Key Factors in Determining Your HIPAA Compliance

July 30, 2018 by Navin Balakrishnaraja

Healthcare organizations confront many issues as it applies HIPAA compliance and of them all cost tends to be the most challenging. This trend extends beyond just small organizations with limited security budgets but also to large acute care facilities. Lack of budget is a plague that affects risk and compliance officers at healthcare organizations of all sizes – small, medium and large. 

The Cost of HIPAA Non-Compliance 

The cost of non-compliance is high. From 2011 to 2017, HIPAA violation fines have ranged from $2.5 million to $32.5 million dollars. In addition civil action lawsuits can also be filed against an agency or provider for data breached on the ground of negligence.  

The Cost of HIPAA Compliance

While the price of HIPAA compliance is dependent upon the several factors of the organization there are several variables that an organization or provider can assess as a starting point for determining their cost of overall compliance.  

  • The type of organization:
    • Are you a hospital, business associate, health information exchange (HIE), healthcare clearinghouse, or another type of healthcare provider?
    • Each will have varying amounts of protected health information (PHI) and risk levels.  
  • The size of the organization:  
    • Typically, the larger the organization, the more vulnerabilities it has. More workforce members, programs, processes, computers, PHI, and departments increase the overall complexity of what needs to be managed and protected, and ultimately the cost involved.  
  • The organization’s IT and compliance culture:  
    • If data security is a top priority, a cybersecurity program is more than likely in place. If there has been hesitancy in dedicating budget, and therefore a robust security program, the organization will have more distance to make up for in becoming HIPAA compliant.  
  • The organization’s information technology and information security environments:  
    • The type of medical devices, the brand of computers, the kind of firewalls, the model of backend servers, and whether cybersecurity was a consideration when purchasing, implementing and maintaining these devices will impact compliance costs.  
      • If security was well thought-out, the costs to comply with HIPAA at this point will be lower.  
      • If security was not well thought- out, the costs to become compliant with HIPAA will be greater.  
  • The role, responsibilities, and size of the organization’s dedicated HIPAA workforce:  
    • Without a dedicated HIPAA team, you might not know how far you are from closing the HIPAA gap. Even with a dedicated HIPAA team, organizations usually require additional outside consulting services to help them meet their HIPAA requirements.