Circle Social Inc.'s HIPAA Program

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to all Circle Social Inc. employees. We work with clients who work directly with patients and in the healthcare industry. This means it is also our job to help protect patient information and alert them to potential data leaks if we see them. Our HIPAA Compliance Program will feature:- HIPAA Privacy and Security Compliance Lesson;- A HIPAA quiz/assessment or agreement; - Periodic Training Requirement

As a new employee who is part of Circle Social Inc, you must complete this course. *You are required to complete this training even if you think that you will not personally have access to individually identifiable health information.*

The Basics

What is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that is designed to:

Protect the privacy and security of an individual’s health information
Provide for electronic and physical security of an individual’s health information
Require compliance with the “minimum necessary” standard for use and disclosure of an individual’s health information
Provide individuals with specific rights related to access, use and disclosure of their health information.

Covered Entities

HIPAA clearly outlines covered entities, these include:

Healthcare Providers
Health Plans
Business Associates (like us at Circle Social Inc.)
Other Entities

Circle Social Inc. can fall under to umbrellas with HIPAA. These two are "business associates" and "other associated HIPAA entities". We fall here because we do direct business with providers and at times may have access to sensitive patient information. This comes in the form of customer reviews for clients, potential access to client messaging systems, testimonials and more.

The Main Components of HIPAA

HIPAA features many regulations that are broken up across three rules. These rules are the Privacy Rule, the Security Rule and the HITECH act.

The privacy rule:

Protects information about an individual’s health, health care, or payment for that care
Identifies permitted uses and disclosures of protected health information (PHI)
Outlines patients’ rights with respect to their health information
Mandates training for workforce members

The security rule:

Ensures the confidentiality, integrity and availability of all electronic protected health information (ePHI).
Mandates training for workforce members "Awareness of good computing practices"
Protects against:
- reasonably anticipated threats to the security and integrity of ePHI (e.g., hackers, phishing attempts and viruses)
- unauthorized disclosures

The HITECH act:

The Health Information Technology for Economic and Clinical Health (HITECH) Act was created as a subpart of the American Recovery and Reinvestment Act of 2009 (ARRA).

Other Major Concepts Regarding HIPAA

Requires appropriate safeguards to protect the privacy and security of protected or personal health information. Safeguards include:
- Administrative
- Technical
- Physical
Provides patients and plan members specific rights related to access, use and disclosure of their health information.
Requires notification of all individuals involved in a Breach of their identifiable health information.
Requires covered entities to ensure confidentiality, integrity and availability of all health information it creates, receives, maintains or transmits.
Requires covered entities to protect against any reasonably anticipated uses or disclosures of health information that is not permitted or required under the Rules.
Requires protections against any reasonably anticipated threats or hazards to the security or integrity of the health information.
Requires covered entities to conduct risk assessments - assess security risk and implement countermeasures to proportional to the risk.

In-Depth Look at the Rules

RULE1

Privacy

Identifies, or can be used to identify the individual. The most important thing is that we never mix PII and PHI together in the same electronic communication.

Here are some things to remember:

HIPAA is a federal law that affords protection to an individual’s health information
Protecting individuals’ privacy and maintaining a secure environment is everyone’s responsibility
You must safeguard an individual’s Protected Health Information (PHI)
PHI may be shared for treatment, payment and healthcare operations (TPO). Typically, all other disclosures will require patient authorization unless otherwise allowed under the Rule
Access only the minimum of information necessary to perform your job duties or tasks.

rule2

Security Rule Summary: The Things Important for You

Only 10% of security safeguards are “technical." Never open an attachment in an email if you don't know who it's from. Hackers are getting much more sophisticated and now doing things like hacking into a co-workers email and then sending phishing links from there. If you ever get an email from a client or a co-worker, including your boss, that looks odd. Reach out to them by phone or text before opening it. The hacker may still be in their inbox, so don't just send an email confirmation.
The other 90% of security safeguards rely on YOU, the computer user, to adhere to good computer practices.

rule3

The HITECH Act

HITECH imposes additional requirements to existing HIPAA rules to:

Improve enforcement
Increase civil monetary penalties for HIPAA violations
Require OCR conduct Privacy and Security Audits
Provide notification to patients of breach of their personal health information
Provide patients access to their electronic health record
Require Business Associates to be in compliance with the privacy and security rules
Mandates training for workforce members "Breach and notification requirements"

HIPAA – What You Need to Know & More