Under the Health Insurance Portability and Accountability Act (HIPAA), telehealth practices are considered covered entities (CEs). As a HIPAA covered entity, the HIPAA Security Rule applies to telehealth practices.
What is the HIPAA Security Rule?
The HIPAA Security Rule requires organizations working in healthcare to secure protected health information (PHI), maintaining the confidentiality, integrity, and availability of PHI.
- Confidentiality: PHI cannot be disclosed to unauthorized individuals.
- Integrity: PHI cannot be altered or destroyed without proper authorization.
- Availability: PHI must be easily accessible to authorized individuals.
Covered entities have an obligation to adhere to the following in accordance with the HIPAA Security Rule:
- Identify and protect against reasonably anticipated threats to the security or integrity of the information;
- Protect against impermissible uses or disclosures of ePHI that are reasonably anticipated; and
- Ensure compliance by their workforce.
In addition to these standards, it is a requirement of the HIPAA Security Rule to have administrative, physical, and technical safeguards in place.
- Administrative: requires a security risk assessment (SRA) to be performed to identify gaps in security measures.
- Physical: are the measures that are put in place to secure physical location including alarms and cameras.
- Technical: are measures that secure an organization’s network including encryption, firewalls, and data backup.
Although the HIPAA Rule does not mandate specific safeguards to be in place, covered entities (CEs) must implement measures that are reasonably appropriate for their organization. When deciding what protection to implement, the following should be considered:
- Their size, complexity, and capabilities;
- Their technical hardware, and software infrastructure;
- The costs of security measures; and
- The likelihood and possible impact of the potential risk to ePHI.