What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 was created by the U.S. Department of Health and Human Services (HHS) to initiate rules and regulations surrounding the protection of a patient’s health information and data. Prior to HIPAA, there were no standards or rules that protected the sensitive information and data of health records for patients. Additionally, the health industry began relying on electronic modes of storing and transmitting health records which in return, became cause to establish a protective act such as HIPAA. Two specific sets of protection rules were highlighted under this act to preserve the privacy and security of medical information. The privacy rule set national standards that protects certain health information while the security rule establishes the same restrictions but more specifically with the electronic health data that is shared. This shift of digitalization increased the healthcare industry’s priority to preserve and protect all health information. Thus, it is vital to ensure that this database is protected from any potential cybersecurity threat.
Security Rule
The security rule is the specific provision that addresses the protection and management of medical information as it is accessed and transferred in electronic form. Under HIPAA, the e-PHI (Electronic Protected Health Information) is a measure that provides a set of guidelines in regards to the manner in which this information is protected and utilized within the healthcare industry. Under this measure, it asserts the 18 distinct demographics that could be used to identify patients and their corresponding information. These demographics include personal information such as a patient’s name, address, social security number and other sensitive identifiers. Due to the extreme sensitivity of this information, the Office for Civil Rights (OCR) enforces the penalties that can occur if this act receives any misconduct or manipulation.
Cybersecurity Threat
Electronic information in regards to a patient’s health plan, insurance, and history is extremely valuable for both the patient and the healthcare entity deemed responsible. Thus, this data can be a vulnerable target for any potential cybersecurity attacks. One of the more common methods that hackers deploy their attacks when it comes to infiltrating health data is ransomware. Hackers will essentially infiltrate an entity’s system through vulnerabilities and weaknesses and block the organization from accessing the system. The hackers will then hold the information as ransom to be compensated in order for the release of the information. With the accelerated advancements of digitizing health information, each step of progress also increases the stakes for the system to be hijacked and exploited as well. As such, HIPAA continues to reform the security measurements and guidelines that entities must follow in order to protect their organization’s information and data.
Electronic Applications Protected Under HIPAA
Within the migration of digitizing health information and records, clinical applications have been designed to better manage data from various perspectives.
CPOE (Computerized Provider Order Entry): This application is utilized on behalf of healthcare providers that send information such as medication and treatment instructions for patients.
EHR (Electronic Health Records): An electronic health record is essentially a digital version of a patient’s health chart which includes an overall scope of a patient’s history and current state.
