Privacy and Security Standards | Healthcare Standards

HIPAA (Health Insurance Portability and Accountability Act)

Enacted: 1996 (US federal law) Enforced by: HHS Office for Civil Rights (OCR)

HIPAA Privacy Rule

Purpose: Protects patient health information (PHI) Applies to: Covered entities and business associates

Covered Entities:

Healthcare providers (hospitals, doctors, clinics)
Health plans (insurance companies, HMOs)
Healthcare clearinghouses

Business Associates:

Vendors that create, receive, maintain, or transmit PHI on behalf of covered entities
Examples: EHR vendors, billing companies, consultants, cloud providers

Protected Health Information (PHI): Any individually identifiable health information, including:

Names
Geographic identifiers (address, zip code)
Dates (birth, admission, discharge, death)
Telephone/fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate/license numbers
Vehicle identifiers
Device identifiers and serial numbers
URLs and IP addresses
Biometric identifiers
Full-face photos
Any other unique identifying number or code

Permitted Uses and Disclosures:

Treatment, Payment, and Healthcare Operations (TPO)
When patient authorizes in writing
For public health activities
To prevent serious threats to health or safety
As required by law
Limited dataset for research

Patient Rights:

Right to access their records
Right to request amendments
Right to an accounting of disclosures
Right to request restrictions
Right to confidential communications
Right to notice of privacy practices

Minimum Necessary Standard: Use, disclose, or request only the minimum PHI necessary to accomplish the purpose.

HIPAA Security Rule

Purpose: Establishes safeguards for electronic PHI (ePHI) Three Categories:

1. Administrative Safeguards:

Security Management Process
- Risk analysis
- Risk management
- Sanction policy
- Information system activity review
Assigned Security Responsibility
Workforce Security
- Authorization and supervision
- Workforce clearance procedures
- Termination procedures
Information Access Management
- Access authorization
- Access establishment and modification
Security Awareness and Training
- Security reminders
- Protection from malicious software
- Log-in monitoring
- Password management
Security Incident Procedures
Contingency Plan
- Data backup plan
- Disaster recovery plan
- Emergency mode operation plan
Business Associate Contracts

2. Physical Safeguards:

Facility Access Controls
- Contingency operations
- Facility security plan
- Access control and validation procedures
Workstation Use and Security
Device and Media Controls
- Disposal procedures
- Media re-use
- Accountability
- Data backup and storage

3. Technical Safeguards:

Access Control
- Unique user identification (Required)
- Emergency access procedure (Required)
- Automatic logoff (Addressable)
- Encryption and decryption (Addressable)
Audit Controls
- Implement hardware, software, and procedural mechanisms to record and examine access
Integrity Controls
- Mechanisms to ensure ePHI is not improperly altered or destroyed
Person or Entity Authentication
- Verify person/entity seeking access is who they claim to be
Transmission Security
- Encryption (Addressable)
- Integrity controls (Addressable)

HIPAA Breach Notification Rule

Breach Definition: Unauthorized acquisition, access, use, or disclosure of PHI that compromises security or privacy

Notification Requirements:

To Individuals: Within 60 days of discovery
To HHS:
- Within 60 days for breaches affecting fewer than 500 individuals
- Within 60 days but no later than next calendar year for breaches >=500
To Media: Prominent media outlets if breach affects >=500 individuals in a state
Business Associates to Covered Entities: Without unreasonable delay, no later than 60 days

Exceptions (Safe Harbor): If PHI was encrypted using NIST-specified algorithms, breach notification may not be required.

HIPAA Penalties

Tiers (per violation):

Tier 1: Unknowing - $100 to $50,000
Tier 2: Reasonable cause - $1,000 to $50,000
Tier 3: Willful neglect (corrected) - $10,000 to $50,000
Tier 4: Willful neglect (not corrected) - $50,000

Annual Maximum: $1.5 million per violation type

Criminal Penalties:

Knowingly obtaining PHI: Up to 1 year prison, $50,000 fine
False pretenses: Up to 5 years prison, $100,000 fine
Intent to sell/transfer/use for harm: Up to 10 years prison, $250,000 fine

Implementation for Software Developers

Key Requirements:

Unique User IDs: Each user must have unique identifier
Automatic Logoff: Implement session timeouts
Encryption: Use strong encryption (AES-256 recommended)
- At rest: Database encryption, disk encryption
- In transit: TLS 1.2+ for all connections
Audit Logs: Log all PHI access with user ID, timestamp, action
- Retain logs for 6 years
- Protect logs from tampering
Access Controls: Role-based access control (RBAC)
Authentication: Strong password policies, MFA recommended
Backup and Recovery: Regular encrypted backups, tested recovery
Business Associate Agreement (BAA): Required contract with all vendors

