Although you aren’t required to have an information system asset inventory, having one will help you meet several requirements of the HIPAA Security Rule, including risk analysis and management, information systems activity review, device and media management, and...
Patients don’t want to be put on hold. They’re tired of accommodating to constraining office hours. Consequently, they’re looking for easy ways to communicate with their providers. Technology can solve many of patients’ communication frustrations. Many systems allow...
Far too many privacy officers lean on their electronic medical record (EMR) or electronic health record (EHR) system as a HIPAA compliance crutch. They believe (mistakenly) that an EMR/EHR system keeps their organization HIPAA compliant. Maybe that’s you. However,...
In January 2017, a HIPAA-covered Texas clinic learned that someone had stolen an unencrypted external hard drive. The thief took it from a locked closet inside the clinic. The clinic used that hard drive to back up patients’ protected health information (PHI)....
If you don’t record and review system activity, hackers or unethical employees can harm your organization without a trace. Therefore, The Office for Civil Rights (OCR) prompts HIPAA-covered organizations to collect, secure, track, and review their system audit...
A security risk analysis is a vital part of the risk management process. According to the HIPAA Security Rule, all HIPAA-covered organizations must conduct them. This analysis helps your organization prevent, detect, contain, and correct security violations. However,...