What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law that safeguards the security and privacy of sensitive health information. HIPAA applies to:

All individuals, as everyone can or may possess PHI
Health plans (a "covered entity")
Healthcare clearing houses (a "covered entity")
Qualifying healthcare providers (a "covered entity")
Business associates providing a service to or on behalf of a covered entity

Created by the Federal Department of Health and Human Standards (HHS) in 1996, HIPAA contains the following privacy protection standards, broken down into five general rules:

1. HIPAA Security Rule

The HIPAA Security Rule addresses the administrative, physical, and technical safeguards that covered entities must put in place to secure electronic protected health information (ePHI). These protections help ensure the confidentiality, integrity, and security of electronically stored, transmitted, or received PHI.

The Security Rule essentially helps covered entities implement and enforce the privacy protections enumerated in the HIPAA Privacy Rule, as pertaining to ePHI. Due largely to the HITECH Act, much, if not most, of all patient health information is now in digital form and is therefore subject to the HIPAA Security Rule.

2. HIPAA Privacy Rule

The HIPAA Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information, specifically protected health information (PHI), electronic protected health information (ePHI), and personally identifiable information (PII) when it is considered PHI.

The HIPAA Privacy Rule gives patients the right to:

Request corrections to their data
Access their medical records
Limit how their healthcare data can be shared by covered entities without their authorization
Ensure that only authorized parties can access PHI
Secure the appropriate use and disclosure of their health information

3. HIPAA Breach Notification Rule

HIPAA’s Breach Notification Rule requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured PHI. Specifically, covered entities must notify:

Affected individuals
The Secretary of Health and Human Services
In certain circumstances, the media

Business associates must notify covered entities if the breach occurred within their jurisdiction. Notification must be provided to affected individuals no more than 60 days after the breach and must include:

A brief description of the breach
What type of information was involved
How individuals should protect themselves from potential harm resulting from the breach
How the covered entity is handling the breach and preventing future breaches
Contact information for the covered entity

4. HIPAA Enforcement Rule

The HIPAA Enforcement Rule outlines provisions pursuant to:

HIPAA compliance
HIPAA investigations
Procedures for hearings
Civil monetary penalties (CMPs) for HIPAA violations

5. HIPAA Omnibus Rule

HIPAA’s Omnibus Rule is a set of legal requirements aimed at increasing the level of security and privacy of health information shared between healthcare providers. The Omnibus Rule was enacted in 2013 to strengthen the protections established under the HITECH Act. It also was the Rule that expanded the definition of “business associate” to include “all entities that create, receive, maintain, or transmit PHI on behalf of a covered entity, making clear that companies that store PHI on behalf of health care providers and health plans are business associates.”

Medical professional holding a tablet and smiling at the camera

What Is HITECH?

Hand-in-hand with HIPAA is the HITECH Act (Health Information Technology for Economic and Clinical Health Act), which passed in 2009 and urges health providers to:

Adopt electronic health records (EHR) to improve quality of patient care
Adhere to expanded data breach notification requirements
Secure ePHI data using appropriate privacy protections

Both HIPAA and HITECH address ePHI security, but measures within HITECH support the enforcement of HIPAA through the Breach Notification Rule and the HIPAA Enforcement Rule.

The Importance of Protected Health Information (PHI)

Protected health information (PHI) is data about patients':

Health

Treatment

Payment for treatment

As technology continues to expand, the definition of PHI will as well. Compliance with HIPAA laws will depend largely on covered entities’ ability to stay ahead of these changes and correctly identify and secure PHI in all its various forms.

Why Healthcare Leaders Count on Fortra for HIPAA and HITECH Compliance

Fortra’s automated, simplified security solutions can help healthcare entities more easily satisfy auditor demands and protect healthcare data as they strive to meet the rigorous requirements of HIPAA’s Security Rule. Covered healthcare entities and business associates meet their HIPAA Security Rule obligations through Fortra’s proven cybersecurity and compliance solutions. For example, our automated data security solutions directly address HIPAA security requirements while reducing the risk of human error and lowering the compliance burden on IT staff.

Fortra Solutions for HIPAA Compliance

Our healthcare security solutions enable you to not only break the healthcare attack chain but do so in a way that meets critical HIPAA compliance requirements and keeps your organization’s name out of breach headlines. Fortra surrounds sensitive healthcare data at all points in time, wherever it resides.

Fortra’s arsenal of compliance-ready solutions increase efficiency and productivity, seamlessly integrate automation into your critical business processes, and achieve HIPAA compliance with minimal impact on your internal resources and workflow.

