FAQs
Have Questions?
Does HIPAA apply to my Houston business?
HIPAA applies to covered entities (healthcare providers, health plans, and clearinghouses) and to business associates that handle protected health information on their behalf. A Houston business that bills insurance, provides clinical services, manages medical records, or processes payments for healthcare typically falls under HIPAA. Many businesses are surprised to learn they are business associates.
What does the HIPAA Security Rule require for IT?
The Security Rule requires administrative safeguards like risk analysis and workforce training, physical safeguards like facility access controls, and technical safeguards including access controls, audit logging, integrity monitoring, and encryption for electronic PHI. Each safeguard has specific implementation specifications that must be addressed in writing.
What are HIPAA penalties for a small practice?
HIPAA penalties scale by violation tier and severity. Tier 1 minor violations carry modest per-incident amounts, but Tier 4 (willful neglect not corrected) reaches significant per-violation amounts with annual caps in the millions. For a small practice with a major breach, total penalties commonly run into the hundreds of thousands. State actions can add to federal penalties.
Do we need a HIPAA risk analysis every year?
The Security Rule requires periodic risk analysis. Most healthcare attorneys recommend annual analysis as a baseline. Any significant change to systems, vendors, or practice operations should trigger a fresh review. CinchOps performs annual risk analyses for healthcare clients and updates them when significant changes occur between annual cycles.
What is a business associate agreement?
A business associate agreement is a written contract between a covered entity and a business associate that handles PHI on its behalf. The agreement specifies how the business associate will safeguard the information. HIPAA requires these agreements with every business associate, and OCR specifically looks for them in audits. Missing BAAs are a common compliance gap.
