What is HIPAA?
HIPAA is the Health Insurance Portability and Accountability Act (HIPAA). Congress originally passed the Act in August of 1996. It is intended to combat health care fraud, lower costs of providing health care and allow better access to health insurance.
Who must comply with HIPAA?
All covered entities who store patient data electronically must comply with HIPAA. The federal government has created three classes of entities who must comply: (1) Health care providers who conduct certain transactions in electronic form (i.e. doctors and doctor's offices), (2) health care clearinghouses and (3) health plans.
Are NextMed Technologies and the RECS software HIPAA compliant?
Yes.
There are a number of laws that collectively make up the HIPAA legislation. These rules were originally signed into effect on August 21st, 1996, but they have been amended numerous times in the dozen years since their inception. Despite years of adaptation and change, there are still two primary sections to the HIPAA laws: the Privacy Rule and the Security Rule.
The HIPAA Privacy Rule is intended to set boundaries on the use and release of health records. It provides guidelines on appropriate safeguards for health care providers and Business Associates, and holds violators accountable if they violate privacy rights.
The HIPAA Security Rule requires that Covered Entities and Business Associates define electronic Protected Health Information (ePHI) within its own organization and ensure the confidentiality and integrity of any ePHI created, received or maintained by the organization as well as to protect against any reasonably anticipated threats to the security or integrity of ePHI.
NextMed Technologies provides HIPAA protection across the board - we are in HIPAA compliance. Your patients' information is safe.
Encryption of data during transmission: All data to and from NextMed servers are secured using 128-bit SSL encryption.
Backup on servers: NextMed meets the highest standards for backup and disaster recovery, including:
- All databases are mirrored at the transaction level on redundant database servers allowing for immediate failover
- Full database backups are performed every several hours . All backups are also secured using 448-bit encryption at a secured remote off-site location.
- The NextMed data center is SAS-70 certified (Type II Audit completed)
- NextMed's network and electrical power supply are guaranteed for 100% uptime.
Physical Security: Physical server security is maintained by a professional data-protection corporation. Safeguards include:
- 24-hour physical security monitors all cameras, door positions, and access areas.
- Redundant off-site monitoring of all security systems
- Building is rated to withstand hurricane force winds
- Ballistics-proof walls, doors, and windows
- Steel structural supports and concrete walls
- Double man trap entry
- Data Center Facility is uniquely connected to two power grids.
- Cameras digitally record all movement in and around the Data Center Facilty
Note: Although many companies purport to certify organizations as "HIPAA Compliant", there is no common standard for a "Compliance Certificate". Companies are required to independently demonstrate that their organization addresses all of the current laws and regulations in effect (collectively called "HIPAA"). For more information about HIPAA and HIPAA compliance, contact your legal counsel or refer to the Office for Civil Rights at the U.S. Department of Health and Human Services: http://www.hhs.gov/ocr/hipaa/. For more discussion of how we protect HIPAA information, please contact us.