A Complete Guide on Building HIPAA Compliant Software

Healthcare data breaches have been rising rapidly over the last decade. In the last few years, the world has experienced around 2,550 data breaches, with millions of records being affected. 510 healthcare data breaches were recorded in 2019 out of which 41.11 million records were stolen, disclosed or impermissibly exposed.

But have you ever thought why data breaches occur? Primary reasons for data breaches include improper disposal, data theft, mishandling of data, unauthorized access, data disclosure to third parties and hacking. These data breaches can have numerous dangerous outcomes and can be life-threatening in some scenarios. So, now, the question is how to deal with healthcare data breaches.

The answer is HIPAA. You need HIPAA compliant software that complies with the HIPAA standard. First, you need to know what is HIPAA compliance.

• What is HIPAA?
• What is HIPAA Compliant Software?
• What are the features of HIPAA Compliant Software?
• How to become HIPAA Compliant?
• How to build a HIPAA Compliant Software on AWS Cloud?
• Which healthcare apps need to comply with HIPAA rules?
• Conclusion

What is HIPAA?

HIPAA stands for “Health Insurance Portability and Accountability Act”. It is a federal law that requires the creation of national standards to secure confidential patient health information from getting disclosed without the patient’s consent. The US Department of HHS (Health and Human Services) issued the HIPAA privacy rule to implement the HIPAA requirements to deal with PHI (Protected Health Information).

Companies dealing with PHIs (Protected Health Information) and ePHIs (electronically Protected Health Information) must have their systems compliant with HIPAA. Entities dealing with payments, providing treatment and operations in healthcare; and business associates who have access to patient’s information, payments, treatments, or operations must adhere to HIPAA compliance.

What is HIPAA Compliant Software?

HIPAA Compliant Software is an app or service for healthcare institutes that include essential security and privacy safeguards to meet HIPAA requirements. It can either help with particular elements of HIPAA compliance or offer a complete solution for each component of HIPAA compliance.

The purpose of building HIPAA compliant software is to offer a framework to help compliance officers ensure all provisions of HIPAA security, breach notification rule, privacy and omnibus rules are satisfied.

What are the features of HIPAA Compliant Software?

Here are some of the features that a HIPAA Compliant Software should include:

• Access Control
  Any software or application that stores PHI should restrict who can modify or access the sensitive data.  As per the HIPAA Privacy Rule, nobody should view more patient info than required. The privacy rule also implies de-identification, meaning that patients can view their own data and the ability to restrict or provide access to their PHI.It can be done by assigning each user a unique ID. You can analyze and monitor the activity of people accessing your system. You need to provide each user a list of permissions that allow them to modify or view specific information.For example, a physician can view, create and modify patients’ medical records while the lab technician can only update them.
• Transmission Security
  You need to safeguard the PHI you transfer over the network and between various tiers of your system. Therefore, you should impose HTTPS for all communications. The secure communication protocol encrypts data using TLS/SSL. SSL certificate links the key to your digital identity.When setting up an HTTP connection, the browser requests your certificate. The client checks its credibility and starts the SSL handshake. The outcome is an encrypted communication between your HIPAA compliant app and the user.
  You can also use a secure FTPS or SSH protocol for transferring files containing PHI rather than the regular FTP.
• The entity or person authentication
  After you assign privileges, your system should authenticate that the person trying to access PHI is the one she/he claims to be. The law provides various general ways in which you can implement this protection:

   

  • Password
  • Biometrics
  • Personal Identification Number
  • Physical means of identification

  Password is one of the easiest authentication methods; however, it is also simplest to crack. The report by Verizon says that 63% of breaches happen due to filched or weak passwords.

  Hackers can easily crack a weak password within few seconds and use it as quickly as they can. Therefore, consider using two-factor authentication. Use a secure password with another method of verification. It can be anything, from a biometric scanner to an OTP received through SMS.

