Is Your Medical Practice Actually HIPAA Compliant? The Gaps We Find in Almost Every Practice That Comes to Us

You're probably not HIPAA compliant.

We work with a lot of medical companies and medical practices. When folks come to us, there are usually quite a few things they're doing that aren't compliant. Most of the time nobody did anything careless. The practice grew, the office got busier, and the compliance work that was set up years ago never kept pace.

Even if you're doing most of what you should, you're probably still not covering some of it. Most of the practices that come to us, there's something that's missing.

You're not alone if that's you. When the HHS Office for Civil Rights audited covered entities on the HIPAA Security Rule in 2016 and 2017, only 14 percent were substantially doing the risk analysis the rule requires. That's the foundation the rest of the Security Rule is built on.

Email is usually the first thing we find

On the easy end of the spectrum, we still come across practices sending patient information by plain email. Lab results, referral notes, a spreadsheet of appointments sent to a billing company.

HIPAA doesn't ban email. HHS says providers can email patients as long as they apply reasonable safeguards, and the Security Rule doesn't prohibit sending electronic patient information over email either. What it does require is that you assess the risk and put protections in place for information you send over the internet. For most practices, that means encrypted email for anything with patient information in it, and a habit of double-checking the address before you hit send.

There's one wrinkle worth knowing. If a patient asks you to send their own records by unencrypted email, HHS says you can, as long as you warn them about the risk first and they still want it that way. That's the patient's choice to make. It shouldn't be your office's default.

This is one of the easiest fixes we make. Turn on encryption, set a rule for when it applies, and train the front desk on it.

The plans you have but haven't practiced

You should have an incident response plan. You should practice tabletop exercises. You should have a DR plan, a business continuity plan, where you have backups and you actually practice restoring them.

The Security Rule spells out the paperwork part. A practice needs security incident procedures for identifying and responding to incidents, and a contingency plan that includes a data backup plan and a disaster recovery plan. Most practices we meet have some version of these on file.

Far fewer have ever used them.

A tabletop exercise is how you find out whether the plan works before you need it. The people who'd be making decisions on a bad day sit down together, someone describes a scenario, and you talk it through. The EHR is down on a Monday morning. A staff member clicked a link and patient records are encrypted. You find out that a laptop with patient data on it was stolen from a car. Who calls whom, what gets said to patients, and how the clinic keeps seeing people while it's sorted out. Maybe it means the clinic goes to paper for a day. Whatever the answer is, you want to find it in a conference room.

Backups are the same story. A test restore means you actually bring the data back and open it, and you write down how long it took, because that's how long the clinic would be down.

HIPAA lists testing and revising your contingency plans as an "addressable" specification. Addressable means you either do it, or you document why it isn't reasonable for your practice and what you do instead. "We never got around to it" isn't one of the accepted answers.

The risk analysis most practices skip

The risk analysis is where the OCR audits found the biggest gap. It's a written, practice-specific look at where patient information lives, what could happen to it, how likely that is, and what you're doing about it. It gets reviewed and updated when something changes: a new EHR, a new location, a breach.

The audit report is blunt about what it found instead. Practices sent in documentation of a security vendor's activities but no risk analysis behind them. Some sent template policy manuals with no sign they'd ever been reviewed or put into practice. A few sent documents that had nothing to do with the question at all.

If your compliance binder came from a template and hasn't been opened since, that's the gap.

How to close the gaps

We know the compliance requirements. We know the policies you should have in place. Our job is to take you through all of the requirements, look at all of your practices, and make sure everything you're doing lines up with what's required. Here's the order we'd go in.

1. Do a real risk analysis. Start here, because everything else depends on it. List every place patient information lives: the EHR, email, the scanner, the billing company, the shared drive, the phones. Then write down the risks to each and what you're doing about them. HHS publishes guidance on what a risk analysis needs to cover.

2. Encrypt email that carries patient information. Turn it on, decide when it's required, and make it easy enough that staff actually use it.

3. Write the incident response plan, then run it. Put names and phone numbers in it, not job titles. Then run a tabletop exercise against it at least once a year, and fix what the exercise turns up.

4. Test-restore your backups. Bring back real data, open it, and time it. Do it on a schedule, and keep a record that you did.

5. Keep the evidence. Compliance you can't show doesn't count in an audit. Keep the risk analysis, the tabletop notes, the restore test results and the training records somewhere you can find them.

Where to start

If you do one thing this month, start the risk analysis. It's the requirement most practices miss, and it tells you where to spend the rest of your effort.

If you want a quick win while that's underway, check how patient information leaves your office by email today. Ask the front desk and the billing staff to show you. That one conversation usually turns up the first fix.

Then put your first tabletop exercise on the calendar. Ninety minutes, the people who'd be making decisions on a bad day, and one scenario run start to finish. Write down every question nobody could answer. That list becomes the next round of work, and the notes become part of the evidence you'll want if anyone ever asks.

---

One question to answer this week: if OCR asked for your current risk analysis tomorrow, could you send it? If you're not sure, book 15 minutes and we'll go through your practice against the requirements, or run our free external scan to see what an attacker can already find about your practice.

Keith Parker is the CEO of Methodology IT, a managed IT services provider in Los Angeles that has supported healthcare practices, nonprofits, and growing businesses across Southern California since 1997.

Sources: HHS OCR, 2016-2017 HIPAA Audits Industry Report · HHS: emailing patients under the Privacy Rule · HHS: sending e-PHI by email under the Security Rule · HHS: guidance on risk analysis · 45 CFR 164.308, administrative safeguards