Health Insurance Portability and Accountability Act, or HIPAA of 1996, is a federal that makes people’s lives easier in such a way that it will protect the confidentiality, keep health insurance, help healthcare industry in controlling administrative costs and secure the healthcare information. Based from the security guidelines made by the HIPAA, it is not only the covered entities but also the business associates who are required of meeting the national standards for Technical, Physical and Administrative security in health information.
To keep the security of protected data, it is an obvious fact that applications will be managed, transmitted and stored with the use of HIPAA compliant hosting. But what are the needed HIPAA hosting requirements to make that possible?
The security rules for HIPAA calls for the given safeguards in order to meet the compliance. It includes the following:
- physical safeguards
- administrative safeguards
- technical safeguards
Normally, the HIPAA hosting meets only the requirements for Physical Safeguard. It means that HIPAA hosting alone will not make the app for HIPAA compliant. All the hosting providers who take care of the protected HIPAA data are required of signing in the “Business Associate Agreement”. This is to ensure that the service providers safeguard, disclose and use personally the identifiable information of patient properly.
More so, the complaint must comply with the HIPAA hosting requirements dictated by security rule of the HIPAA. The requirements include the following:
- Media Re-use: They must follow procedures for the removal of ePHI from the electronic media before it is made available for the re-use.
- Workstation Use: They must follow the procedures and policies which specify the necessary functions. It must perform in such a way that the functions will be really performed. Its physical attributes must also surrounds the class of workstation or specific workstation that will able to access the ePHI.
- PHI disposal: They must follow the implemented procedures and policies which address an ultimate disposal of the ePHI. And also with the electronic media and hardware on which this is stored.
- Workstation Security: They should implement the physical safeguards in all the workstations that can be accessed in ePHI and electronic media or hardware to where it is located or stored.
All the requirements stated above must be implemented for every company that wants to deal in the world of HIPAA. The company must document their given choice whether they want or not to get along with the behind logic of it. However, generally speaking, the HIPAA hosting companies must do the implementation in addition to the required physical specification. It will become the best practices which will contribute ultimately in the security of the sensitive data.
The HIPAA hosting requirements compliance will enable for the protection of data security such as the failure requirements, access to servers, data redundancy and the like are just the portion of the totality of everything. While there is no question to be asked regarding about the use of HIPAA compliant hosting, it is the first step forward in order to ensure that the HIPAA requirements are met.
