HIPAA Security Evaluation: Checking Your Compliance Vital Signs

Checking Your Compliance Vital Signs
In health care, we think of “Vital Signs” as the measurements of body temperature, pulse, respiration rate, and blood pressure. Vital signs provide information about your general health. They offer clues to medical conditions. When you are sick, they are used to help check your return to good health.

In a similar way, HIPAA has “Vital Signs”, although not measurements of body temperature, pulse, respiration rate, and blood pressure. HIPAA created the Evaluation Standard 164.308(a)(8), which requires a periodic technical and non-technical evaluation of the healthcare organizations security safeguards to demonstrate and document compliance with security policy and the security rule requirements. In the case of your HIPAA program, the required periodic evaluation provides information about your organizations compliance health. The evaluation offers clues to the condition of security safeguards. If safeguards are found lacking, the evaluation is used to help check the return to good compliance health. Let’s examine the specific rule:

Evaluation 164.308(a)(8)
HIPAA Standard: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which an entity’s security policies and procedures meet the requirements of this subpart.

Required Standard
HIPAA created the Evaluation Standard 164.308(a)(8), which requires a periodic technical and non-technical evaluation (emphasis added) of the healthcare organizations security safeguards to demonstrate and document compliance with their security policy and the security rule requirements. Required standard, means, “a covered entity must implement the implementation specifications”.

Some Thoughts on Conducting an Evaluation

  1. Decide whether the evaluation will be conducted with internal staff resources or external consultants.
  2. Engage external expertise to assist the internal evaluation team where additional skills and expertise is determined to be reasonable and appropriate.
  3. Use internal resources to supplement an external source of help, because these internal resources can provide the best institutional knowledge and history of internal policies and practices.

Develop Standards and Measurements for Reviewing All Standards and Implementation Specifications of the Security Rule

  1. Use an evaluation strategy and tool that considers all elements of the HIPAA Security Rule and can be tracked, such as a questionnaire or checklist.
  2. Implement tools that help document and report on the level of compliance, integration, or maturity of a particular security safeguard deployed to protect EPHI.
  3. If available, consider engaging specific staff or management having responsibilities that include security (for example, billing manager).
  4. Leverage any existing reports or documentation that may already be prepared by the organization addressing compliance, integration, or maturity of a particular security safeguard deployed to protect EPHI.

Conduct Evaluation

  1. Determine, in advance, what departments and/or staff will participate in the evaluation.
  2. Secure management support for the evaluation process ensures participation.
  3. Collect and document all needed information.
  4. Collection methods may include the following: Interviews, surveys, third party examinations
  5. Outputs of automated tools, such as access control auditing tools, system logs, and results of penetration testing.
  6. Conduct penetration testing (where trusted insiders attempt to compromise system security for the sole purpose of testing the effectiveness of security controls), if reasonable and appropriate.

Document Results

  1. Reasonable and appropriate documentation practices will often include:
  2. Analyze the evaluation results.
  3. Identify security weaknesses.
  4. Document in writing every finding and decision.
  5. Develop security program priorities and establish targets for continuous improvement.

Repeat Evaluations Periodically

  1. Establish the frequency of evaluations, taking into account the sensitivity of the EPHI controlled by the organization, its size, complexity, and environmental and/or operational changes (e.g., other relevant laws or accreditation requirements).
  2. In addition to periodic re-evaluations, consider repeating evaluations when environmental and operational changes are made to the organization that affect the security of EPHI (e.g., if new technology is adopted or if there are newly recognized risks to the security of the information).

Conducting your annual security evaluation is an excellent way to insure you have complied with Evaluation Standard 164.308(a)(8) of HIPAA and have documented your organizations HIPAA vital signs.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us