Fortra’s HIPAA compliance solutions include:

Cloud Access Security Broker (CASB)

Fortra CASB keeps sensitive data contained, so it isn’t accidentally exposed to unauthorized internal or external recipients. Healthcare employees using cloud applications are prevented from uploading sensitive files to inappropriate places such as messaging apps, accessing apps from risky locations, or using unauthorized apps altogether. It also discovers misconfigurations in cloud storage that could make ePHI accessible to the wrong parties.

Cloud Email Protection & Suspicious Email Analysis

Fortra’s integrated cloud-based email security platform helps healthcare entities protect themselves from email cyberattack vectors like spoofing and spear phishing. Its advanced data science leverages machine learning, LLMs, and neural networks to detect impersonation. Using Fortra Suspicious Email Analysis, your organization can separate legitimate threats from inconsequential noise to mitigate threats to HIPAA compliance.

Data Loss Protection (DLP)

Detect, inspect, and secure your critical healthcare data across email, web, and the cloud with Fortra’s DLP solutions. Endpoint protection ensures that data flagged for HIPAA protection is secured throughout its entire lifecycle. Adaptive redaction allows for content that would constitute a HIPAA breach to be dynamically modified (redacted or sanitized), allowing the rest of the communication to be delivered unhindered.

Data Classification

Fortra data classification solutions support HIPAA compliance with automated discovery and classification, allowing users to identify valuable data with labels or tags. Its ability to automatically classify high volumes of historical HIPAA data is of huge benefit when it comes to understanding where that data is stored, ensuring it’s classified appropriately, and keeping the end user overhead down. An organization’s investment in, and application of, such a classification system may in itself constitute a “reasonable measures” defense, should there be a HIPAA breach charge and subsequent OCR audit.

Data Security Posture Management (DSPM)

DSPM helps compliance teams discover, classify, and protect sensitive patient data. Fortra DSPM gives teams the complete, real-time data visibility needed to maintain control over the exposure of ePHI while in motion or at rest. It further protects ePHI by restricting risky data behavior such as saving critical documents to USB drives, uploading important files to file hosting services, or copy/pasting sensitive information like source code into AI tools.

DMARC Protection

Domain-based message authentication, reporting, and conformance (DMARC) protection is an email authentication protocol that prevents email spoofing by allowing domain owners to dictate what happens to inbound messages that fail predetermined authenticity checks. Fortra DMARC Email Authentication stops attackers from being able to send fraudulent emails from your domain.

Human Risk Management

Fortra Human Risk Management provides award-winning security training to empower employees to improve their cybersecurity literacy and spot the signs of cyberattacks. It delivers engaging training with a practical, people-centric approach. Based on real-world threats, each learning module and phishing simulation template is designed to reduce risk and help create a strong human line of defense against breaches of ePHI.

IBM i Security and Compliance Solutions

If your healthcare organization has IBM i systems in your environment, Fortra Powertech solutions can help you meet the technical safeguard requirements of HIPAA’s Security Rule by acting as an automatic security control to harden your system security and provide visibility to your database access.

Integrity and Compliance Monitoring

Fortra’s file integrity monitoring (FIM) and security configuration management (SCM) solution Tripwire® Enterprise and its managed service counterpart Tripwire ExpertOps enhance data security for ePHI by enforcing built-in HIPAA policies and alerting security teams on unauthorized changes and compliance drift.

Managed Security Services

Our security experts help you assess, detect, and block threats that could result in the loss of ePHI and subsequent HIPAA violations. Our managed service offerings include offensive security to aid organizations without the necessary internal resources to conduct penetration testing. Fortra Extended Detection & Response (XDR) offers a holistic view of an organization’s cybersecurity posture, which tackles HIPAA compliance proactively by detecting threats across multiple-layered environments.

Network Monitoring

HIPAA requires network monitoring, including network user access limitations for sensitive ePHI. Intermapper gives healthcare organizations a complete view of their network infrastructure. It helps healthcare entities manage growing and changing networks without putting HIPAA compliance in jeopardy. Every asset with an IP address is mapped to give IT teams visibility into what’s happening now across their entire networks.

Penetration Testing

Offensive security solutions are ideal for conducting risk analysis, a critical piece of HIPAA compliance. Recent changes to the HIPAA Security Rule include a proposed requirement for annual pen testing, pushing healthcare entities toward a more proactive cybersecurity approach. Core Impact uses a sophisticated exploit library to simulate real-world attacks. Its automated testing capability allows teams to automate repetitive pen tests, freeing them up to manually test deeper risks.

