What do I mean by standards?

I was trying to find a word that encompassed standards, requirements, compliances, guidelines, policies, and I'll stop there. But, as you can imagine, those words have different definitions, so it was a ridiculous task. I begrudgingly accepted standards.

What you will find here is some help understanding some of the standards, requirements, compliances, guidelines, policies, and so on, that guide our security compass. When we build a house we follow a blueprint, if someone takes their project outside the "guidelines" of the blueprint they're not fulfilling the "requirements," and they're not following the "policies," so the house can't be completed until that project is brought back into "compliance."

Well I tried to get them all in there.

Standards

Categories

Hospitals

HIPAA Compliance

?What is HIPAA Compliance?

HIPAA, the Health Insurance Portability and Accountability Act, sets the standard for protecting sensitive patient data. Any company that deals with protected health information (PHI) must ensure that all the required physical, network, and process security measures are in place and followed.

Five steps to HIPAA security compliance

The health insurance portability and accountability act has set various guidelines, which should be adhered to by anyone who handles any electronic medical data. These guidelines stipulate that all medical practices must ensure that all necessary measures are in place while saving, accessing and sharing any electronic medical data to keep patient data secure . Lack of compliance to the HIPAA security standards could lead to large fines and in extreme cases even loss of medical licenses. Several steps can be followed by medical practices to ensure compliance to HIPAA standards. These steps include:

  • Run a complete risk assessment of the medical practice

    Some medical practices adopted electronic health recording systems before there were clear guidelines on what these systems should contain. This means that a medical practice could be using electronic systems which are not compliant with HIPAA standards. To ensure HIPAA compliance a risk assessment should be done on the current systems using HIPAA standards and guidelines to highlight areas in which compliance is not enforced. A risk assessment against HIPAA guidelines exposes areas in which changes are needed.
  • Prepare for disaster before it occurs

    All the data handled by a medical practice should be safe both from loss and corruption. One of the main ways of ensuring that data is not lost in case of any mishaps is backing up of medical data regularly. Data should be backed up in an offsite location such that in case of incidents such as fires in the medical premises the data backup is not destroyed, as well. Antivirus programs should also be installed in all computers to ensure that data is not corrupted or destroyed by computer viruses.
  • Have an ongoing employee training program

    Any system is only as strong as its weakest link and in most cases untrained employees are the weakest links in medical practices. A medical practice could have a very secure encryption system, but if the employees don’t use their passwords to securely access records and files the encryption system is rendered useless, and anyone can gain access to these records. Medical practices should continually train their staff on how to follow the right security protocols to ensure data integrity and security.
  • Buy medical products with security compliance and compatibility in mind

    New equipment bought for a medical institution should be compatible with existing systems and should offer enough security features. Some medical equipment may offer enough security features but may be incompatible with existing systems or vice-versa. Thus before making any major purchases enough review of the product should be done to ensure both security and compatibility.
  • Collaborate with affected parties

    Changes which need to be made to bring about HIPAA compliance affect many people in the medical practice. Affected departments should be consulted when making changes to ensure all parties affected by the changes are happy with the changes.