By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    headphones can create health problems
    The Harmful Health Effects of Using Headphones
    September 24, 2021
    Headache causes
    4 Causes Of Headache You Probably Didn’t Know About
    December 28, 2021
    follow these steps to recover from your injury
    What Steps Should You Take to Recover More Quickly from an Injury?
    April 12, 2022
    Latest News
    7 Most Common Healthcare Accreditation Programs: Which Should You Use?
    August 20, 2025
    Hospital Pest Control and the Fight Against Superbugs
    August 20, 2025
    Hygiene Beyond The Clinic: Attention To Overlooked Non-Clinical Spaces
    August 13, 2025
    5 Steps to a Promising Career as a Healthcare Administrator
    August 3, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    Key Tips For Buying Safe And Effective CBD Products
    February 16, 2021
    Medical Data & Patient Privacy: An Update
    July 30, 2018
    Benefits Of The Internet Of Things For Hospitals And Healthcare
    September 28, 2020
    Latest News
    How Social Security Disability Shapes Access to Care and Everyday Health
    August 22, 2025
    How a DUI Lawyer Can Help When Your Future Health Feels Uncertain
    August 22, 2025
    How One Fall Can Lead to a Long Road of Medical Complications
    August 22, 2025
    How IT and Marketing Teams Can Collaborate to Protect Patient Trust
    July 17, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Uncategorized

HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist

onlinetech
onlinetech
Share
7 Min Read
Defined Scope of HIPAA Compliance
SHARE

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

More Read

Difference Between Medical Billing Software and EMR
Essential Steps to Take to Recover from a Slip and Fall Injury
The Importance Of Medical Labels And Supplement Labels
Government Health IT Gets Boost with Two New Websites
Understanding The Potential Risk Factors And Causes Of Dementia

Q: Is it possible to be HIPAA compliant without an HROC (HIPAA Report on Compliance – or without a HIPAA risk assessment?
A: No. 45 CFR 164.308(a)(1)(ii)(a) is a required Implementation Specification under the HIPAA Security Rule, Security Management Process Standard. An HROC is not a required document. However, organizations must be able to produce evidence that they have completed an assessment and resolved any deficiencies or vulnerabilities. An HROC demonstrates the auditable steps that an organization took in that process.

Q: Can you explain where the HITECH act specifies antivirus is “required”?
A: “Protection from Malicious Software,” 45 CFR 164.308(a)(5)(ii)(b), is an Addressable Implementation specification under the HIPAA Security Rule, Security Awareness and Training Standard. Addressable does not equate to Optional.

“Protection from Malicious Software” is one of the key HIPAA Implementation Specifications as it speaks to the Confidentiality, Integrity, and Availability of Electronic Protected Health Information.

Q: What about offsite backup and/or disaster recovery?
A: The ability to store a recoverable set of Electronic Protected Health Information (ePHI), and test that process, are critical components that are governed by multiple HIPAA Implementation Specifications and Standards:

Contingency Plan Standard, 45 CFR 164.308(a)(7)(i)

  • Data Backup Plan (Required) – 45 CFR 164.308(a)(7)(ii)(A)
  • Disaster Recovery Plan (Required) – 45 CFR 164.308(a)(7)(ii)(B)
  • Emergency Mode Operation Plan (Required) – 45 CFR 164.308(a)(7)(ii)(C)
  • Testing and Revision Procedures (Addressable) – 45 CFR 164.308(a)(7)(ii)(D)

Device and Media Controls Standard, 45 CFR 164.310(d)(1)

  • Data Backup and Storage (Addressable) – 45 CFR 164.310(d)(2)(iv)

In addition to the Standards and Implementation Specifications listed, there are many others that factor into the procedures and safeguards that are implemented in the Backup and Recovery Process.

Q: What about a firewall?
A: A firewall can be considered in multiple Standards and Implementation Specifications across the HIPAA Administrative, Physical, and Technical Safeguards. Remember that the purpose of a firewall is to restrict access to networks through a selective process of blocking inbound traffic.  In some cases, firewalls or content filters will also block outbound traffic.

While HIPAA does not call for the direct implementation of firewall technology, in most cases, it is the most reasonable and practical approach to addressing the requirements laid out in the HIPAA regulations.

Q: What methodology did you use to come up with the 136 audited components for ATMP’s independent HIPAA audit?
A: In the development of the assessment methodology, a combination of technical, health care, and HIPAA knowledge was used. HIPAA is very clear in some areas and provides guidance in other areas. An objective risk based approach was integrated in the overall assessment process making it adaptable to any Covered Entity or Business Approach.

Q: Can you explain why there is no such thing as “HIPAA certified”?
A: Unlike other compliance standards such as ISO and SOX, HIPAA has not yet implemented a single audit standard. The industry relies on individuals and organizations who possess background in Information Technology, Health Care, and HIPAA to reasonably guide Covered Entities and Business Associates through the compliance process.

One of the main reasons that HIPAA has not implemented a single audit standard is due to the fact that one set of regulations governs all health care entities and their business partners. In other words, unlike PCI, HIPAA does not have a subset of requirements in place, based on the size of the organization. HIPAA, in its original and current state, was designed to be a flexible, scalable, and vendor neutral architecture for compliance.

Q: How many audited components go with each standard/citation ?
A: Based on the size and type of organization, we have adopted the following framework:

Defined Scope of HIPAA Compliance

Defined Scope of HIPAA Compliance

Still have other HIPAA-related questions? For more HIPAA hosting resources, see our HIPAA FAQ and HIPAA Glossary of Terms.


Joe Dylewski of ATMP Group

Joe Dylewski, President, ATMP Group

Joseph Dylewski is a twenty-five year Information Technology Professional veteran, a Certified HIPAA Professional (CHP), and a Certified HIPAA Security Specialist (CHSS) with ten years spent exclusively in the Healthcare Industry. In addition to holding positions as a Project Manager and Director of Information Technology, Joseph has also served as a Healthcare IT Services Practices Director and Account Manager with a proven track-record of successfully delivering end-to-end IT application and infrastructure project services. Joseph also currently serves as an Assistant Professor at Madonna University.

TAGGED:HIPAA compliance
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

engineer fitting prosthetic arm
How Social Security Disability Shapes Access to Care and Everyday Health
Health care
August 20, 2025
a woman explaining the document
How a DUI Lawyer Can Help When Your Future Health Feels Uncertain
Public Health
August 20, 2025
physiotherapist at work
How One Fall Can Lead to a Long Road of Medical Complications
Health care
August 20, 2025
Common Healthcare Accreditation Programs
7 Most Common Healthcare Accreditation Programs: Which Should You Use?
Health News
August 20, 2025

You Might also Like

Linking ICD-10 and the Future of HCIT

February 28, 2012

Provider Identities and Information Sources : Using IT to Facilitate Information Therapy

September 23, 2011

Algorithms in Medicine

February 15, 2012
Uncategorized

Infographic:Race to the ICD-10 Finish Line

February 9, 2012
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?