Red Teaming

Red teaming helps organizations identify threat vectors that could lead to breaches of ePHI. Cobalt Strike empowers security teams with adversary simulations and red team operations to emulate real-world threats and discover security weaknesses before cybercriminals do. Use Cobalt Strike to execute PowerShell scripts, mimic man-in-the-middle attacks, an synthesize actionable reporting data. Outflank Security Tooling provides healthcare entities with tools maintained by Fortra’s red team, covering every step in the attack chain.

Secure Collaboration

Fortra Secure Collaboration allows healthcare entities to share their files securely by ensuring that the security policy sticks to the data, wherever it goes. When patient data must be shared externally, a covered entity can share it with the confidence that it can only be accessed by the authorized users they choose, even after it’s opened.

Secure Email Gateway (SEG)

Fortra Secure Email Gateway reduces the risk of ransomware and sophisticated email threats while ensuring encrypted sharing of sensitive data. Protect your organization from spam, viruses, phishing, and other email threats using a Deep Content Inspection Engine alongside Active Code detection and removal, blocking messages containing malicious URLs and attachments.

Secure Web Gateway (SWG)

Fortra SWG helps enforce HIPAA security policies and block non-compliant activity. It protects against internet threats and data leakage by protecting web users from threats like zero-day and browser-based attacks. Its single proxy architecture inspects all inbound and outbound web traffic, filters bad sites, and protects sensitive data like ePHI.

Secure Managed File Transfer (MFT)

Invest in a multi-layered HIPAA-compliant defense structure that includes award-winning managed file transfer. Fortra MFT solutions help secure and automate the exchange of ePHI, protecting healthcare information, encrypting data at rest and in motion, and providing comprehensive audit and reporting logs required for HIPAA compliance. Fortra MFT integrates with other Fortra solutions to mitigate malware risks and enforce data protection.

Vulnerability Management

Fortra VM assesses risk by uncovering, identifying, and prioritizing vulnerabilities that could be exploited by attackers. Its robust reporting capabilities provide auditors with thorough documentation of all activities and prove that a HIPAA-required risk analysis has been effectively completed. Fortra VM’s Network Map gives healthcare entities visibility into their networks’ security posture, fulfilling the new network mapping requirements of the HIPAA Security Rule.

Zero Trust Network Access (ZTNA)

As a security model, Zero Trust helps organizations align with HIPAA by granting minimum access to ePHI. Fortra ZTNA enforces this principle of least privilege access by restricting users to only the applications and data they need to perform their jobs. Healthcare organizations can bolster HIPAA compliance by replacing their legacy VPNs with Fortra ZTNA to uncover shadow IT and protect ePHI in increasingly permeable IT perimeters.

Request a Demo

“The support team is a huge strength. The ease of use is good, and I always enjoy the interactions. There are there to help us when we need it.”
– Integration Manager at Southeastern Health

Featured Resource

4 Steps to Implementing

Data Protection in Healthcare

Read the Guide

Selected Case Studies

How A Renowned Healthcare Institution Protects Patient Data in the Cloud

Southeastern Health Relies on GoAnywhere MFT to Support Its Mission of Quality Healthcare

Austin Travis County Integral Care Reduces Risk of Data Breach and Realizes Cost Savings

Steps to Ensure HIPAA Compliance

As many organizations find that they are either covered entities or business associates subject to HIPAA law, the question of how to become HIPAA compliant is top of mind. “Unexpected covered entities” can include organizations in fields from marketing to finance, and all are expected to comply (see FAQs for more).

Responsibilities of Covered Entities

Under HIPAA, covered entities have the responsibility to:

Provide individuals with the rights outlined above
Comply with HIPAA policies that protect the privacy and security of patient health data

Responsibilities Include:

Privacy responsibilities

Obtaining written consent from patients for the use of their PHI beyond treatment, research, legal, and payment purposes
Responding to patient medical record access requests within 30 days
Providing patients with a Notice of Privacy Practices (NPP)

Security responsibilities

Developing and implementing security policies
Securing against threats to ePHI
Preventing unauthorized uses or disclosures of ePHI
Ensuring employee compliance with the above security policies and procedures

And more, including:

Having an incident response plan in place
Documenting HIPAA policies, practices, and configuration settings
Implementing a risk management program
Authenticating entities with whom the covered entity or business associate communicates
Encrypting information travelling over open networks

HIPAA Compliance Steps

Perform a Risk Assessment

Covered entities have been fined for failing to implement regular risk assessments as part of their ongoing HIPAA-compliant strategies. Identify and prioritize potential security threats to PHI and ePHI, and factor in elements like human error, natural disasters, and technical shortcomings.

