HIPAA Compliance: Keeping Patient Information Safe

With the rise of mobile apps, paperless medical record transfer, online bill payments, and email services, healthcare providers are responding to patient demand and striving to make healthcare services more convenient. In order to provide these digital healthcare services, patient information must flow between different service delivery entities. Translation services are one example of this - healthcare providers and insurance companies have a legal obligation to provide language services when providing services, but they must also ensure that sensitive patient data is not compromised.

As early as 1996, the U.S. Department of Health and Human Services recognized that "advances in electronic technology may erode the privacy of health information" and began taking steps to protect personally identifiable health information. Ultimately, HIPAA (Health Insurance Portability and Accountability Act) came into being, and although the law contains many aspects, they can also be complicated.

In 2000, the Privacy Rule was enacted to establish standards for how protected health information (PHI) may be used and disseminated. This rule applies to all health plans, medical billing organizations, and healthcare providers (“covered entities”), particularly when information is transmitted electronically. Covered entities are often required to contract with third-party partners (“business partners”) to provide related digital services. While these business partners are also subject to the HIPAA Privacy Rule to a certain extent, the ultimate responsibility remains with the covered entity, which must ensure that it has a contract with its business partners that clearly states how PHI may be used or disclosed.

In 2003, the Security Rule was issued to set standards for "administrative, physical, and technical safeguards" designed to ensure the security of electronic PHI transmissions. The rule maintains flexibility so that covered entities can continue to expand their use of technology while ensuring efficiency and quality of care. Although the rule provides general terms for the processing of electronic PHI (e-PHI), the Security Rule leaves some uncertainty about how business partners should comply with these terms.

Protected entities must remain vigilant, take appropriate security measures, assess all potential risks, and limit physical and electronic access that could compromise the security of e-PHI. But how can we ensure that business partners (and the contractors they hire) are equally vigilant? Given the growing importance of cybersecurity, "trust but verify" should be the principle to follow.

How to ensure that information is safe in the hands of a third party?

Risk Analysis:

Consider possible gaps in the control or flow of electronic PHI. Who has access to this information? What potential risks and threats could lead to erroneous or unauthorized access?

Vulnerabilities in the translation process:

In order to meet language service compliance requirements, healthcare providers often need to translate patients' specific medical or insurance information. These files may contain names, contact information, social security numbers, dates of birth, etc., all of which can be directly linked to individuals. However, the translation process is often overlooked and becomes a potential source of security vulnerabilities.

If you work with an external service provider, you need to ask yourself the following questions:

• Are files sent via unsecured email where they could be hacked?
• Are your files encrypted or otherwise protected?
• How many vendors will have access to your files throughout the translation process?
• Is the PHI in the files de-identified, or is this information visible to all vendors who access the files?

By deeply analyzing these issues, you can ensure that sensitive patient information is properly protected throughout the translation process, minimizing any possible risks and ensuring compliance with privacy and security requirements set forth by HIPAA.

◀️：Three keys to unlock a smooth multilingual publishing process

▶️：Five questions to ask yourself before localizing your website