Contents
What documents need to be HIPAA compliant?
HIPAA documents you should start working on
- HIPAA Risk Management Plan.
- HIPAA Risk Analysis.
- PHI location documentation (e.g., a PHI map)
- Notice of Privacy Practices.
- How you’ve eliminated third party risks.
- Software development lifecycles.
- Business associate agreements (BAA) and/or enforceable consent agreements (ECA)
What is a HIPAA compliant vendor?
“When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA.
Do I need a BAA to be HIPAA compliant?
The HIPAA Privacy Rule requires all Covered Entities to have a signed Business Associate Agreement (BAA) with any Business Associate (BA) they hire that may come in contact with PHI.
Do you need documentation to comply with HIPAA?
A massive chunk of your HIPAA compliance process should be spent recording what you’ve completed. Also known as documentation and largely considered a pain by most people, this process is absolutely necessary for HIPAA compliance.
How to do a HIPAA compliance checklist for your organization?
If you are unsure as to whether your organization is subject to the HIPAA compliance guidelines, here is an initial HIPAA compliance checklist: Determine which of the required annual audits and assessments are applicable to your organization. Conduct the required audits and assessments, analyze the results, and document any deficiencies.
What do you need to know about HIPAA passwords?
The HIPAA password requirements stipulate procedures must be put in place for creating, changing and safeguarding passwords unless an alternative, equally-effective security measure is implemented. We suggest the best way to comply with the HIPAA password requirements is with two factor authentication.
What are the technical safeguards for HIPAA compliance?
The Technical Safeguards concern the technology that is used to protect ePHI and provide access to the data. The only stipulation is that ePHI – whether at rest or in transit – must be encrypted to NIST standards once it travels beyond an organization´s internal firewalled servers.