How Does Blancco Help Organizations Achieve HIPAA Compliance?

The Health Insurance Portability and Accountability Act (HIPAA) is a 1996 U.S. federal law that regulates the use and disclosure of protected health information (PHI), and includes requirements for data disposal.

HIPAA is applicable to organizations that offer health plans, to health care clearinghouses and to any health care providers that transmit health information in electronic form. It is also applicable to entities that create, receive, maintain, or transmit any PHI on behalf of a covered entity or another business associate acting as a subcontractor. This includes government-owned institutions.

HIPAA and Data Sanitization

While HIPAA doesn’t put specific data sanitization rules in place, it does speak about the need to dispose of data that is no longer required to meet HIPAA compliance needs. It’s up to your organization to establish secure data removal policies to avoid fines for noncompliance.
In 2013, the HIPAA Omnibus Rule was put in place. This rule increased penalties for HIPAA compliance violations to a maximum of $1.5 million per incident.

Complying with HIPAA

Adhering to HIPAA Title II is what most organizations mean when they refer to HIPAA compliance. Also known as the Administrative Simplification provisions, Title II includes the following HIPAA compliance requirements:

• National Provider Identifier Standard. All healthcare entities must have a unique 10-digit national provider identifier number, or NPI.
• Transactions and Code Sets Standards. A standardized mechanism for electronic data interchange (EDI) for processing insurance claims.
• HIPAA Privacy Rule. Officially known as the Standards for Privacy of Individually Identifiable Health Information, this rule establishes national standards to protect patient health information.
• HIPAA Security Rule: The Security Standards for the Protection of Electronic Protected Health Information sets standards for patient data security.
• HIPAA Enforcement Rule. This rule establishes guidelines for investigations into HIPAA compliance violations.

Specifically, Blancco helps organizations comply with the HIPAA Privacy Rule and the HIPAA Security Rule.

HIPAA Privacy Rule

The HIPAA Privacy Rule concerns “national standards to protect individuals’ medical records and other personal health information.”

This Rule requires that organizations implement safeguards to protect patient data. Blancco’s suite of data erasure solutions enable organizations to meet HIPPA compliance by erasing electronic records when they’re no longer needed.

For example, Blancco File Eraser allows organizations to go beyond file shredding with secure erasure of sensitive files and folders with system integrations and rules automation. This cost-effective solution ensures data is made unrecoverable, fully satisfying the HIPAA Privacy Rule requirement when data no longer fulfills a business or retention need.

HIPAA Security Rule

The HIPAA Security Rule protects a subset of electronic information covered by the HIPAA Privacy Rule. The Security Rule refers to this information as “electronic protected health information” (e-PHI).

The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI.
The following chart shows how Blancco helps address HIPAA Security Rule requirements.

Download the Solution Brief.

You may be interested in:

How Blancco Helps Organizations Comply with ISO 27001 Data Destruction Controls

The Boardroom Case for Circular IT 

[VIDEO] How ITADs can detect UEM enrollments with Blancco

6 Data Sanitization Controls to Strengthen Your Enterprise GRC Strategy