Some of the Healthcare apps, eHealth,
mHealth apps in the US have to comply with HIPAA which is a set of standards
meant to protect the sensitive health information of patients. If these rules
are violated, the concerned entities may face severe repercussions.
Here is one such real-case scenario
of a leading provider of insurance in the US, Anthem, Inc.
In October
2018, Anthem, health insurance provider was charged a heavy penalty for
neglecting security and privacy rules set by HIPAA. It started with a small
phishing email and later led to a massive data breach. There was an aggressive
cyber-attack by the hackers that may have exposed the protected health data
(PHI) of approximately 79 million patients which further lead to the risk of
identity fraud.
Also, the
infuriated patients sued Anthem and won a settlement of $115 million. Not only
this, but Anthem was charged by the U.S. Department of Health and Human
Services Office for Civil Rights (OCR) at $16 million. Had the company followed
HIPAA compliance, they could have saved millions as well as their brand image.
If such a large corporation could go
through such devastating attacks and penalties for violating HIPAA rules,
smaller practices need to be all the more cautious.
Why is HIPAA Compliance so Important/Crucial?
Today, thousands of health apps and
software are being used by patients as well as doctors. A tremendous amount of
sensitive health and personal data continually flows through them. So, the
owners of telemedicine apps, hospital bodies using the healthcare apps,healthcare IT services developing healthcare apps carry a
huge responsibility to protect this data. In case they fail to do so, it could
lead to data breaches, healthcare frauds, identity thefts, blackmail, etc. So,
the concerned entities must abide by HIPAA guidelines. Here are some key
advantages to following them:
- It fosters an environment of compliance.
- Helps to educate the staff about the right way to handle sensitive data and practice strict security controls.
- Enables to proactively assure that electronic PHI is being accessed, transmitted, stored, or shared appropriately and securely.
- Simplifies administrative healthcare functions while improving the efficiency of the entity.
- Helps in the transition from paper records to the digitalization of health records or other forms while reducing manual errors.
- Helps to gain patients’ trust which also improves brand reputation.
- Provides a competitive edge.
- Helps organizations to avoid expenses for add-on security measures.
- Facilitates enhanced operational efficiency in healthcare practices.
What kind of Health Data falls under HIPAA
Compliance?
Any medical app involves crucial
medical data. HIPAA’s primary focus is on securing this data i.e. PHI. PHI is
categorized majorly in two parts- health records/data and personally
identifiable data. As per the Department of Health and Human Services, PHI’s
personally identifiable data includes 18 classes namely:
- patient names;
- geographical data including
state, city, country, exact address, pin code, etc.;
- dates like their admission
dates, discharge dates, birth or death dates, etc.;
- contact numbers;
- fax numbers;
- emails;
- medical record numbers;
- social security numbers;
- health plan beneficiary numbers
and names;
- account numbers and other
credentials;
- certificate/license numbers;
- vehicle identifiers and serial
numbers;
- device identifiers and serial
numbers;
- IP addresses;
- web URLs;
- biometric identifiers like
fingerprints and voice prints;
- photos or images of faces and
any comparable images;
- Any other
unique identifying numbers, codes, or characteristics.
What Entities are covered under the
HIPAA PrivacyRule?
The below-mentioned individuals and
organizations willing to develop healthcare apps must adhere to HIPAA-compliant
structure and its guidelines.
Healthcare Providers: Any healthcare service
provider, big or small, that requires electronic processing or transmission of
medical data for certain transactions like requests for authorization, claims,
inquiries for eligibility, and other such transactions comes under this category.
These include hospitals, or individual practitioners like doctors, dentists,
psychologists, etc.
Health Plans: These comprise of
entities that pay the cost of healthcare expenses, for instance, insurance
providers, health maintenance organizations (HMOs), employer-sponsored group
health plans, multi-employer health plans, government- or church-sponsored
health plans, etc.
Healthcare Clearinghouses: These are the entities
that act as middlemen between the healthcare service providers and insurance companies.
These process nonstandard data they receive from a healthcare organization into
a standard format or vice versa.
Business Associates: The entities that store,
collect, process, or transmit PHI on behalf of all the aforesaid covered
entities.
How to Make your Medical App HIPAA Compliant?
Any entity that wants to build a HIPAA
compliant medical app or software must do the following:
- Ensure the integrity, privacy, confidentiality, and availability of all ePHI i.e. electronic protected health information.
- Detect probable threats and safeguard the information in all the ways possible.
- Protect against probable impermissible disclosures or accesses
- Certify compliance by the staff
Also, here is a list of security
measures to be taken for protecting and controlling access to health data in a medical
app.
Limit Access of data: Limit the access to
sensitive data by providing a unique ID to concerned authorities and also the
patients. This helps in tracking the activity being carried out in the application.
Entity Authentication: Verify the person/entity
trying to access the data with the use of passwords, biometrics, PHI PINs,
token, digital signatures, etc. The app must provide access only to
authenticated users.
Encryption of the data: Ensure that the PHI data
in healthcare apps is encrypted before storing it on the servers and databases.
Use tools like BitLocker, File Vault, etc for encrypting the data. Encryption
greatly ensures data integrity by protecting it from hackers. Without
decryption keys, the hackers would just keep struggling around without any
results.
Using Secured protocols: The data transmitted
over networks and between the tiers of a system, should be channeled through
HTTPS protocol that encrypts data using SSL and TLS. If PHI data has to be sent
through email, then HIPAA compliant email services should be used.
Ensure Data Backup: Backup of all PHI is a
must. It must be stored in various locations so that in case of a system crash
or database corruption or a fire in a data center, the data remains intact.
Discard PHI data after use: Any sensitive data
should be permanently destroyed if not needed anymore. In case it remains in
your systems, scanners, biomedical equipment, memory cards, network cards,
etc., it is vulnerable to threats.
Automatic Logging-off: In case of inactivity,
the app having PHI should terminate the session automatically. The users will
need to log-in again by re-entering the password.
Monitoring and Auditing of data: Monitoring and auditing
of the data in healthcare apps must be conducted regularly. Every time a user
logs in or out, the details must be recorded. The data can be monitored via
hardware, software, or other procedures. Activity on PHI data can be recorded
using a log file or log table in the database.
Extra Mobile App Security: The security measures in
mobile apps like screen-lock, remote data erasing, full-device encryption, etc.
must be suggested to the users of the app to enhance the security of the data.
These can’t be forced on the users though.
Final Verdict:
Unauthorized access of PHI data from healthcare
apps will lead to huge fines that can cost you a fortune but HIPAA compliance
can save you from these penalties. HIPAA security will assure the auditors that
you have done enough to protect medical data from phishing, social engineering,
breaches, etc. Though adhering to HIPPA seems cumbersome, yet they guarantee
future-proof apps, secured software solutions, infrastructures for a booming
healthcare market.
Has this
blog provided you with the required insights about HIPAA rules and HIPAA
compliant apps?
Please let us know through your comments.
