Addressing Healthcare Compliance: The HITECH Act

With a dramatic increase in the number of security breaches and Patient Health Record (PHR) thefts, there is mounting pressure on healthcare organizations to implement a thorough access governance framework to protect electronically stored PHR. This called for the extension of The Health Insurance Portability & Accountability Act (HIPAA) to accommodate a more preventive rather than reactive approach to security; the end result being The Health Information Technology for Economic and Clinical Health (HITECH) Act, which imposes much more stringent requirements in addition to the privacy and security norms of HIPAA.

The HITECH Act takes a broader and more preventive approach by enforcing specific control requirements for the protection of PHR. Additionally, HITECH compliance not only requires a system of recording evidence of compliance, but also an audit trail of who has access to Electronic Health Records (EHR), and how and when these records were accessed. With all these regulatory standards to be addressed, healthcare organizations need a comprehensive security monitoring and compliance management solution that can effectively deal with access control and other requirements. Here are some features to look for:

Automated Access Controls: Healthcare organizations need a solution that can implement automated controls to ensure authorized access, and address change management with regard to users’ roles within, and relationships with the organization. It should facilitate maintenance of policies in a consistent fashion to avoid access-related risks.

Preventive, rather than Detective Approach: Applying access-control policies in an environment that is subject to constant change is a formidable challenge. And hence effective change management becomes a growing challenge. Hence the security solution adopted by healthcare organizations should be able to simplify the change management process by assigning pre-determined compliant roles, and by ensuring a closed-loop validation process which can make sure that access rights not required for a certain role are remediated. This helps in taking a preventive approach and helps mitigate risks.

Complete Compliance Support: Complying with multiple regulations is always a challenge for organizations of all sizes. And only more so for healthcare organizations which process electronically stored patient records. While on the one hand they need to ensure overall information security, on the other they have to abide by the stringent requirements of HIPAA Compliance and HITECH Acts. And to ensure healthcare compliance organizations have to adopt a solution that can offer complete support with simple, easy-to-use tools, offering scalability and easy plug-in capabilities to accommodate new regulations.

Some compliance solutions also enable automatic updates on new policies and procedures, and on modified regulations and requirements. They also keep track of the compliance status and send out periodic reminders for compliance maintenance. With such an integrated compliance solution and a strategic policy framework in place, healthcare organizations can gain complete visibility and control over information access, and effectively mitigate risk of unauthorized access to sensitive PHR.