4 ms·
Its simple. You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring. Each record
by jollofricepeas 3y ago
Its simple.
You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring.
Each record gets a UUID. Everywhere else you reference that record by UUID.
- Patient ABC123 called and requested modifications to their record
- Meds delivered to ABC123
- Insurance confirmed for patient ABC123
That’s how you ensure MINIMUM NECESSARY.
And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST:
https://www.hhs.gov/hipaa/for-professionals/security/nist-security-hipaa-crosswalk/index.html https://www.hhs.gov/hipaa/for-professionals/security/nist-se...
- twunde 3y agoFor systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthcare first, the strict privacy wasn't a requirement. Retrofitting your software and workflows can be a hell of a lot of work. Add in that you now need to verify that all the vendors you use are also compliant with the terms of your BAA. For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)
- jollofricepeas 3y agoGood point. HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them. Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.