPAA) and its sister regulation, the Health Information Technology for Economic and Clinical Health (HITECH) act hard to achieve.
How do you build a network that safeguards electronic protected health information (ePHI), without harming efficiency and productivity? HIPAA is frustratingly open to interpretation, so we’ve compiled this concise overview to keeping your network compliant.
HIPAA outlines a series of control that healthcare providers must use to secure their technology. While there’s a great deal of freedom as to how to most “appropriately” deploy each of these controls, a secure network must have the following features to avoid a HIPAA compliance violation.
Authentication and Access Controls
Access controls ensure that only users with the proper privileges can view and manipulate ePHI. At the most basic level, this involves designating each user with a unique system ID and password. However, to ensure strong compliance and security you’ll need to go beyond those basic protections, which includes:
Properly Configured Firewalls and VPNs
Network and software firewalls are your first line of defense against intrusion, which makes them an important part of any regulatory compliance program. Despite their critical function, mismanagement of firewalls is a chronic condition. Research from Security Metrics shows that 76% of organizations that experienced a data breach had an incorrectly configured firewall, for example.
To ensure your firewalls are up to the challenge of HIPAA, here are best practices to consider:
Reliable and Repeatable Audit Controls
Your technology should always be ready for a HIPAA audit. Achieving this readiness involves having controls in place so that when auditors — or internal compliance team — want to take stock of your compliance posture, they have the log files and other data to do so efficiently.
The audit controls recommended by the HIPAA are described in three categories, application audit trails, users audit trails, and system audit trails. You’ll need address all three in your compliance program.
Strong Encryption
All ePHI that is transmitted across your network, including through email, text message, collaboration platforms, and messaging apps must be encrypted, preferably with an industry-accepted technology like advanced encryption standard (AES).
While many of today’s popular collaboration platforms incorporate encryption be default, you should work to ensure that ePHI and other sensitive data is encrypted from end to end, meaning that only the sender and receiver can view the data. You’ll also need to make the important distinction between data at rest and data in motion, so that ePHI archives receive the proper protection.
Physical Security Protections
Physical security under HIPAA means making sure that unauthorized users are never able to physically compromise ePHI containing systems. In today’s modern network environment, where the network perimeter has continued to push outward, that means careful attention to all network endpoints.
Obviously, this is just an overview of the controls you’ll need to enforce for HIPAA compliance. If you’d like to talk about the controls listed above in greater depth, or determine how they apply to your organization, the Complete Network team is ready to help, click here to book a call with our team.
As with any regulatory compliance program, you must remain vigilant with HIPAA and HITECH to ensure success. One common stumbling block is failing to account for all the components and systems that can lead to a compliance slip. Here are a few areas that organizations sometimes overlook.
Business Associates
To develop strong overall HIPAA compliance, you must be certain that all business associates who touch upon ePHI are doing so responsibly. Any business associate, including medical billing firms, accounting services, and IT vendors must have a written agreement in place that lays out their obligations in detail.
Secure Wireless Networks
Mobile healthcare professionals are dependent on WiFi signals and wireless LANs to access and share the patient information they need. However, this category of network is a well-known compliance liability.
To secure a wireless LAN, you should start by making sure that your existing security software is properly configured to detect threats, such as data interception and packet sniffing, which typically affect these networks.
For healthcare organizations that provide public WiFi access to visitors, you may want to separate your public and private WiFi networks, so that guests are kept safely away from vulnerable network hardware or ePHI.
Want to learn more? We’ve written a comprehensive guide to HIPAA compliance here.
The most reliable way to achieve and stay compliant is to enlist the help of an experience partner, like Complete Network. For decades, we’ve been helping healthcare companies implement the technical, administrative, and physical safeguards to stay confident about their HIPAA and HITECH posture.
In an ideal world, technology would be a consistent source of competitive advantage and benefit for small and midsized businesses. The reality is that many fail to realize that confidence.
Without the right resources and support, even a highly skilled technology team can become overwhelmed by the growing list of technology management duties. When important tasks get neglected, it creates ripple effects throughout an organization that damage productivity and efficiency.
The co-managed IT services model solves these problems by providing your existing IT team with all the support and resources they need to successfully plan, manage, and defend your network technology.
This guide covers:
Download it for free by filling out the form here.
