HIPAA compliance is required for a specific set of organizations that handle health information in the United States. These organizations are broadly categorized into two groups: covered entities and business associates.

Covered Entities:

• Healthcare providers. This includes doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies, but only if they transmit any health information in an electronic form in connection with transactions for which the Department of Health and Human Services (HHS) has adopted standards.
• Health plans. Health insurance companies, health maintenance organizations (HMOs), employer-sponsored health plans, and government programs that pay for healthcare, such as Medicare, Medicaid, and the military and veterans’ healthcare programs.
• Healthcare clearinghouses. These are entities that process nonstandard health information they receive from another entity into a standard format or vice-versa. This includes billing services and community health management information systems.

Business Associates:

• Service providers to covered entities. These are individuals or entities that perform certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provide services to, a covered entity. Examples include billing companies, claims processing companies, attorneys, IT consultants, data processing firms, and document shredding companies.
• Subcontractors of business associates. This extends to subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate, further expanding the range of entities that need to be HIPAA compliant.

Notably, HIPAA compliance is not limited to entities within the United States. If a company based outside of the country handles PHI for U.S. patients or works with U.S. healthcare providers, that overseas business must also be HIPAA compliant. This wide net is meant to assure that patient data is protected through every step of healthcare operations and associated services, regardless of the specific nature of an entity’s business.

Any organization that is required to be HIPAA compliant can benefit from compliance software that enables it to survey its sensitive data and security controls to see where the business is already compliant, as well as where it isn’t, and how to fill the gaps.

HIPAA (the Health Insurance Portability and Accountability Act) and HITECH (the Health Information Technology for Economic and Clinical Health Act) are both U.S. laws that deal with health information, but they have different focuses and were enacted at different times. While the HIPAA Privacy Rule empowers patients to obtain and control their own PHI, the HITECH Act increases those rights by allowing patients to obtain copies of health records in electronic form if the covered entity maintains the records in electronic format.

HIPAA (1996):

Primary focus: HIPAA was enacted primarily to improve the portability and continuity of health insurance coverage, with a strong emphasis on the confidentiality and privacy of Protected Health Information (PHI). It sets national standards for the protection of PHI by healthcare providers, insurance companies, and their business associates.

Privacy and security rules: These are the two significant components of HIPAA. The Privacy Rule dictates how PHI should be used and disclosed, whereas the Security Rule sets standards for the secure handling of electronic protected health information (ePHI).

Enforcement: HIPAA violations are enforced by the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS).

HITECH Act (2009):

Primary focus: The HITECH Act was a part of the American Recovery and Reinvestment Act and was primarily aimed at promoting and expanding the adoption of health information technology, specifically the use of Electronic Health Records (EHRs) by healthcare providers.

Strengthening HIPAA: HITECH enhanced HIPAA rules by introducing stricter data breach notification requirements and increasing the penalties for HIPAA violations. It emphasized the importance of safeguarding ePHI, reflecting the growing use of digital technology in healthcare.

Encouraging use of EHRs: A significant part of HITECH was the introduction of the Meaningful Use program, which provided financial incentives for healthcare providers to adopt and use certified EHR technology, to improve patient care and efficiency in the healthcare system.

While HIPAA established the foundational rules for protecting health information privacy and security, HITECH came later to reinforce these rules in the context of rapidly advancing health information technology. HITECH also introduced incentives and penalties aimed at accelerating the adoption of EHRs and enhancing the protection of electronic health data. HITECH also prohibits organizations from selling PHI except under limited, specific circumstances. This effectively stopped providers from profiting off treatment recommendations.

Organizations in PCI Levels 2 through 4 can complete a self-assessment questionnaire (SAQ) instead of an external audit.

It’s difficult to provide a broad estimate of HIPAA compliance costs because those costs depend on each organization’s own unique systems and operations That said, some rules of thumb can provide a sense of the potential expenses involved:

Risk Assessment and Gap Analysis:

• Small practices or businesses might spend $1,000 to $5,000 using self-assessment tools or low-cost consultants.
• Larger organizations, especially those with complex data systems, could see costs ranging from $15,000 to $50,000 or more for comprehensive external assessments.

Technology and Infrastructure Upgrades:

• For small to medium-sized entities, IT upgrades might range from $10,000 to $100,000.
• Larger organizations or those needing extensive upgrades could face costs in the range of $100,000 to several million dollars, depending on the scale and complexity of the IT infrastructure.

Training and Workforce Education:

• Annual training costs could be around $100 to $500 per employee. For a small practice with 10 employees, this might total around $1,000 to $5,000.
• In larger organizations, costs can escalate to $10,000 to $50,000 annually, considering more extensive training programs and a greater number of staff.

Policy Development and Legal Consultation:

• Small practices might spend $2,000 to $5,000 on policy development and legal consultations.
• For larger entities or those with more complex legal needs, costs could reach $25,000 to $100,000 or more.

Compliance Management Software:

• Software solutions can vary significantly in price, from as low as $1,200 to $10,000 per year for basic platforms, to $25,000 to $100,000 or more for comprehensive solutions tailored to larger organizations.

Ongoing Compliance Activities:

• Small practices may incur $3,000 to $10,000 annually.
• Larger organizations could spend $50,000 to $200,000 or more each year on ongoing compliance activities.

Breach Response and Incident Management:

• Costs in the event of a breach are highly variable. Small breaches might cost a few thousand dollars, while significant breaches could run into millions in forensic investigations, breach notification, legal fees, and fines.

Cyber Liability Insurance:

• Premiums can range from $1,000 to $5,000 annually for small practices but could exceed $50,000 annually for larger healthcare organizations.

These figures are approximate and can vary based on the specific needs and circumstances of each organization. It’s also important to note that these costs are spread over several areas, and not all of them may apply equally to every organization.

Find out what HIPAA auditors are specifically looking into by registering for the step-by-step guide

GET THE GUIDE

The HIPAA Security Rule sets out security standards for protecting the confidentiality, integrity and availability of ePHI. It requires covered entities to implement technical safeguards to prevent unauthorized access and related security incidents.

While a firewall is an important part of a comprehensive cybersecurity program, HIPAA compliance software has a somewhat different purpose.

The purpose of a compliance management software solution like the ZenGRC Pro Platform is to help organizations assure that they’ve met all cybersecurity and data privacy controls and documentation required by HIPAA rules.

A firewall is only a single requirement, of many, that an organization might be required to implement to meet its compliance obligations.

No programming languages are inherently secure. Instead, the software is made compliant by the developer who adopts the HIPAA compliance best practices while creating the software.

That said, a variety of programming languages can be used in various medical settings, so long as the language is used in a compliance-ready environment.

And on that note, Python is one of the most frequently used programming languages for HIPAA compliant software.