HIPAA Compliance Services

HIPAA applies to "covered entities": healthcare providers (doctors, clinics, hospitals, pharmacies, nursing homes), health plans (insurance companies, HMOs, Medicare, Medicaid) and healthcare clearinghouses. It also applies to "business associates", meaning vendors or subcontractors that create, receive, maintain or transmit PHI on behalf of a covered entity.

HIPAA protects all "individually identifiable health information" held or transmitted by covered entities and their business associates. This protected health information (PHI) includes demographic data, medical histories, test results, insurance information, and other information that can identify an individual and relates to their past, present, or future physical or mental health condition, healthcare provision, or payment for healthcare services.

A breach is an impermissible use or disclosure of unsecured PHI that compromises its security or privacy. Examples include lost or stolen devices holding unencrypted PHI, unauthorized access, sharing information without authorization, or improper disposal. Not every impermissible use or disclosure is a breach: a risk assessment can show that there is a low probability the PHI was compromised.

HIPAA requires covered entities and business associates to assess risk regularly but does not set a frequency. Most healthcare organizations run a full risk assessment annually and an additional one after significant changes to systems or environments. Auditing and monitoring should continue between formal assessments.