A Brief History of HIPAA
The Health Insurance Portability and Accountability Act (HIPPA) has been in place for almost 20 years and has continued to evolve alongside the shift from paper to digital records. As a direct result of record setting cyberattacks in the Healthcare industry in the past two years, the Office for Civil Rights (OCR) at the department of Health and Human Services (HHS) issued a Notice of Proposed Rulemaking (NPRM) to modify the HIPAA Security Rule in order to strengthen cybersecurity protections for electronic protected health information (ePHI).
This proposed rule seeks to strengthen cybersecurity by updating the Security Rule’s standards to better address ever-increasing cybersecurity threats to the health care sector. The updated regulations demand faster response times, rigorous security measures, and improved visibility into vulnerabilities. These new standards may present major challenges for many organizations — especially those that have struggled to meet past legislative requirements. In light of these factors, it is important to have an accurate understanding of how these new HIPAA regulations could affect healthcare organizations, and what steps can be taken to implement them.
Summary of 2024 Proposed Changes to the HIPAA Security Rule
The HIPAA Rules apply to covered entities and business associates including:
- Health care providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies, but only if they transmit any information in electronic form in connection with a transaction for which HHS has adopted a standard.
- Health plans: Health insurance companies, HMOs, company health plans, and government programs that pay for health care, such as Medicare, Medicaid, and military veterans’ health care programs.
- Health care clearinghouses: Entities that process nonstandard health information they receive from another entity into a standard format, or vice versa.
The core theme of the proposed updates is the removal of the distinction between “required” and “addressable” implementation specifications, along with the elimination of most exceptions. These updates aim to enforce consistent compliance measures across healthcare organizations.
Enhanced mandatory written documentation requirements for:
- Annual compliance audits remain mandatory.
- Security policies and procedures.
- Testing plans for data security.
- Incident response processes and analysis.
- Increased emphasis on proactive documentation for audits and proof of compliance.
Enhanced risk management
- Mandated system hardening: Requires the application of secure configurations and controls to all systems interacting with ePHI.
- Bi-annual vulnerability scanning: Ensures identification and remediation of security gaps every six months.
- Detailed risk analysis: Expanded to include assessments of insider threats, third-party risks, and evolving cyber threats.
- Required data encryption: Mandatory for both data in transit and at rest, with stricter enforcement on encryption methods.
Breach incident reporting and response
- 72-hour data restoration requirement: Organizations must restore ePHI access and functionality within 72 hours following an incident.
- 24-hour notification of ePHI access changes: Applies to both unauthorized access and major access modifications.
- Business associate 24-hour reporting requirement: Partners handling ePHI must notify covered entities of breaches within 24 hours.
Regular asset inventories and security audits
- Annual technology asset inventory: Includes a comprehensive network map for all systems handling ePHI.
- Annual testing of security measures: Ensures continued effectiveness of implemented controls.
- Validation of business associate safeguards: Annual verification that all business associates comply with required security standards.
Backup and recovery
- Annual review and testing of backup measures: Organizations must test backup systems to ensure they can recover ePHI as required.
- Implementation of separate technical controls: These ensure the integrity of backup and recovery processes, preventing contamination or compromise.
- Data prioritization restoration analysis: Formalized procedures for determining which ePHI data must be restored first in case of an incident.
How Customers Should Address the New Rule
Understanding the new legislation is the first half of the battle. Organizations also have to take the proper steps to ensure that their security controls comply with the new HIPAA rules. In order to do this, healthcare organizations should take the following steps:
- Zero trust principles: Zero trust principles are the implementation of continuous authentication and authorization when a user, device, or application tries to access the network. No person, device, or program is automatically granted unlimited access to an organization’s network.
- Implement robust backup solutions: Ensure that data backup and disaster recovery solutions are in place to meet the 72-hour restoration requirement. This includes regular testing of backup systems to ensure they function correctly in the event of a data loss incident.
- Conduct regular compliance audits: Establish a schedule for annual compliance audits to review and update security policies, procedures, and plans. This includes maintaining detailed records of all security measures and conducting thorough risk assessments.
Enhance cybersecurity measures: Strengthen cybersecurity protocols to protect ePHI from cyber threats. This includes implementing encryption, access controls, and continuous monitoring of data access and modification logs.
Andrew Mosio“Ensuring HIPAA compliance is not just a regulatory obligation for us; it’s essential to maintaining the trust of our patients. Implementing a robust incident response process enables us to swiftly address potential breaches, safeguard sensitive data, and minimize disruptions to our services.”
Director of Technology & Service Delivery
UI Health
How Veeam Helps Clients Address HIPAA Compliance
Healthcare customers are one of the Cybersecurity & Infrastructure Security Agency’s (CISA) 16 critical infrastructure sectors. In recognition of the importance of this industry, Veeam provides comprehensive solutions to help healthcare organizations meet HIPAA compliance requirements. One way is through Coveware by Veeam. They have expertise, experience, and patent pending tools designed to drive decisions to minimize damage and determine the best recovery path — not to mention they deal with cyber extortion every day. Coveware experts are always on hand to guide your organization through stressful times, with a team who has a proven track record to help you every step of the way.
Veeam also empowers healthcare organizations to achieve compliance while enhancing operational resilience. Our solutions are purpose-built to align with HIPAA requirements and provide the following benefits:
- Compliance and visibility: Conduct gap analysis and monitor regulatory adherence using built-in reporting tools. Ensure audit readiness with detailed logs and immutable backup copies.
- Accelerated recovery: Achieve the 72-hour data restoration requirement with enterprise-grade recovery speeds. Rely on automated recovery testing to validate ePHI availability and integrity.
- Proactive threat defense: Leverage ransomware detection and incident response to safeguard critical data. Utilize immutable backups for enhanced protection against malicious attacks.
- Modernized data operations: Integrate hybrid cloud and multi-cloud environments for scalable backup and recovery. Optimize costs and efficiency using advanced deduplication and storage-tiering technologies.
Final Thoughts:
The new HIPAA rule represents a pivotal shift in how healthcare organizations must manage and protect their data. With the increasing threat of cyberattacks, particularly in the healthcare sector where the stakes are incredibly high, adherence to the updated regulations is not just a legal obligation but a moral one as well.
By embracing strategies such as robust backup and recovery solutions, enhanced cybersecurity measures, and zero-trust principles, organizations can significantly mitigate risks and enhance their ability to respond effectively to potential incidents. As the digital landscape continues to evolve, staying proactive and informed about compliance requirements will be crucial for healthcare providers to thrive in an increasingly interconnected world.