• PHI Disposal
  You should be able to permanently destroy PHI when no longer required. The data cannot be considered “disposed of” if its copy stays in one of your backups.Here’s an example that states why PHI disposal is necessary. Affinity Health Plan gave back its photocopiers to the leasing company in 2010. But, it didn’t eliminate their hard drives. As a result, the breach disclosed the personal information of over 344,000 patients. Due to this, Affinity had to pay $1,2 million for this event.PHI can hide in many unexpected places: scanners, biomedical equipment, SD cards, network cards and flash memory in motherboards. In addition to deleting the data, you also need to destroy the media properly that contain PHI before you throw them away.
• Decryption/Encryption
  Encryption is the right way to guarantee PHI integrity. Even if attackers managed to thieve your data, it would look like gibberish without decryption keys. Usually, unencrypted phones, laptops and other portable devices are the most usual causes of HIPAA breaches. To be on the safe side, you can encrypt the hard drives of devices with PHI.
• Data Storage and Backup
  Backups are necessary for data integrity. A server crash or database corruption can harm your PHI. Also, earthquakes or fire in the data center could damage protected health information.Therefore, it is essential to have various copies of the PHI stored in different locations. Your PHI backup plan should identify the probability of data compromise. You need to back up the medium and high-risk information daily that is stored in a secure facility.But make sure that backup is useless if you cannot restore it. Also, test your system continuously to prevent recovery failures. You should also record the system’s downtime and failures to back up the health information.Also, remember that backups need to comply with HIPAA security standards.
• Automatic Logoff
  A system havPHI should automatically end any session after a specific period of inactivity. The user will need to enter their password again or authorize it in any other way. It will secure PHI if someone loses their device when logged into your app.The period of inactivity provoking the logout should rely on the specifics of your system. You can set a 10-15 minutes timer for a secure workstation in a protected environment.
  But ensure that the period should not exceed 10 minutes for web solutions. However, for a mobile app, you can set a timer of 2-3 minutes.Various programming languages implement automatic logoff in different ways.

Now you have got a list of some of the features for HIPAA compliant software. However, they won’t guarantee security and won’t protect you from phishing.

But having the above features convince an auditor that you have done enough to protect the client data. To document

How to become HIPAA Compliant?

Following are some of the steps that can help your healthcare organization become HIPAA compliant:

1. Create security and privacy policies for the organization
   Becoming HIPAA compliant needs more than only following HIPAA privacy and security rules. Covered business associates and entities must also prove that they have been energetic about preventing HIPAA violations by creating security and privacy policies.
   All these policies must be documented, regularly updated and interacted with staff. Staff should be trained on HIPAA policies at least once a year and they must affirm that they know all HIPAA policies and procedures.Health organizations are also needed to create and spread a notice of privacy practices (NPP) for patients to review and sign. The NPP should cover the covered entity’s privacy policies, including how PHI is handled and alert patients of their right to view their medical records’ copies.
2. Name a Security Officer and HIPAA Privacy Officer
   HIPAA legislation is ever-changing and complex. Therefore, every health organization requires its own internal HIPAA experts. The HIPAA Security Rule needs covered entities for designating a privacy compliance officer to supervise the development of privacy policies, make sure those policies are adopted and update them yearly.The Department of Health and Human Services recommends that large organizations also build a privacy oversight committee to guide policy creation and managing oversight.The Privacy Officer and Oversight Committee participants must take regular training to stay ahead of HIPAA regulations changes. The HIPAA privacy officer also maintains NPPs (Notice of Privacy Practices), manages and updates BAAs (Business Associate Agreements), organizes training sessions and self-audits.

    

   Covered entities should also have a HIPAA Security Officer to ensure there are procedures and policies to detect, prevent and reply to ePHI data breaches.  The Security Officer creates safeguards needed by the security rule and performs risk assessments to measure their effectiveness.

