HIPAA Tip: What Does Security Mean to You?
Is it having locks on all doors, or is it an alarm system and security cameras? When you think of security for your home and your personal possessions, do you assess the organization’s security with the same standards?
Security for a healthcare organization goes beyond physical security, and the best way to look at a business’s security is reviewing the annual Security Risk Analysis (SRA) for areas with medium and high risks and their vulnerabilities.
- Physical security measures include: designated alarm codes or individual key fobs for all staff; disabling the codes/fobs is listed on the Exit Interview/Offboarding Checklist. Physical locks are replaced when needed based on the termination (voluntary/involuntary dismissal). *NOTE: locks, fobs or codes apply for server/network rooms, medical record rooms, basements with medical records or offsite storage facilities.
- Security measures on computers, firewalls, switches, wireless access points include: software updates and encryption enabled, additional security licensing for firewalls along with firmware updates, switches and wireless access points are checked to ensure they are up to date on ages as well as patching, Endpoint Detection and Response (EDR) solutions for all business devices.
- Workstation security includes: long and strong passwords (11-16 complex character password), account lockout after 3-4 failed login attempts, restriction on the reuse of the last several passwords, passwords changing (2-3 times per year depending on the password length), auto-lock of the computer after 10-15 minutes of inactivity.
FACILITY SECURITY PLAN § 164.310(a)(2)(ii)
WORKSTATION SECURITY § 164.310(c)
Compliance Is Ongoing
HIPAA compliance isn’t a one-time checklist. It’s ongoing, programmatic in nature, and requires demonstrated reasonable diligence to stay in good standing with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Anatomy IT can provide you peace of mind with our expert HIPAA compliance services. To learn more, contact us here.
