HIPAA Compliance in 2021 - Everything You Need to Know

Imagine patients running around and collecting their medical records scattered all over town before coming in for their appointment.

Or them calling the doctor’s office to get more information about their own medical data, only to get a reticent gatekeeper. Or patients taking a couple of hours off work to go to the doctor’s office, only to sit in the waiting room for another hour before they even get to see the doctor.

Those were the old days of complicated logistics that made it slow and difficult for patients to get the care they need.

The healthcare industry, however, has been moving online where doctors and patients could communicate directly with each other using email, Zoom, and chat apps. Patients have been able to get care much faster. During the COVID-19 lockdowns, which accelerated underlying digitization trends throughout 2020, virtual telehealth has been a boon, particularly for mental health patients.

Growth in telehealth has resulted in massive time- and cost-savings, but a big question remains:

Are communication tools used for telemedicine HIPAA compliant?

What is HIPAA and why should you care?

HIPAA is the Health Insurance Portability and Accountability Act, a federal law passed in 1996 that protects patient health information from being shared with others or the public without permission from patients.

Such protected healthcare information (PHI) is information that can personally identify a patient.

PHI data must not be breached or made public under any circumstances. Therefore, any technology or infrastructure through which this information travels must comply with HIPAA. This most certainly applies to email, chat messaging, intra-hospital communications, etc.

We found this informative HIPAA Compliance training program for you and your team to get a deeper understanding of HIPAA

Who must comply with HIPAA?

There are two types of organizations that must comply.

Covered entities include…

Hospitals
Doctor offices
Pharmacies
Insurance companies that provide treatment, payment, and healthcare operations.

Business associates of covered entities providing technological services that receive, transmit, or store PHI data also must comply with HIPAA. These include…

Cloud-based SaaS for health professionals
Data analytics companies that process medical data
Doctor-patient chat messaging apps
Medical transcription services

What happens if you don’t comply with HIPAA?

Non-compliance with HIPAA can result in crushing fines that can potentially shutter clinics and bog hospitals down with liability, diverting their attention away from their core function: providing care to patients.

Common violations against HIPAA can result in penalties ranging between one-time $50,000 fines to over $1,700,000 per year, per violation. There can also be disciplinary actions taken against violators, including suspension or loss of medical license. The most serious and egregious violations can also result in criminal charges.

In larger facilities, these penalties can really add up quickly. It’s not hard to find examples of multi-million dollar penalties of non-compliance where Tenet Healthcare’s data breach cost them $32.5 million. Even worse, the Anthem hack cost them over $100 million in financial penalties.

What some benefits of HIPAA compliance?

1. Reduce liability

Doctors can provide care over virtual mediums without fear of breaking their patients’ confidentiality — or getting sued if their patient’s medical information wasn’t kept confidential.

2. Prevent healthcare fraud

HIPAA established a robust program to fight fraud. For example, HIPAA prohibits billing for services that weren’t actually performed, falsifying diagnoses to justify procedures that aren’t medically necessary, or using incorrect procedure codes to obtain payment for services not typically covered by insurance.

3. Build trust and reputation with patients

Complying with HIPAA enables you to take proactive steps to protect medical records and patients’ personal information using the latest data handling practices.

4. Shield from expensive penalties

Paying non-compliance penalties would use up funds that would otherwise go into growing your practice. On the other hand, being in compliance means your practice won’t be subject to punitive action if and when a breach occurs.

5. Enable one-stop shops for medical needs

Both doctors and patients can use an app or portal to directly communicate, dispense care, view and enter medical records, and update prescriptions all within a HIPAA-compliant framework. Compliant platforms make it much easier for healthcare professionals to coordinate care, billing, and data storage without fear of violating HIPAA.

How to achieve HIPAA compliance in 5 steps

1. Conduct a risk assessment

The first thing to do is to conduct a HIPAA risk assessment as part of your HIPAA compliance checklist. Using a checklist is quite useful because your organization may be compliant in some ways, but not in others, and it’s different for every organization. From here, filling in the gaps should be straightforward.

2. Limit access

The second thing to do is to restrict access to sensitive information only to employees or patients on a need-to-know basis. For example, a patient’s medical history does not need to be shared with anyone else unless a specialist needs to see it in order to confirm a specific diagnosis. To do that, a good place to start would be to review patient consent procedures and all the roles at your own organization.

3. Use end-to-end encryption

Next, you’ll need to set up safeguards to ensure that PHI data is always protected with end-to-end encryption. Communication technologies such as email, messaging apps, and portals need to be encrypted following HIPAA’s encryption requirements.

Additionally, SaaS companies use these technological safeguards to ensure their products are HIPAA-compliant:

Access control
Audit controls
Integrity controls
Transmission security

4. Train your employees and build a culture of accountability

Once you have the risk assessment done and the technological framework in place, you’ll need to provide training to users, employees, and doctors on privacy and data security.

In terms of compliance, your technologies are only as effective as how your organization uses them. The HIPAA Journal lists the most up-to-date training requirements along with a downloadable and self-paced learning course.

5. Choose technologies that are already HIPAA compliant

Choosing a compliant app or technology is the easiest and fastest path to HIPAA compliance. However, these decisions must be carefully deliberated — and the products thoroughly vetted — before integrating them into your organization and workflow.

HIPAA changes in 2021: what you need to know

Although it’s been 25 years since HIPAA was first passed into law, there have been many changes to it over the years.

In fact, they loosened compliance requirements during the COVID-19 pandemic throughout 2020. However, this will soon change and the full force of the law will return into effect sometime in 2021, as well as some new rules:

New HIPAA privacy rule: New rules surrounding HIPAA privacy will greatly restrict ways PHI can be used or shared. Your technologies and internal procedures will likely need to be refreshed to stay in compliance.
Right to access initiative: In our healthcare system, it has always been difficult and expensive for patients to get access to their own medical data and records — until this year. The Right to Access Initiative promises to make it easier and cheaper for patients to get copies of their medical records.
National patient identifier: To reduce medical errors or misidentification of patients, a single identification number will be assigned to each patient and will be used by all doctors and hospitals across the entire healthcare system.
End of COVID grace period: Currently no fines are being levied for telehealth during the pandemic, but healthcare organizations and business associates/vendors must put in a good faith effort to comply in case the temporary COVID-19 “grace period” ends in 2021 and HIPAA goes back into full enforcement.
Location flexibility: If there’s one thing 2021 rule changes make things less stringent, it is regarding the location of care rendered to patients. The more doctors and patients go online, the less it makes sense to confine care to specific geographical locations of both doctors and patients.

CometChat: Our HIPAA compliant chat messaging platform

Rather than trying to build your own HIPAA compliant chat messaging system or hiring a team of developers to make it HIPAA compliant, you can just use an existing technology that’s already compliant without having to reinvent the wheel.

CometChat is cloud-based HIPAA compliant chat system with end-to-end encryption. Since it can be run on any platform without extra coding, installation and setup are easy enough that your organization would not miss a beat while providing care to patients.

Want a demo? Get in touch with us today.

About the author

Nabeel Keblawi, a deaf entrepreneur, runs a Content Marketing and SEO agency that helps B2B SaaS companies grow organically in their industries around the world. His previous work experience involved software development, renewable energy, and cloud computing. In his personal life, Nabeel loves to go hiking with his family, and dust off his skis to hit the slopes given the chance. He is also an avid reader of fictional history.

Nabeel Keblawi

CometChat