Health Insurance Portability and Accountability Act
Our HIPAA Compliance Program provides services to help our clients efficiently and cost effectively manage the entire compliance life-cycle and address the requirements enforced by the Department of Health and Human Services. IT Balance works with its clients in preparing for the required ongoing HIPAA reviews, conducting the reviews in an educational, rather than adversarial manner, documenting compliance with the rules, and providing a HIPAA Compliance Statement.
Our HIPAA security review covers:
Administrative safeguards
Physical safeguards
Technical safeguards
Organizational requirements
Policies, procedures, and documentation requirement
Following the compliance review, IT Balance can assist in developing a remediation plan and in developing safeguards that must be in place including procedures that must be implemented to become HIPAA Compliant.
HIPAA Business Partner Review
Many health care organizations are unaware of the compliance requirements associated with business partners and outside service providers. IT Balance reviews third-party agreements in order to ensure that they contain the provisions required by HIPAA.
Training Services
HIPAA training under both the Privacy Rule and Security Rule is mandatory for “all members of an entity’s workforce who, by virtue of their position, are likely to obtain access to protected health information” and “all members of an entity’s workforce who, by virtue of their position, are likely to obtain access to protected health information.” This pertains to employees, volunteers, trainees and contractors. IT Balance provides training services to enable organizations meet these requirements.
Managed Services
IT Balance provides a managed services solution that is HIPAA compliant. We can deliver first-class 24/7 IT support that also takes away some of the burdens of the provider associated with information assurance.
IT Balance Solutions
for Achieving HIPAA Compliance
The Administrative Safeguards of HIPAA compliance require documented policies and procedures for day to day operations, management of employees, as well as the security controls in place to protect healthcare information. IT Balance is able to provide comprehensive help with compliance against the HIPAA security rule. Whether an organization simply needs help getting started, or requires a certification of compliance from an external reviewer, we can help.
| Requirement | Description | IT Balance Solution |
|---|---|---|
| Security Management Process Section 164.308 (1) | Implement policies and procedures to prevent, detect, contain, and correct security violations.
|
|
| Assigned Security Responsibilities Section 164.308 (2) |
Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the entity. |
|
| Workforce Security Section 164.308 (3) | Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information (EPHI) and to prevent access by others who do not have authorization.
|
|
| Information Access Management Section 164.308 (4) | Implement policies and procedures for authorizing access to EPHI that are consistent with the applicable requirements of subpart E of this part.
|
|
| Security Awareness and Training Section 164.308 (5) | Implement security awareness and training program for all members of its workforce.
|
|
| Security Incident Procedures Section 164.308 (6) | Implement policies and procedures to address security incidents
|
|
| Contingency Plan Section 164.308 (7) | Establish and implement policies and procedures for responding to an emergency or other occurrence such as fire, vandalism, system failure, & etc. that damage systems containing EPHI.
|
|
| Evaluation Section 164.308 (8) | Perform a periodic technical and non-technical evaluation initially based on HIPAA standards and subsequently based on environmental and operational changes affecting the security of EPHI. |
|
| Business Associate Contracts and Other Arrangements Section 164.308 (9) | A covered entity (CE) may permit a business associate to create, receive, maintain or transmit EPHI on the CE’s behalf only if the CE obtains satisfactory assurances in accordance with § 164.314 (a) That the business associate will appropriately safeguard the information. |
|
| Requirement | Description | IT Balance Solution |
|---|---|---|
| Facility Access Controls Section 164.310 (1) | Implement policies and procedures to limit physical access to electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.
|
|
| Workstation Use Section 164.310 (2) | Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed and the physical attributes of the surroundings of a specific workstation or class of workstation that can access EPHI. |
|
| Workstation Security Section 164.310 (3) | Implement physical safeguards for all workstations that access EPHI to restrict access to authorized users. |
|
| Device and Media Controls Section 164.310 (4) | Implement policies and procedures to that govern the receipt and removal of hardware and electronic media that contain EPHI.
|
|
| Requirement | Description | IT Balance Solution |
|---|---|---|
| Access Control Section 164.312 (1) | Implement technical policies and procedures for electronic information systems that maintain EPHI to allow access only to persons or processes granted access rights as specified in Administrative Standard section.
|
|
| Audit Control Section 164.312 (2) | Implement hardware, software, and/or procedures that record and examine activity in information systems that contain or use EPHI. |
|
| Integrity Section 164.312 (3) | Implement policies and procedures to protect EPHI from improper alterations or destruction.
|
|
| Person or Entity Authorization Section 164.312 (4) | Implement procedures to verify that a person or entity is seeking access to EPHI is authentic. |
|
| Transmission Security Section 164.312 (5) | Implement technical security measures to guard against unauthorized access to EPHI that is being transmitted over electronic communications network.
|
|
