How to Make Software HIPAA Compliant

Creating Appropriate Procedures

1. How to Make Software HIPAA Compliant Picture 1
   Keep an audit log. You need to track who accesses a patient's record. This means that you need to create separate usernames and passwords for each person who has access to patient health information. As part of the audit log, you should track the following:

   1. which record the user accessed
   2. the date it was accessed
   3. whether the user viewed the information, updated it, or deleted it
2. How to Make Software HIPAA Compliant Picture 2
   Create levels of access. HIPAA also requires that an employee only see the 'minimum necessary' information to do their job. For example, a doctor will need to see more health information than a receptionist. Accordingly, you need to create levels of access, in which you provide only as much information as each person needs to do their job.

   1. Some employees might only work with certain patients. In this situation, they should be granted access only to the patient records for the people they work with.
   2. In order to successfully create levels of access, you need to clearly define roles in your organization. This might require that you look at job descriptions and rearrange duties.
3. How to Make Software HIPAA Compliant Picture 3
   Create an 'emergency override' function. Even if you create levels of access, there may be situations where someone needs to access all information in an emergency. For this reason, you should create an 'override' which allows the person to retrieve whatever information is necessary to effectively treat patients.

   1. Nevertheless, you should set up your software so that use of this override function undergoes scrutiny.
   2. For example, you could set up the software so that every time someone uses the override function several other people are automatically emailed simultaneously. The software should also track whatever information this person accesses.
   3. You should also write out a review process for each use of the override function. For example, the person who uses it might have to meet later with a supervisor to justify the use.
4. How to Make Software HIPAA Compliant Picture 4
   Secure your data. HIPAA requires that you keep your data secure. In practice, this means that you should use passwords and keep the data secured behind a firewall.

   1. You also need to ensure that your emails are secure. In particular, you must use sufficient encryption technology on your emails.
   2. For more information on making sure your email complies with HIPAA, see Make Email HIPAA Compliant.
5. How to Make Software HIPAA Compliant Picture 5
   Scan patient authorization forms. You are required to get patients to sign forms authorizing your use of their information for their care. Each form should include a description of what you will use the data for and the date of expiration.

   1. You should track these authorizations, including the date the form was signed and the name of the person signing it.
   2. You should also scan the form and maintain a digital copy.
6. How to Make Software HIPAA Compliant Picture 6
   Confirm that your billing system is compliant. HIPAA standardized the transmission of billing information. For this reason, whatever billing system you use must support the HIPAA standards.

   1. At this point in time, virtually every billing system on the market does. Nevertheless, you should confirm with your vendor that it is HIPAA compliant.
7. How to Make Software HIPAA Compliant Picture 7
   Ask vendors about backup. HIPAA also requires that you maintain your data so that a patient can see it whenever he or she requests it. This means that you must maintain backups of all information. If you keep information on paper, then you need copies stored off-site or digital scans created. If you store data electronically, then it must be backed up.

   1. Ask vendors how they back up their systems. Find out how they ensure the continuity of the system in case of an accident.
   2. Should you host the data system on your own servers, then you will need to find out what backup procedures you have in place, as well as your emergency plans.
8. How to Make Software HIPAA Compliant Picture 8
   Have business associates sign contracts. Anyone who sees your data must agree to uphold the same policies and procedures as your organization. You should therefore draft a 'Business Associate' contract for all vendors to sign.

   1. Health and Human Services has a sample contract available at http://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html. You can modify it to suit your purposes.
   2. There are also sample contracts on the Internet. For example, the UT Health Science Center has a form contract you can use.^{[1] X Research source}
   3. You should also have your health care attorney look over any contract to make sure that it is sufficient to protect you.