Reconciling HIPAA Compliance with Network Security

HIPAA compliance, which aims to protect confidentiality and security of healthcare records, is unavoidable for companies and data centers who wish to handle the data of these companies. While most data centers and healthcare providers are aware of the HIPAA provisions and take steps to ensure compliance, many of them make some mistakes which may render the compliance efforts a waste and make the company liable for non-compliance action. A significant area of mistakes and oversights relate to security aspects.

Here are a couple of ways you can reconcile HIPAA compliance with network security.

Do NOT compromise on security infrastructure: Complying with all the provisions of HIPAA may still result in non-compliance. This is because HIPAA, while focusing on privacy and security relating to personal data, assumes that there are already tight security processes in place. This is very often not the case, and health purveyors have a high risk of security breaches from hackers and others, just like every other company. In an age where cyber crimes are at an all time high, having top grade security infrastructure backed up by sound security policies that work in keeping major threats at bay are important to comply with HIPAA provisions. Having said this, throwing money on infrastructure is not enough. It is equally important to develop a strong culture where security is given the commitment and priority it deserves.

Review system activity: HIPAA mandates organizations to review their system activity regularly, through access and security-incident reports. However, in today’s environment, there is a high incidence of employees processing and storing covered health information on their mobile phones, which may be outside the scope of organizational control. When it comes to external storage in the cloud, the organizations are equally helpless, and it is up to the data center or the cloud provider to undertake these reviews. Organizations need to ensure that their service providers do what’s necessary, rather than assume the provider has these systems in place.

Encrypt data: Encrypting stored data negates the work of cyber-attackers breaching the network and trying to steal data. Encryption prevents data thieves from accessing or tampering with sensitive information, therefore sparing the organization from liabilities. Organizations need to always choose data centers that offers high-grade encryption.

Do not underestimate physical security: Organizations across the board, be it the parent company or data centers, often take physical security for granted, when that remains a major weak spot for security breaches. Professional data thieves and rogue insiders may find it easier to run away with backup disks or even the server itself, rather than trying to hack the network. A simple case of employee carelessness in misplacing backup tapes can be just as damaging. Among the most common HIPAA violations involve healthcare employees accessing files inappropriately, either out of curiosity or maliciously. Make sure that the data center takes physical security seriously and has thorough the record-keeping in place, including accountability logs.

Network security is in a constant state of flux, as new challenges emerge by the day. Organizations and, by extension, data centers, who need to comply fully with HIPAA have no option but to take a proactive approach to security and meet these challenges directly.

Lifeline Data Centers has all of these network security issues covered, and we are a Rated-4 data center that takes both physical and digital security seriously. Schedule a tour with us to learn more today.

Alex Carroll

Managing Member at Lifeline Data Centers

Alex, co-owner, is responsible for all real estate, construction and mission critical facilities: hardened buildings, power systems, cooling systems, fire suppression, and environmentals. Alex also manages relationships with the telecommunications providers and has an extensive background in IT infrastructure support, database administration and software design and development. Alex architected Lifeline’s proprietary GRCA system and is hands-on every day in the data center.