Healthcare providers, healthcare plans, healthcare clearinghouses, and also any of their service or technology providers (known as “business associates”) must comply with HIPAA’s security, privacy, and breach notification rules. These are the organizations and entities in the United States that process, store, and transmit the health data of individuals for healthcare reasons.

Protected health information, or PHI, is any personal health data created, stored, or transmitted by covered entities and their business associates in order to complete healthcare-related activities and transactions. As an example, this could include data stored and transmitted by a technology service that provides email or text-based appointment reminders.

The proper technical, physical, and administrative safeguards must be in place to protect the confidentiality, integrity, and availability of all PHI. This means ensuring that there is no chance of unauthorized access, tampering, or damage to PHI electronically or physically. The Carbide platform guides you through establishing a foundation of HIPAA-compliant security policies and the action items required to ensure your PHI is safeguarded.

A Business Associate’s Agreement (BAA) is a contract required between a covered entity like a hospital or other healthcare provider and their associated vendors. The BAA outlines each party’s responsibilities as it relates to protected health information and makes responsible the vendor or service provider who is now entrusted with the protected health information. This means that if you are transmitting PHI to another service provider, having that service provider sign a BAA holds them responsible for that information.

There is no officially endorsed HIPAA certification and therefore no audits are required to be certified. Though companies are permitted to sell “certification” audits and services, these are not required by HIPAA for compliance. Under HIPAA, organizations must perform a periodic review of all technical and non-technical requirements, including security policies and procedures. This can be done internally using an information security management platform like Carbide to identify gaps in compliance and generate reports.

Under the law, business associates can be held directly liable for HIPAA violations. Failure to comply with the regulatory requirements, such as the Security Rule or providing breach notifications, would be a violation of the terms of the business associate agreement. The Department of Health and Human Services has the authority to take enforcement action against business associates that fail to meet their obligations for protecting health information.