April 19, 2024

This week, we’ve gone through what makes HIPAA, well, HIPAA. 

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, comprises three rules.

 These rules include: 

• Security Rule
• Privacy Rule
• Breach Notification Rule 

Today, we’re talking about the Security Rule. Trust us, we know that compliance jargon can get complicated. That’s why we’re here to make it simple. 

What’s the Security Rule?

Let’s kick it back to the totally rad 90s to give more insight. 

The year is 1996, and we’re entering the digital age. While we fought with dial-up and AOL was all the rage, more and more Electronic Protected Health Information (ePHI) was being created and transmitted digitally. 

HIPAA was signed into law because of this technological boom, needing federal guidance on the protection of health information with each new innovation. 

As a result, a part of HIPAA, the Security Rule was born.

The Security Rule establishes the standards for how ePHI needs to be protected. This includes the administrative, physical, and technical safeguards to ensure ePHI is secure, remains private, and accurate. 

Building a Fortress

Administrative safeguards are the first line of defense when it comes to protecting patient data.

Administrative safeguards are policies and procedures that your practice or business does to ensure compliance and protection of ePHI. 

The Security Risk Analysis (SRA) is a classic example of an administrative safeguard.

This proactive measure helps practices and business identify their risks and vulnerabilities when it comes to protecting PHI. The SRA is required under the Security Rule. 

Training also falls under administrative safeguards, ensuring all staff is knowledgeable and up-to-date with best practices to remain HIPAA-compliant.

Keep it Secure

You wouldn’t leave your keys lying around, would you? 

The same goes with PHI. 

Physical safeguards include a range of measures to secure ePHI. 

Common examples of the appropriate physical safeguards include: 


• Alarms: Wee-o Wee-o! Alarms make sure that staff is alerted when there is unauthorized access in the practice or business. 
• Locks: Locks make sure that only authorized staff can access parts of the practice or business, like your computer area. 
• Access Logs: Access logs provide an audit trail, seeing when and who accesses specific information. 

Tech Talk

Now, alongside physical safeguards, technical safeguards are key to keeping ePHI safe. 

We hate to break it to you, but a lock isn’t going to protect your ePHI when there’s a hacker across the globe trying to breach your ePHI! 

Common examples of technical safeguards include: 

• Encryption: Locking your files with a secret key. Only those who have the key can unlock and access the information.
• Multi-Factor Authentication: What’s better than one? Two! Multi-factor Authentication provides an extra layer of security, requiring more than just a password, like a fingerprint, a unique code, and more. 
• Antivirus Software: Your digital bodyguard! Antivirus software provides another line of defense, flagging suspicious files, malware, and phishing attempts. 

Covered Entities and Business Associates can get on track with these proper safeguards by working with your IT department or an IT partner.

How Abyde Can Help

Phew! Who knew HIPAA could get so complicated? 

Well, Abyde is here to save the day, simplifying the compliance process for your organization. Abyde’s software is tailored to fulfill HIPAA regulations, including an intuitive SRA, entertaining training, custom policies and procedures, and more. 

The Abyde software is here to make sure you Never Stress Over Compliance Again!

If you are looking for an IT partner to assist you in implementing technological safeguards, we can also help with that, too! We have numerous IT partners who specialize in healthcare, knowing what you need to be secure. Reach out to info@abyde.com and call 1.800.594.0883 to find your next IT partner. 

To learn more about HIPAA compliance, email info@abyde.com and schedule an educational consultation here for Covered Entities and here for Business Associates.