3. Conduct Risk Assessments and Self-Audits regularly
   Becoming HIPAA Compliant is not a one-time process. The US Department of Health and Human Services (HHS) requires covered entities and business associates to perform audits of administrative, physical and technical safeguards regularly to analyze compliance gaps. Organizations must then make written remediation plans that explain how they want to reverse HIPAA violations and when this should happen.
4. Implement Security Safeguards
   The Security Rule requires three kinds of safeguards that covered business associates and entities must have to secure ePHI, including:

    

   • Technical Safeguards
     Organizations must have access control to keep ePHI secured in the EHR and other databases to ensure that employees only view data they are authorized to see. Data needs to be encrypted during transit and when it is at rest that results in the need for secure email, HIPAA Compliant Messaging and HIPAA Compliant Texting. It is also a must for organizations to have audit controls for all software and hardware that transmit or manage ePHI to ensure that they fulfill HIPAA network requirements. There must be integrity controls to make sure ePHI is not deleted or edited improperly.
   • Physical Safeguards
     Organizations must control who can access physical facilities where ePHI is saved. They must also keep all devices and workstations secured that transmit or store ePHI.
   • Administrative Safeguards
     Organizations must designate security personnel, implement an information access management system, document security management processes, assess all security protocols timely and offer workforce security training.
5.  Establish a Breach Notification Protocol
   HIPAA violations don’t need to get organizations into trouble, especially when they can confirm that the breach was unintentional and they had done everything to prevent breaches. But situations become worse when organizations fail to report breaches.The HIPAA Breach Notification Rule needs that business associates and entities must report breaches to OCR and notify patients whose personal data might have been compromised. Organizations building HIPAA compliant software need to have a documented breach notification process that states how they will comply with this rule.
6. Document Everything
   Organizations must document all HIPAA compliance activities, including security and privacy policies, self-audits, risk assessments, staff training sessions and remediation plans. OCR (Office for Civil Rights) will review the documentation during complaint investigations and audits.

How to build a HIPAA Compliant Software on AWS Cloud?

Businesses nowadays are using cloud providers like AWS (Amazon Web Services) to increase their processes’ operational efficiency and manage their IT infrastructure. Healthcare providers have also started using AWS cloud to feed, process and share PHI under HIPAA regulations.

AWS provides a complete AWS HIPAA Services list to build secure, scalable and fault-tolerant HIPAA solutions for multiple healthcare use cases. Before you think about building HIPAA compliant software, you need to understand that HIPAA compliance can go wrong if not implemented correctly.

Significant Components of any 3-tier architecture of any software include:

• Client Interface
• Server Interface
• Mobile or Web App
• APIs
• Database

While you develop HIPAA compliant software, it is essential to ensure that all three tiers are secured under HIPAA guidelines.

What to consider when implementing HIPAA Compliant Software on AWS?

1. Access Control
   According to HIPAA guidelines, the healthcare application should make sure that only authenticated users can access resources granted to them. AWS uses IAM – Identity and Access Management to give specific access to particular uses in quick steps.
   IAM allows you to have access to AWS services and resources securely. Using IAM, you can form and manage AWS groups and users and use permissions to deny or grant their access to AWS resources.
2. Data Backup and Storage
   AWS Backup is a managed solution that backs up application data automatically for AWS services. It is an easier and quicker backup option for AWS customers. Earlier, in the traditional healthcare software applications, backup and recovery was a night. But, AWS made it easy and now backup can be set up regularly or on request.Backup solution by AWS also monitors the status of searches, current backups, restored backups to ensure compliance with regulatory and corporate requirements. AWS services, including Elasticache, S3 and RDS, have native backup functionality.
3. Audit Control
   Monitoring and Auditing are significant features of HIPAA compliance. Amazon has an AWS config for the same functionality. It is a completely managed service that offers you AWS resource inventory, configuration change notifications and configuration history to allow governance and security.AWS Config enables discovering deleted and existing resources, compliance against the rules.  It simplifies auditing, change management, operational troubleshooting and security analysis.
4. Disposal as a requirement
   Every account owner on AWS can install and configure holding for all services they use. The account owner can delete data from the service upon request and prevent useless data from getting stored. The app should offer a way to erase the data. Any company that gathers health information must make sure it’s properly deleted.As per HIPAA guidelines, media must be cleared, destroyed or purged with NIST Special Publication 800-88 (Guidelines for Media Sanitization) in a way that PHI cannot be retrieved.
5. Encryption and Decryption
   AWS provides a robust security feature for encrypting the data saved in different services. Amazon S3 is used for object storage and contains great data encryption options. Every S3 object is encrypted with a unique key that is encrypted and stored regularly.S3 utilizes the secure block cipher, i.e., 256-bit Advanced Encryption Standard (AES-256). Amazon uses KMS (Key Management Service), a HIPAA compliant solution for handling encryption keys with other AWS services. KMS uses a concept of master keys that can be leveraged to encrypt/decrypt keys used encrypting/decrypting the PHI data within the app.AWS provides an easy way to encrypt an RDS database. SSL layer can be used to encrypt the network traffic for security in transit. AWS also provides a service called certificate manager to handle SSL certificates at no cost.

