HIPAA Compliance for Community Health Centers

There is an argument there should be a different level of HIPAA compliance for community health centers, due to community health centers having fewer resources available to them than other Covered Entities. Unfortunately, due to the complexity of the Healthcare Insurance Portability and Accountability Act (HIPAA), introducing different levels of HIPAA compliance for community health centers would be logistically complex and lead to demands for other “special interest groups” to be taken into account.

A list of “special interest groups” could be extensive. Should charity-funded hospices, for example, have the same level of HIPAA compliance as privately-owned, for-profit medical centers? It may not seem fair, but the answer is “Yes”. This is because a breach of Protected Health Information (PHI) from any source is still a breach of PHI, and the potential consequences of a breach (identity theft, insurance fraud, etc.) will be no different, regardless of how, where or when the breach occurred.

The Purpose of HIPAA Compliance for Community Health Centers

The purpose of HIPAA compliance for community health centers is to safeguard the privacy of patients and protect against the misuse of their PHI. In order to achieve this, the Department of Health & Human Services has published Privacy and Security Rules and a Breach Notification Rule which Covered Entities (healthcare providers, healthcare plans and healthcare clearinghouses) have to comply with. These Rules cover the use, disclosure, storage and transmission of all forms of PHI (i.e. paper, electronic, etc.).

Community health centers not only have to comply with these Rules themselves, they have to make sure any “Business Associate” they share PHI with are also HIPAA-compliant. Business Associates are best described as entities who do not encounter PHI in their normal or primary business, but who may have access to it in the course of providing a service for a community health center. The list of potential Business Associates is extensive and can include lawyers, accountants, and cloud service providers.

Where to Start with HIPAA Compliance for Community Health Centers

The first stage of achieving HIPAA compliance for community health centers is to appoint a HIPAA Privacy Officer and a HIPAA Security Officer. These roles can be fulfilled by the same person, and can either be somebody brought in to oversee HIPAA compliance or an existing member of the health center team. It is possible to appoint a company to assist with HIPAA compliance during the preliminary stages, and then have an existing member take over the positions once the basic requirements are met

The Officer(s) responsible for HIPAA compliance should first conduct a risk assessment in order to identify areas of the community health center´s operations in which vulnerabilities exist in that may result in the unauthorized disclosure of PHI. The Officer(s) should evaluate existing privacy and security policies in order to determine whether they are configured and used as necessary, and then perform a risk analysis to draw up an action plan of the measures required to achieve HIPAA compliance.

Develop HIPAA-Compliant Policies and Train (and Re-Train) Employees

The action plan will help Privacy and Security Officers prioritize the most crucial vulnerabilities preventing HIPAA compliance for community health centers. Measures need to be implemented to mitigate the risks of a data breach and policies developed to make sure the measures are understood and adhered to. This will involve employee training and the development of a sanctions policy informing employees of the consequences of failing to comply with the new policies.

Employee training should not be regarded as an item to tick off a HIPAA compliance checklist. It should be ongoing and, due to the complexity of HIPAA, more frequent than the annual training suggested by the Department of Health & Human Services. In order to be effective, training about HIPAA compliance for community health centers should address different issues in short sessions. The content of a day´s compressed training is unlikely to be remembered until the next training session one year later.

Further Information about HIPAA Compliance for Community Health Centers

There are multiple benefits of achieving and maintaining HIPAA compliance for community health centers. Eligibility for HRSA Section 330 grants and Meaningful Use incentive payments can depend on HIPAA compliance, plus patients will feel happier knowing the integrity of their personal data is being safeguarded. Make sure the community health center under your care is HIPAA compliant.  You can find a comprehensive guide here.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.