Establish HIPAA Compliance Controls

Implement PHI safeguards in the following three areas:

Administrative: Train employees to properly access and handle PHI. Includes role-based access, the principle of least privilege, PHI and ePHI storage and transmission best practices, security awareness training, integrity and audit controls, and more.
Physical: Physically protect areas containing PHI and ePHI, such as server rooms, file cabinets, and workstations. Implement mandatory log-out or lock screen policies when employees are away from their desks, require ID badges to access sensitive health information, and lock paper files containing patient health data.
Technical: These safeguards center around ensuring the security of electronic PHI (ePHI) by employing cybersecurity-oriented HIPAA compliance solutions like secure file transfer (SFT), data encryption, data loss protection (DLP), data classification, and more.

Assign a HIPAA Compliance Officer

Establish a HIPAA point person and a chain of command leading up to them. This team will be responsible for heading and keeping track of HIPAA-related efforts, involving all stakeholders, overseeing the creation of HIPAA privacy and security practices, implementing employee HIPAA compliance training, and creating a breach plan that includes HIPAA-mandated notification, reporting, and mitigation.

Create a Breach Notification Process

Put a plan in place to facilitate mandatory breach reporting within 60 days of a discovered breach. This must include notifying the Office for Civil Rights (OCR) and all affected parties. Include the media when the breach affects more than 500 individuals in a particular jurisdiction, and all notifications must be accomplished “without unreasonable delay.”

Document all HIPAA-Related Policies and Procedures

HIPAA standards require accurate documentation of all HIPAA-related policies and procedures. In the event of an OCR audit, these records will prove an organization’s HIPAA compliance — or failure to comply. Documentation includes:

HIPAA privacy policies

HIPAA security controls

HIPAA remediation plans

Internal audit reports

Certificates of employee training

Risk assessments

Consequences and Penalties of HIPAA Noncompliance

HIPAA violations occur when the HIPAA Administrative Simplification Regulations have been breached. The HIPAA Administrative Simplification Regulations are “what most people consider to be HIPAA because they contain the General Provisions and the Enforcement Rule (Part 160), the Standards for Electronic Transactions and Data Elements (Part 162), and the Privacy, Security, and Breach Notification Rules (Part 164)." However, they were not published with HIPAA in 1996, but rather several years later. For all intents and purposes, the Administrative Simplification Regulations are the regulatory portion of the HIPAA Act, comprising all the standards and legal requirements outlined in the HIPAA Rules.

Very specific guidelines around how health data is stored and shared by hospitals, clinics, insurers, research facilities, pharmacies, and public health organizations are necessary to ensure patient privacy. Breaching the trust of individuals who’ve entrusted their data comes with consequences.

HIPAA Compliance FAQs

Who is subject to HIPAA?

HIPAA only applies to the following entities that conduct electronic transactions for which the Department of Health and Human Services (HHS) has published standards:

health plans,
healthcare clearing houses,
healthcare providers,

that conduct electronic transactions for which the Department of Health and Human Services (HHS) has published standards. This means that not all healthcare providers are subject to HIPAA, although all are still subject to state regulations. Those not subject to HIPAA would be entities not conducting electronic transactions of PHI or ePHI.

However, those that conduct electronic transactions are the vast majority, and are referred to in HIPAA as covered entities and business associates.

What is a "covered entity" under HIPAA?

A covered entity is any health care provider, health plan, or health care clearinghouse who, as part of their day-to-day business, creates, maintains, or transmits PHI. There are a few exceptions, including:

Most health care providers employed by a hospital, as the hospital itself is the covered entity and therefore the party responsible for implementing and enforcing HIPAA compliant policies
Employers, even though they may maintain some healthcare data on employees. They are exempt unless they provide self-insured health coverage or benefits such as an employee assistance program (EAP). This would be considered a “hybrid” entity situation and still may be subject to HIPAA breach consequences for any unauthorized disclosure of PHI.

What is a "business associate" under HIPAA?

A business associate is defined as any person or business that provides a service to, or performs a function or activity for, a covered entity when that action involves accessing PHI maintained by the covered entity. Accountants, IT contractors, lawyers, billing companies, cloud storage services, and email encryption services are all examples of business associates.

