The Health Insurance Portability and Accountability Act (HIPAA) is a federal law in the United States that establishes minimum standards for securing Protected Health Information (PHI) including electronic PHI (ePHI). It applies to all organizations that store, process or transmit PHI for U.S citizens.
PHI includes specific personal and health identifiers such as names, email addresses, telephone numbers, significant dates such as dates of birth, social security numbers, medical record numbers, biometric information, and photographic images. While HIPAA is specific to U.S citizens, many other countries have enacted similar rules to safeguard health information. For example, countries in the European Union must comply with the General Data Protection Regulation (GDPR) to protect health-related personal data. Canadian organizations are covered by the Personal Information Protection and Electronic Documents Act (PIPEDA) that deals with the protection of personal information that includes health-related information.
HIPAA standards are defined in three separate Rules for Privacy, Security, and Breach Notification. The Privacy Rule applies to PHI. The Security Rule includes measures to protect the confidentiality, availability and integrity of ePHI. The Breach Notification Rule outlines reporting and disclosure requirements in the event of a breach of PHI or ePHI. Violations of the requirements of the rules can result in fines and civil penalties. Furthermore, the Office for Civil Rights (OCR) is empowered to conduct periodic audits of organizations to confirm compliance with HIPAA standards.
The Security Rule details 18 standards compromised of 42 specifications that organizations must comply with to protect ePHI from unauthorized access, modification or disclosure. This includes technical safeguards for authentication, access control, data transmission, encryption and auditing. The technical safeguards apply to all solutions handling ePHI. This can include SAP solutions.
The OCR issued a notice for proposed updates to the HIPAA Security Rule in December last year. The updates are intended to address current and emerging cyber threats. The changes include removing the distinction between required and “addressable” standards. This was used by some organizations to evade compliance. The revised Security Rule will limit exemptions.
The new Security Rule will also mandate vulnerability assessments every 6 months, penetration tests every 12 months, and annual compliance audits. Organizations will need to ensure the timely implementation of security patches and software updates by implementing critical patches within 15 days and high priority patches within 30 days. The Rule will also require the implementation of specific measures for encrypting data at rest and in transit, multi-factor authentication, anti-malware protection, and minimizing the attack surface for information systems. Organizations will also be required to implement technology to support real-time monitoring and incident response for systems.
The public comment period for the proposed changes to the Security Rule closed earlier this month. The OCR will review all 4,745 comments submitted by organizations and experts. There is currently no timeline for the implementation of the new Security Rule. However, the changes have bipartisan support and therefore are likely to be rolled out soon. Once the updated Rule takes effect, organizations are expected to have 180 days to comply with the new requirements.
The Cybersecurity Extension for SAP automates compliance audits for the technical safeguards of the HIPAA Security Rule. It detects compliance gaps for SAP solutions related to authentication, access control, unapplied security patches, auditing and other standards in HIPAA. The solution also supports compliance assessments for other security frameworks including GDPR, PCI-DSS and NIST, as well as SAP security standards such as the SAP Security Baseline, the S/4HANA Security Guide, and SAP Enterprise Cloud Services requirements for SAP RISE.
The Cybersecurity Extension for SAP performs threat detection for SAP solutions including alerting for suspected security breaches. Alerts can be investigated and reported using built-in incident response procedures. This supports compliance with security monitoring requirements and the Breach Notification Rule of HIPAA.
