Hipaa Data Regulation

The HHS HIPAA Security Series suggests that covered entities ask themselves the following two questions to help determine if data encryption is appropriate:

• Which ePHI should be encrypted and decrypted to prevent access by persons or software programs that have not been granted access rights?
• What encryption and decryption mechanisms are reasonable and appropriate to implement to prevent access to ePHI by persons or software programs that have not been granted access rights?

To that same extent, covered entities should determine who is accessing the data, and how they might be doing so. For example, if a facility has a BYOD policy, and employees can access ePHI through their phone, mobile data encryption might be appropriate.

It remains to be seen if the government will make adjustments on its requirements for health data encryption. Until then, facilities need to be thorough in their risk assessments so they can properly determine if data encryption is a necessary measure and then how best to incorporate it into their security. If a covered entity decides that data encryption is not necessary, it is essential to document the reasons why and then provide an acceptable alternative. Data breaches are unlikely to stop happening, so it is important that healthcare organizations remain diligent in making the necessary adjustments to remain as secure as possible.