To be in HIPAA compliance, business associates must sign a business associate agreement with the covered entity before gaining access to PHI which details what PHI they can access, how they plan to use it, and that the PHI will be returned or destroyed once the need for it or task is completed. The business associate is under the same HIPAA compliance obligations as the covered entity while they are in possession of the PHI.

What is an "unexpected covered entity" under HIPAA?

An unexpected covered entity under HIPAA includes organizations and individuals that might not typically be considered covered entities, but deal with PHI in a way that makes them subject to HIPAA regulations nonetheless.

These unexpected covered entities include:

Technology companies developing health apps, and their associated developers, data analysts, and even vendors
A non-health-related organization (like the owners of a fitness tracking app) that handles PHI in any capacity (i.e., tracking heartrate during sleep and exercise)
Marketing firms with access to PHI to be used in a targeted advertising campaign
Cloud storage providers storing ePHI on their cloud platform
Financial institutions, like banks, that perform services such as data analysis, invoicing, or healthcare lending to healthcare clients are considered unexpected covered entities or business associates under HIPAA law

Are local, state, or national governments subject to the HIPAA Privacy Rule?

If they perform functions that require the handling of electronic PHI, then those state, county, or local governments are subject to the HIPAA Privacy Rule. Examples include:

County health departments that operate health clinics must maintain HIPAA compliance
A state Medicaid program acts as a health plan and, therefore, qualifies under HIPAA
A local city that offers ambulance services, a hospital, or contracts with outside entities that offer such services is subject to HIPAA regulations

HIPAA Security Rule Checklists

The HIPAA Security Rule is a set of national standards requiring appropriate:

Administrative safeguards
Physical safeguards
Technical safeguards

These safeguards ensure the confidentiality, integrity, and availability of electronic PHI that is created, maintained, received, or used by a covered entity. The Security Rule is a subset of the Privacy Rule, applying only to electronic health information, and explains how to protect digital patient data as covered under the Privacy Rule. Its intent is to provide the necessary technical, physical, and administrative specifications to comply with HIPAA privacy law protecting digital health data.

Fortra helps covered entities and business associates comply with the Security Rule by providing the technical security solutions necessary to protect electronically stored, transmitted, and generated health information under HIPAA law. These include solutions for:

There are three categories of safeguards to help ensure the HIPAA Security Rule is adhered to by covered entities and business associates — administrative, physical, and technical.

Administrative Safeguards to Meet HIPAA Security Rule Requirements

Per the HIPAA Security Rule, covered entities must enforce:

Identify and analyze risks

Identify and analyze possible risks to e-PHI and place appropriate and reasonable security measures to reduce them.

Designate a Privacy Official

Designate a someone to be responsible for developing and implementing security policies and procedures.

Manage information access

Manage information access per HIPAA Privacy and Security Rules. The Privacy Rule limits the use and disclosure of ePHI to the "minimum necessary." The Security Rule requires role-based access policies and procedures to authorize access to ePHI.

Train your workforce

Train your workforce on ePHI policies and procedures and apply appropriate management policies to ensure those policies and procedures are followed. All workforce members must be trained regarding a covered entity’s security policies and procedures with appropriate sanctions for violations of them.

Evaluate policies and procedures

Periodically, current policies and procedures should be evaluated to see how well they meet the established HIPAA requirements.

Physical Safeguards for HIPAA Security Rule Compliance

Per the HIPAA Security Rule, covered entities must implement:

Limit physical access

Limit physical access to and control of facilities while still allowing authorized access.

Secure workstations and devices

Policies and procedures should specify proper, secure use of and access to workstations and electronic media. To protect ePHI, they should also include provisions for the safe transfer, removal, disposal, and re-use of electronic media.

Technical Safeguards for HIPAA Security Rule Compliance

Per the HIPAA Security Rule, covered entities must:

Control access to ePHI

Control access by implementing policies and procedures that allow only authorized persons to access ePHI.

Audit controls around ePHI

Audit controls by putting hardware, software, and/or procedural mechanisms in place to record and examine all access and activity surrounding ePHI.

Ensure the integrity of ePHI

Implement policies and procedures to ensure that personal health information is not improperly altered or destroyed. Electronic measures must be put in place to confirm the integrity of ePHI.

Secure the transmission of ePHI

Implement technical security measures to guard against unauthorized access when ePHI data is being transmitted over an electronic network.

Additional Resources

Guide

Learn More About How Fortra Can Help with HIPAA Security Rule Compliance

Fortra is the single provider you need to feel confident in your ability to implement the technical safeguards central to HIPAA Security Rule compliance.