Technical Implementation Example:

# Example audit logging
def log_phi_access(user_id, patient_id, action, resource):
    audit_entry = {
        'timestamp': datetime.utcnow().isoformat(),
        'user_id': user_id,
        'patient_id': patient_id,
        'action': action,  # 'read', 'write', 'delete'
        'resource': resource,  # 'demographics', 'lab_results', etc.
        'ip_address': request.remote_addr,
        'session_id': session.get('session_id')
    }
    audit_log.write_encrypted(audit_entry)

# Example access control check
def check_access(user, patient, action):
    # Check if user has role allowing access
    if not user.has_role_for_patient(patient, action):
        log_access_denied(user.id, patient.id, action)
        raise UnauthorizedAccess

    # Check if patient has restricted their data
    if patient.has_restriction_for_user(user):
        log_access_denied(user.id, patient.id, action)
        raise RestrictedAccess

    log_phi_access(user.id, patient.id, action, 'demographics')
    return True

HITECH Act (Health Information Technology for Economic and Clinical Health)

Enacted: 2009 (part of American Recovery and Reinvestment Act) Purpose: Promote adoption of health IT and strengthen HIPAA

Key Provisions:

Extended HIPAA to business associates
Increased penalties for HIPAA violations
Required breach notification
Promoted meaningful use of EHRs through incentives
Established ONC to coordinate health IT

Meaningful Use Program (now MIPS/MACRA):

Stage 1: Data capture and sharing
Stage 2: Advanced clinical processes
Stage 3: Improved outcomes

Enacted: 2018 (EU regulation) Applies to: Organizations processing EU residents’ data

Key Principles:

Lawfulness, fairness, transparency
Purpose limitation
Data minimization
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

Individual Rights:

Right to access
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restrict processing
Right to data portability
Right to object
Rights related to automated decision-making

Special Category Data: Health data is considered “special category” requiring explicit consent or specific legal basis.

GDPR vs HIPAA Key Differences:

Consent: GDPR requires explicit consent; HIPAA allows TPO without consent
Right to Delete: GDPR mandates; HIPAA does not
Breach Notification: GDPR requires within 72 hours; HIPAA within 60 days
Penalties: GDPR up to 20M EUR or 4% of revenue; HIPAA up to $1.5M annually
Geographic Scope: GDPR applies to EU data subjects; HIPAA to US covered entities

Implementation for Healthcare Software:

Obtain explicit consent for health data processing
Implement data deletion capabilities
Support data portability (export in machine-readable format)
Document data processing activities
Appoint Data Protection Officer (if required)
Implement Privacy by Design
Conduct Data Protection Impact Assessments (DPIAs)

ISO 27001 (Information Security Management)

Purpose: International standard for information security management systems (ISMS) Relationship to HIPAA: Can help demonstrate HIPAA compliance

Core Components:

Context of the Organization: Understanding internal and external issues
Leadership: Management commitment and security policy
Planning: Risk assessment and treatment
Support: Resources, competence, awareness
Operation: Implementing controls
Performance Evaluation: Monitoring and measuring
Improvement: Nonconformity and corrective action

Annex A Controls (14 domains, 114 controls):

Information Security Policies
Organization of Information Security
Human Resource Security
Asset Management
Access Control
Cryptography
Physical and Environmental Security
Operations Security
Communications Security
System Acquisition, Development, and Maintenance
Supplier Relationships
Information Security Incident Management
Business Continuity
Compliance

ISO 27001 Certification:

Requires third-party audit
Valid for 3 years with annual surveillance audits
Demonstrates commitment to security

ISO 27799 (Health Information Security)

Purpose: Sector-specific guidance for healthcare on ISO 27001 Provides: Healthcare-specific controls and implementation guidance

Additional Healthcare Considerations:

Clinical information systems security
Medical device security
Patient privacy rights
Consent management
De-identification and anonymization
Research ethics
Telemedicine security

NIST Cybersecurity Framework

Purpose: Voluntary framework to manage cybersecurity risk Widely Adopted: Many healthcare organizations use alongside HIPAA

Core Functions:

Identify: Asset management, risk assessment, governance
Protect: Access control, awareness training, data security
Detect: Anomaly detection, continuous monitoring
Respond: Response planning, communications, analysis
Recover: Recovery planning, improvements, communications

Implementation Tiers:

Tier 1: Partial (ad hoc, limited awareness)
Tier 2: Risk Informed (approved by management)
Tier 3: Repeatable (formally approved, regularly updated)
Tier 4: Adaptive (continuous improvement)

Quiz: Privacy and Security Standards

Question 1 of 5