HIPAA

HHS can impose civil penalties on a four-tier culpability scale: roughly $100-$50,000 per violation for unknowing violations, up to at least $50,000 per violation for uncorrected willful neglect, each tier capped around $1.5 million per year for identical violations.

Covered entities and business associates must ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit, protecting against reasonably anticipated threats and impermissible uses/disclosures.

Conduct a thorough risk analysis, implement risk management measures, apply a sanction policy for workforce noncompliance, and regularly review system activity records (audit logs, access reports, incident tracking) -- all four implementation specifications are Required.

Designate a security official responsible for developing and implementing the entity's security policies and procedures.

Ensure appropriate access authorization and supervision of workforce members, verify access clearance, and have procedures to remove access when employment ends -- all three implementation specifications are Addressable.

Isolate health care clearinghouse functions from broader organizational access (Required), and implement policies for granting and documenting access authorization (Addressable).

Implement a workforce security-awareness training programme covering periodic reminders, malicious-software protection, login monitoring, and password management -- all four implementation specifications are Addressable.

Implement policies to identify, respond to, mitigate, and document security incidents -- Required.

Maintain a data backup plan, disaster recovery plan, and emergency-mode operation plan (all Required), plus testing/revision procedures and an applications/data criticality analysis (both Addressable).

Perform periodic technical and non-technical evaluations of security safeguards against the Security Rule's requirements, in response to environmental/operational changes.

A covered entity may only allow a business associate to create, receive, maintain, or transmit ePHI on its behalf if it obtains satisfactory assurances -- generally a written Business Associate Agreement (BAA) -- that the associate will appropriately safeguard the information.

Implement policies limiting physical access to electronic information systems and the facilities housing them, while ensuring authorized access is permitted -- all four implementation specifications are Addressable.

Specify proper functions and physical attributes for workstations accessing ePHI, and implement physical safeguards restricting access to authorised users only.

Govern the receipt/removal of hardware and media containing ePHI: secure disposal and media re-use (Required), plus accountability tracking and data backup/storage before equipment movement (Addressable).

Implement technical policies restricting ePHI access to authorised persons/software, with unique user identification and emergency access procedures Required, and automatic logoff plus encryption/decryption Addressable.

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems containing or using ePHI -- Required.

Protect ePHI from improper alteration or destruction, with a mechanism to authenticate ePHI (confirm it has not been altered/destroyed in an unauthorised manner) as an Addressable specification.

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be -- Required.

Implement technical security measures guarding against unauthorised access to ePHI transmitted over an electronic network, with integrity controls and encryption both Addressable.

Sets the specific required content of a Business Associate Agreement: the associate must implement Security Rule safeguards, ensure its own subcontractors do the same, report security incidents, and authorise contract termination on material breach.

Implement reasonable and appropriate policies and procedures to comply with the Security Rule's standards; policy changes are permitted if properly documented and implemented.

Maintain written (paper or electronic) records of required security policies, actions, and assessments; retain documentation for 6 years from creation or last-effective date, keep it accessible to responsible staff, and review/update it periodically.