HIPAA Security Rule – Demystified

Yigal Rechtman, CPA, CFE, CITP, CISM, and Kenneth Rashbaum, JD

In BriefFines under the Health Insurance Portability and Accountability Act (HIPAA) are formulaic, with little room for discretion, so a small medical office can suffer similar consequences as a large hospital if a breach has occurred. Thus, the degree of pre-breach preparation is pivotal. This article dispels the myths surrounding HIPAA compliance preparation so that advisors can prepare businesses for a possible data breach in a fairly painless, pragmatic manner. It will explore the significance of the interaction between the worlds of HIPAA compliance and practical policies and procedures (the purview of management and supported by an entity's legal advisors), which are often heavy with technical detail, and the risks associated with information systems and information technology (supported by internal IT professionals and third-party consultants). The good news is that, with HIPAA, an ounce of preservation can save a pound of gold, and a deliberate effort can be efficient, improve compliance, avoid penalties, and even contribute to greater business success.