Here’s how to build HIPAA Compliant Applications using AWS:

1. Before building your infrastructure and storing PHI data on AWS, you need to sign the business associate agreement (BAA) with AWS. The contract will be used to clarify and restrict the disclosure and permissible uses of protected health information.
2. After you sign the BAA with AWS, the next step is to mark your AWS account as a HIPAA account, which implies that PHI data is processed and saved on that account. All the conditions you need to meet to become a HIPAA compliant are mentioned in the BAA contract. You will always be notified by AWS in case of a security breach that exposes PHI after signing BAA.
3. In case, you have to sell your healthcare application as a SaaS solution, you don’t need to sign the BAA contract with AWS. BAA is transferrable. It means that your clients can sign the BAA with you when they have a covered entity’s role.
4. After the BAA is signed, you need to create infrastructure and move PHI to AWS. When creating the infrastructure, you should take note of the following requirements:
   • Information that is being moved must be encrypted.
   • Only authorized personnel can access the information.
   • PHI is backed up and is recoverable.
   • Information can be disposed of permanently when no longer required.
   • Information is not altered or tampered with.
5. Set up HIPAA administrative policies for your organization and set up HIPAA technical controls for individual AWS infrastructure.
6. Monitor your cloud environment for compliance and security issues on a regular basis.

Which healthcare apps need to comply with HIPAA rules?

When an app is evaluated against the need to comply with HIPAA, three criteria are considered to identify which of them are HIPAA compliant applications.

Entity

When any covered entity like healthcare insurance provider, hospital or physician uses an application, they would consider complying with HIPAA compliant software development requirements.

For example, if you want to develop an application for patient-doctor interaction, it would require complying with HIPAA because both doctors and hospitals are covered entities. But, if an application is only built to help a person follow a medication routine, it won’t have to follow the HIPAA privacy rules as there are no covered entities involved.

When it comes to entities, it is essential to look into the privacy rule. The rule addresses the protected health data and defines who is responsible for ensuring that the personal information is not disclosed.

As per privacy rule, there are two types of organizations subjected to HIPAA law compliance:

• Covered Entities
  They are healthcare organizations, clearinghouses, providers and so on who perform financial and administrative transactions electronically. Such transactions include electronic billing, fund transfer, etc.
• Business Associate
  They are entities that collect, process, store and share PHIs on behalf of covered entities.

Data

HIPAA compliance is mainly focused on protected health information – any health information that can be used to identify an individual along with data that has been disclosed, created or utilized in the time when healthcare managed services like treatment or diagnosis was offered.

PHI consists of two sections: medical data and personally identifiable information. When personally identifiable information is linked with medical data, the information is known as PHI.

For example, an application that helps doctors diagnose skin related diseases by studying anonymous photos does not interact with any PHI. But when you mention the patient’s address or name, it would become a PHI.

When the information saved or shared is identifiable individually, it must comply with HIPAA regulations. The same rule is applicable when the sensitive information is saved on a third-party server.

Security of Software

The last parameter that helps identify whether a healthcare software development should fall in the HIPAA rules or not. It involves multiple standards applied for protection and control access of electronically protected health information (ePHI).

Conclusion

Driven by the impact of coronavirus pandemic on the healthcare industry, digital healthcare transformation has become a new norm. Therefore, now there is a sharp shift to a focus on healthcare compliance adherence.

If you are also planning to build HIPAA compliant software, our healthcare software development experts can assist you. We know how to make a healthcare software application HIPAA compliant and we implement strategies in place to carefully meet HIPAA requirements.