Why HIPPA Matters To Your Business Even If You're Not In Healthcare

Since 2013, Brilliance CRM has been built with HIPPA from the ground up. Not only because one of our first clients needed it but also because of our focus on the security of our customers. Every business deserves the added security measures that HIPPA provides, even those not in the healthcare industry.

What is HIPAA?

HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a crucial piece of United States legislation to protect the privacy and security of medical information. Enacted on August 21, 1996, by President Bill Clinton, HIPAA comprises five titles, each addressing specific aspects of healthcare and data management:

• Title I: HIPAA Health Insurance Reform
• Title II: HIPAA Administrative Simplification
• Title III: HIPAA Tax-Related Health Provisions
• Title IV: Application and Enforcement of Group Health Plan Requirements
• Title V: Revenue Offsets

Discussing HIPAA compliance in online marketing typically pertains to adherence to HIPAA Title II, which focuses on administrative simplification measures.

HIPAA Title II

Also referred to as the Administrative Simplification provisions, Title II of HIPAA encompasses several compliance requirements aimed at enhancing healthcare data management and security:

1. National Provider Identifier Standard: All healthcare entities, including individuals, employers, health plans, and providers, are mandated to possess a unique 10-digit National Provider Identifier (NPI) number.
2. Transactions and Code Set Standard: Healthcare organizations must adhere to standardized protocols for electronic data interchange (EDI) to facilitate the submission and processing of insurance claims.
3. HIPAA Privacy Rule: Formally known as the Standards for Privacy of Individually Identifiable Health Information, this rule establishes national standards for safeguarding patient health information.
4. HIPAA Security Rule: The Security Standards for the Protection of Electronic Protected Health Information delineates standards for ensuring the security of patient data.
5. HIPAA Enforcement Rule: This rule outlines procedures for investigating violations of HIPAA compliance.

Further details on each rule can be found here:

• HIPAA Privacy Rule
• HIPAA Security Rule

Brilliance CRM Compliance Since 2013

In the relationship between Brilliance CRM and yourself, we have you fill out a HIPAA Business Associate Agreements (BAA) form between Brilliance CRM and yourself. Your business should have customers sign a similar form between you and them.

I don't deal with the healthcare industry, do I need HIPPA?

Even if HIPAA doesn't directly apply to your business, maintaining strong data privacy and security practices is crucial for protecting your customers' information and building trust. We feel that by giving you a robust system that complies with already tight industry standards, you are better off protecting your customers and building your brand trust.

What does HIPPA Title II Contain?

For HIPAA compliance under Title II, especially concerning SaaS software solutions, several key considerations include:

• Data Encryption: To prevent unauthorized access, we encrypt all information related to the system and adhere to the patient health information (PHI) in transit and at rest.
• Access Controls: We provide the tools to limit access to information within the system to only those who should have access.
• Audit Trails: We maintain detailed audit trails of all activities involving PHI, including access, modifications, and deletions, to track and monitor user actions.
• Data Backups and Disaster Recovery: Regularly back up PHI and establish comprehensive disaster recovery plans to ensure data availability and integrity in emergencies.
• Secure Communication Channels: Use secure communication channels, such as encrypted email and secure messaging platforms, to transmit PHI to prevent interception or unauthorized access.
• Business Associate Agreements (BAAs): Enter into BAAs with any third-party service providers or vendors with PHI access, ensuring they adhere to HIPAA requirements and standards.
• Employee Training and Awareness: Provide regular training and awareness programs for employees to educate them about HIPAA regulations, security best practices, and their responsibilities in safeguarding PHI.
• Regular Risk Assessments: Conduct periodic risk assessments to identify and address potential vulnerabilities and threats to the security of PHI within your SaaS solution.
• Incident Response Plan: Develop and implement a comprehensive incident response plan to address security breaches or unauthorized disclosures of PHI promptly and effectively.
• Ongoing Compliance Monitoring: Continuously monitor and review your SaaS solution's compliance with HIPAA regulations, staying updated with any changes or updates to the law and industry best practices.