By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Uncategorized

HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist

onlinetech
onlinetech
Share
7 Min Read
Defined Scope of HIPAA Compliance
SHARE

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

More Read

HIPAA Breaches by State
HIPAA Breaches By State
Breaking News: HHS Proposes 1 Year Delay to ICD-10
Oracle Clouds and Oracle Social Network
Electronic Medical Records Now Offering HIPAA-Compliant Social Media-Style Messaging
Mass Digitization Threatens the IT Industry

Q: Is it possible to be HIPAA compliant without an HROC (HIPAA Report on Compliance – or without a HIPAA risk assessment?
A: No. 45 CFR 164.308(a)(1)(ii)(a) is a required Implementation Specification under the HIPAA Security Rule, Security Management Process Standard. An HROC is not a required document. However, organizations must be able to produce evidence that they have completed an assessment and resolved any deficiencies or vulnerabilities. An HROC demonstrates the auditable steps that an organization took in that process.

Q: Can you explain where the HITECH act specifies antivirus is “required”?
A: “Protection from Malicious Software,” 45 CFR 164.308(a)(5)(ii)(b), is an Addressable Implementation specification under the HIPAA Security Rule, Security Awareness and Training Standard. Addressable does not equate to Optional.

“Protection from Malicious Software” is one of the key HIPAA Implementation Specifications as it speaks to the Confidentiality, Integrity, and Availability of Electronic Protected Health Information.

Q: What about offsite backup and/or disaster recovery?
A: The ability to store a recoverable set of Electronic Protected Health Information (ePHI), and test that process, are critical components that are governed by multiple HIPAA Implementation Specifications and Standards:

Contingency Plan Standard, 45 CFR 164.308(a)(7)(i)

  • Data Backup Plan (Required) – 45 CFR 164.308(a)(7)(ii)(A)
  • Disaster Recovery Plan (Required) – 45 CFR 164.308(a)(7)(ii)(B)
  • Emergency Mode Operation Plan (Required) – 45 CFR 164.308(a)(7)(ii)(C)
  • Testing and Revision Procedures (Addressable) – 45 CFR 164.308(a)(7)(ii)(D)

Device and Media Controls Standard, 45 CFR 164.310(d)(1)

  • Data Backup and Storage (Addressable) – 45 CFR 164.310(d)(2)(iv)

In addition to the Standards and Implementation Specifications listed, there are many others that factor into the procedures and safeguards that are implemented in the Backup and Recovery Process.

Q: What about a firewall?
A: A firewall can be considered in multiple Standards and Implementation Specifications across the HIPAA Administrative, Physical, and Technical Safeguards. Remember that the purpose of a firewall is to restrict access to networks through a selective process of blocking inbound traffic.  In some cases, firewalls or content filters will also block outbound traffic.

While HIPAA does not call for the direct implementation of firewall technology, in most cases, it is the most reasonable and practical approach to addressing the requirements laid out in the HIPAA regulations.

Q: What methodology did you use to come up with the 136 audited components for ATMP’s independent HIPAA audit?
A: In the development of the assessment methodology, a combination of technical, health care, and HIPAA knowledge was used. HIPAA is very clear in some areas and provides guidance in other areas. An objective risk based approach was integrated in the overall assessment process making it adaptable to any Covered Entity or Business Approach.

Q: Can you explain why there is no such thing as “HIPAA certified”?
A: Unlike other compliance standards such as ISO and SOX, HIPAA has not yet implemented a single audit standard. The industry relies on individuals and organizations who possess background in Information Technology, Health Care, and HIPAA to reasonably guide Covered Entities and Business Associates through the compliance process.

One of the main reasons that HIPAA has not implemented a single audit standard is due to the fact that one set of regulations governs all health care entities and their business partners. In other words, unlike PCI, HIPAA does not have a subset of requirements in place, based on the size of the organization. HIPAA, in its original and current state, was designed to be a flexible, scalable, and vendor neutral architecture for compliance.

Q: How many audited components go with each standard/citation ?
A: Based on the size and type of organization, we have adopted the following framework:

Defined Scope of HIPAA Compliance

Defined Scope of HIPAA Compliance

Still have other HIPAA-related questions? For more HIPAA hosting resources, see our HIPAA FAQ and HIPAA Glossary of Terms.


Joe Dylewski of ATMP Group

Joe Dylewski, President, ATMP Group

Joseph Dylewski is a twenty-five year Information Technology Professional veteran, a Certified HIPAA Professional (CHP), and a Certified HIPAA Security Specialist (CHSS) with ten years spent exclusively in the Healthcare Industry. In addition to holding positions as a Project Manager and Director of Information Technology, Joseph has also served as a Healthcare IT Services Practices Director and Account Manager with a proven track-record of successfully delivering end-to-end IT application and infrastructure project services. Joseph also currently serves as an Assistant Professor at Madonna University.

TAGGED:HIPAA compliance
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

a woman walking on the hallway
6 Easy Healthcare Ways to Sit Less and Move More Every Day
Health
September 9, 2025
Clinical Expertise
Healthcare at a Crossroads: Why Leadership Matters More Than Ever
Global Healthcare
September 9, 2025
travel nurse in north carolina
Balancing Speed and Scope: Choosing the Nursing Degree That Fits Your Goals
Nursing
September 1, 2025
intimacy
How to Keep Intimacy Comfortable as You Age
Relationship and Lifestyle Senior Care
September 1, 2025

You Might also Like

eHealthPolicy & Law

4 Important Steps In Order To Ensure HIPAA Compliance

November 9, 2018
eHealthMedical RecordsUncategorized

How HIPAA Applies to Medical Marijuana Businesses and Patients

July 8, 2020
senior healthcare benefits
Uncategorized

Diagnosing Patient Dissatisfaction: 5 Top Causes

September 10, 2021

Filtering versus Overload : Information and Content in The Digital Age

July 25, 2011
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?