HIPAA Compliance?

[spacebass5000]

I currently co-own an IT Solutions/Outsourcing company and have been told I should become HIPAA compliant.

How do I go about this?

I'm obviously not a physician but I do work with physician's IT systems. Knowing this, how deep does it go for me?

Any help you have to offer will be greatly appreicated...

 

[franklin97355]

Try some of these sites.

 

[dkediger]

Firstly, you'll need a signed Business Associate agreement for each practice you work at. The practices themselves, as they are the HIPAA defined "Covered Entity," should be taking care of this. If not, then they themsleves have work to do.

Secondly, HIPAA is more appropriately viewed as each organization defining a set of policies and then demonstrating compliance with those policies. There really isn't a catch-all proscribed set of actions to follow. Most regs follow a "reasonable and prudent" course, allowing for different types of covered entities.

For a nice overview of some "reasonable and prudent" standards, check out the newly published NIST guide:

http://csrc.nist.gov/publications/nistpubs/800-66/SP800-66.pdf

 

[spacebass5000]

awesome, thanks!

How do I illustrate to the world at large that I am indeed HIPAA compliant?

 

[GlenJohnson]

You might want to look into a press release.

http://www.stetson.edu/~rhansen/prguide.html

Glen A. Johnson
If you're from the Illinois, Wisconsin or Florida area, check out Tek-Tips in Chicago IL
To get the best answers to your questions, check out faq950-5848