By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    benefits of using protein powder to build muscles
    Protein Powder for Muscle Mass: Everything You Need to Know
    December 12, 2021
    changes brought on by blockchain in healthcare
    Technology In The Healthcare Industry
    March 28, 2022
    What Does Core Body Temperature Say About Health?
    August 17, 2022
    Latest News
    Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
    May 16, 2025
    Learn how to Renew your Medical Card in West Virginia
    May 16, 2025
    Choosing the Right Supplement Manufacturer for Your Brand
    May 1, 2025
    Engineering Temporary Hospitals for Extreme Weather
    April 24, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    FDA Approves Diabetes Pill
    May 2, 2011
    Patient Gets Drunk on Hand Sanitizer
    June 20, 2011
    Cultivating Health Improvement
    July 20, 2011
    Latest News
    Building Smarter Care Teams: Aligning Roles, Structure, and Clinical Expertise
    May 18, 2025
    The Critical Role of Healthcare in Personal Injury Recovery: A Comprehensive Guide for Victims
    May 14, 2025
    The Backbone of Successful Trials: Clinical Data Management
    April 28, 2025
    Advancing Your Healthcare Career through Education and Specialization
    April 16, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist
Uncategorized

HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist

onlinetech
Last updated: April 4, 2012 8:33 am
onlinetech
Share
7 Min Read
Defined Scope of HIPAA Compliance
SHARE

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

More Read

Patient Provider Communication : Using IT to Facilitate Information Therapy
Algorithms in Medicine
Is Age Just a Number, or a Challenge to Widespread HIT Adoption?
Tips to Create a Plans To Stay the Course of Sobriety
3 Fad Diets that Work and 3 that Don’t

Q: Is it possible to be HIPAA compliant without an HROC (HIPAA Report on Compliance – or without a HIPAA risk assessment?
A: No. 45 CFR 164.308(a)(1)(ii)(a) is a required Implementation Specification under the HIPAA Security Rule, Security Management Process Standard. An HROC is not a required document. However, organizations must be able to produce evidence that they have completed an assessment and resolved any deficiencies or vulnerabilities. An HROC demonstrates the auditable steps that an organization took in that process.

Q: Can you explain where the HITECH act specifies antivirus is “required”?
A: “Protection from Malicious Software,” 45 CFR 164.308(a)(5)(ii)(b), is an Addressable Implementation specification under the HIPAA Security Rule, Security Awareness and Training Standard. Addressable does not equate to Optional.

“Protection from Malicious Software” is one of the key HIPAA Implementation Specifications as it speaks to the Confidentiality, Integrity, and Availability of Electronic Protected Health Information.

Q: What about offsite backup and/or disaster recovery?
A: The ability to store a recoverable set of Electronic Protected Health Information (ePHI), and test that process, are critical components that are governed by multiple HIPAA Implementation Specifications and Standards:

Contingency Plan Standard, 45 CFR 164.308(a)(7)(i)

  • Data Backup Plan (Required) – 45 CFR 164.308(a)(7)(ii)(A)
  • Disaster Recovery Plan (Required) – 45 CFR 164.308(a)(7)(ii)(B)
  • Emergency Mode Operation Plan (Required) – 45 CFR 164.308(a)(7)(ii)(C)
  • Testing and Revision Procedures (Addressable) – 45 CFR 164.308(a)(7)(ii)(D)

Device and Media Controls Standard, 45 CFR 164.310(d)(1)

  • Data Backup and Storage (Addressable) – 45 CFR 164.310(d)(2)(iv)

In addition to the Standards and Implementation Specifications listed, there are many others that factor into the procedures and safeguards that are implemented in the Backup and Recovery Process.

Q: What about a firewall?
A: A firewall can be considered in multiple Standards and Implementation Specifications across the HIPAA Administrative, Physical, and Technical Safeguards. Remember that the purpose of a firewall is to restrict access to networks through a selective process of blocking inbound traffic.  In some cases, firewalls or content filters will also block outbound traffic.

While HIPAA does not call for the direct implementation of firewall technology, in most cases, it is the most reasonable and practical approach to addressing the requirements laid out in the HIPAA regulations.

Q: What methodology did you use to come up with the 136 audited components for ATMP’s independent HIPAA audit?
A: In the development of the assessment methodology, a combination of technical, health care, and HIPAA knowledge was used. HIPAA is very clear in some areas and provides guidance in other areas. An objective risk based approach was integrated in the overall assessment process making it adaptable to any Covered Entity or Business Approach.

Q: Can you explain why there is no such thing as “HIPAA certified”?
A: Unlike other compliance standards such as ISO and SOX, HIPAA has not yet implemented a single audit standard. The industry relies on individuals and organizations who possess background in Information Technology, Health Care, and HIPAA to reasonably guide Covered Entities and Business Associates through the compliance process.

One of the main reasons that HIPAA has not implemented a single audit standard is due to the fact that one set of regulations governs all health care entities and their business partners. In other words, unlike PCI, HIPAA does not have a subset of requirements in place, based on the size of the organization. HIPAA, in its original and current state, was designed to be a flexible, scalable, and vendor neutral architecture for compliance.

Q: How many audited components go with each standard/citation ?
A: Based on the size and type of organization, we have adopted the following framework:

Defined Scope of HIPAA Compliance

Defined Scope of HIPAA Compliance

Still have other HIPAA-related questions? For more HIPAA hosting resources, see our HIPAA FAQ and HIPAA Glossary of Terms.


Joe Dylewski of ATMP Group

Joe Dylewski, President, ATMP Group

Joseph Dylewski is a twenty-five year Information Technology Professional veteran, a Certified HIPAA Professional (CHP), and a Certified HIPAA Security Specialist (CHSS) with ten years spent exclusively in the Healthcare Industry. In addition to holding positions as a Project Manager and Director of Information Technology, Joseph has also served as a Healthcare IT Services Practices Director and Account Manager with a proven track-record of successfully delivering end-to-end IT application and infrastructure project services. Joseph also currently serves as an Assistant Professor at Madonna University.

TAGGED:HIPAA compliance
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Do You Grind Your Teeth at Night? Here’s How Night Guards and TMJ Treatments Can Help
Do You Grind Your Teeth at Night? Here’s How Night Guards and TMJ Treatments Can Help
Dental health
May 21, 2025
The Secret To A Confident Smile: Top Tips For Better Teeth
The Secret To A Confident Smile: Top Tips For Better Teeth
Dental health
May 21, 2025
Clinical Expertise
Building Smarter Care Teams: Aligning Roles, Structure, and Clinical Expertise
Health care
May 18, 2025
Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
Health
May 15, 2025

You Might also Like

senior healthcare benefits
Uncategorized

Diagnosing Patient Dissatisfaction: 5 Top Causes

September 10, 2021
Business Associates HIPAA Violations
Technology

The Business Associate’s Role in HIPAA Violations

November 4, 2011
protect patients from identity theft
Medical RecordsNewsTechnologyUncategorized

How Hospitals Can Protect Patients From Identity Theft

October 21, 2020
HIPAA and Health IT Incentives
Medical RecordsTechnology

HIPAA & Health IT: $872 Million in Incentives

October 15, 2011
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?