Neither the authors of the HIPAA legislation nor the Health and Human Services´ Office for Civil Rights have ever issued guidance about the methodology that should be used to conduct a HIPAA-compliant risk assessment. Though frustrating for many, this was a deliberate effort to ensure that HIPAA did not need to be constantly updated with new codes of practice. Much like the “addressable requirements” found throughout the HIPAA document (particularly the Security Rule), it gives the CE or BA flexibility to decide how best to protect PHI based on their available resources.
Thus, each individual Covered Entity and Business Associate has to determine what areas should be covered by the risk assessment and how they will be assessed. This can be daunting for organizations entering a healthcare-related industry with no previous exposure to HIPAA – even those whose access to PHI will be limited.
CEs and BAs are not, however, left totally in the dark about how to conduct risk assessments. The Office of the National Coordinator for Health Information Technology has developed a free Security Rule Assessment (SRA) tool that organizations can download and use in the risk assessment process. As this tool only covers the Security Rule element of HIPAA, organizations – particularly those applying for Meaningful Use incentive payments – will also need to conduct a risk assessment to assess their compliance with the Privacy Rule. There is professional help available for organizations who need it.
Generally, when conducting a risk assessment, organizations should focus divide threats into “internal” vs “external” threats. Internal threats are often the result of human error – phones left on buses, documents left on desks, cabinets left unlocked. These are easily identified though can be hard to address, as human errors are almost unavoidable. External threats often take a much larger scale – cyberattacks pose an ever-increasing threat to patient privacy. It may seem like there’s little an employee can do to tackle this, but education about phishing scams and similar schemes can be very helpful.
There is no further guidance about HIPAA password requirements.
The reason why HIPAA is not more specific about passwords is to ensure legislation does not need to be updated every time there is a change in password and security best practices.
For example, at the time when HIPAA was initially enacted, passwords consisting of a minimum of 6 letters was a best practice.
Today, 6-digit alphanumeric passwords can be cracked using brute force algorithms within minutes.Further, while passwords are currently ubiquitous and are the primary way accounts are secured, that could well change in the future due to advances in two-factor authentication and biometrics.
HIPAA allows for future changes and is deliberately flexible so HIPAA-covered entities and their business associates can develop their own password policies – provided they comply with the Security Rule Standards referenced above.Consequently, policies should be developed that stipulate how passwords are created, changed, and safeguarded.
Policies should also address resetting passwords when it is reasonably believed a password has been compromised, shared with an individual other than the account holder, or in response to a cyberattack.
Supremus Group LLC has completed activities required for compliance with the privacy rule and has implemented policies and procedures necessary to protect the privacy of our members’ personal health information.https://www.supremusgroup.com/
