HIPAA COMPLIANCE
HIPAA compliance in Houston, built on a real risk analysis
DESSS is a Houston-based IT consulting firm that helps healthcare providers, health plans, and the IT, billing, and software vendors that serve them across Houston and Texas meet HIPAA requirements. We run the security risk analysis, implement the technical safeguards, write the policies, and prepare your team to respond to incidents.
The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities and their business associates to protect the privacy and security of protected health information. The Security Rule focuses on electronic PHI and requires an accurate and thorough risk analysis.
For Houston and Texas organizations, the Texas Medical Records Privacy Act (Chapter 181 of the Health and Safety Code) applies to a broader group of organizations than HIPAA, and the state breach notification law adds its own deadlines. We account for both.
Who must comply
Covered entities (health plans, clearinghouses and providers that bill electronically) and business associates that handle PHI on their behalf.
No official certification
HHS does not certify HIPAA compliance. Compliance is shown through a documented risk analysis, safeguards, policies and records.
Who enforces it
The HHS Office for Civil Rights (OCR) investigates complaints and breaches, and has made risk analysis a recent enforcement focus.
Business associates
Vendors that create, receive, maintain or transmit PHI must sign a business associate agreement and meet the Security Rule directly.
HIPAA compliance consulting for Houston healthcare organizations and vendors
Houston medical practices, clinics, billing companies, and healthcare software vendors handle ePHI every day and are subject to both HIPAA and Texas law. DESSS works with your team to map where ePHI lives, complete the Security Rule risk analysis, and put safeguards in place that you can show to a regulator or a covered-entity customer.
- Houston-based team for ePHI mapping sessions and workforce training
- Remote delivery across Texas and the United States
- HIPAA and Texas Chapter 181 requirements handled together
WHAT HIPAA REQUIRES
The HIPAA rules that shape your program
HIPAA is enforced through several rules. Most security work is driven by the Security Rule, while the Privacy and Breach Notification Rules set how PHI is used and what happens after an incident.
Security Rule
Administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of electronic PHI.
Privacy Rule
Rules on how PHI may be used and disclosed, the minimum necessary standard, and patients’ rights to access their records.
Breach Notification Rule
Notification of individuals, HHS and in some cases the media after a breach of unsecured PHI.
Risk analysis
An accurate and thorough assessment of risks and vulnerabilities to ePHI, the foundation the Security Rule builds on.
Business associate agreements
Written contracts that bind vendors handling PHI to protect it and report incidents.
Policies and documentation
Written policies and procedures, kept for six years, that show how each requirement is met.
SECURITY RULE SAFEGUARDS
The HIPAA Security Rule safeguards
Each safeguard includes required implementation specifications and addressable ones. Addressable does not mean optional: you implement it, an equivalent measure, or document why neither is reasonable.
Administrative safeguards
What are administrative safeguards? Administrative safeguards are the policies and processes that manage security: risk analysis and risk management, a designated security official, workforce training and sanctions, access management, contingency planning and periodic evaluation.
Our security awareness training covers the workforce training requirement.
–Security risk analysis
–Risk management plan
–Security official and workforce training
–Contingency and backup plans
–Periodic evaluation
Physical safeguards
What are physical safeguards? Physical safeguards protect facilities and devices that hold ePHI: facility access controls, workstation use and security, and controls for disposal and reuse of devices and media.
–Facility access controls
–Workstation use and security
–Device and media disposal
–Media reuse and accountability
Technical safeguards
What are technical safeguards? Technical safeguards are the technology controls around ePHI: unique user IDs and access control, audit controls, integrity protection, person or entity authentication, and transmission security.
We implement these with Microsoft Entra Conditional Access and MFA, encryption, and logging.
–Unique user IDs and emergency access
–Audit controls and log review
–Integrity controls
–MFA and authentication
–Encryption in transit
Breach notification readiness
What does the Breach Notification Rule require? After a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. HHS must be notified, and the media too when more than 500 residents of a state or jurisdiction are affected.
Texas law also requires notice to the Texas Attorney General within 30 days when a breach affects 250 or more Texans.
–Incident response plan
–Four-factor breach risk assessment
–Notification templates
–Tabletop exercises
Business associate obligations
What do business associates have to do? Since the HITECH Act, business associates are directly liable for meeting the Security Rule. They must sign business associate agreements, safeguard PHI, and report breaches to the covered entity.
Our vendor risk management service helps covered entities track their business associates.
–Signed business associate agreements
–Own Security Rule risk analysis
–Subcontractor agreements
–Breach reporting to the covered entity
HOW WE WORK
How a HIPAA compliance engagement runs
Six steps take you from an ePHI inventory to documented safeguards and a tested breach response.
STEP 01
Map ePHI
Identify every system, device, vendor and workflow that creates, receives, stores or transmits ePHI.
STEP 02
Risk analysis
Assess threats and vulnerabilities to ePHI, rate likelihood and impact, and document the results.
STEP 03
Risk management plan
Prioritize the risks and plan the safeguards that reduce them to a reasonable level.
STEP 04
Implement safeguards
Put administrative, physical and technical safeguards in place, from MFA and encryption to backups.
STEP 05
Policies and training
Write HIPAA security policies and procedures, and train the workforce on them.
STEP 06
Breach readiness
Build and test the incident response and notification process, and review business associate agreements.
SERVICES
DESSS services that support HIPAA
Protecting ePHI draws on risk, identity, data protection and response work. These services deliver the safeguards HIPAA expects.
WHY DESSS
Why work with DESSS on HIPAA
Healthcare organizations need a partner who can write the policy and configure the system behind it.
Safeguards implemented, not just documented
Our engineers configure MFA, encryption, logging and backups, so your risk management plan turns into working controls.
Healthcare and business associates
We work with providers and with the IT, billing and software vendors that handle PHI for them.
Houston and Texas requirements included
We account for the Texas Medical Records Privacy Act and Texas breach notification deadlines alongside HIPAA.
HIPAA compliance means meeting the Privacy, Security and Breach Notification Rules that protect health information. For IT and security, it centers on the Security Rule’s administrative, physical and technical safeguards for electronic PHI.
No. HHS does not certify organizations as HIPAA compliant. You demonstrate compliance through a documented risk analysis, implemented safeguards, written policies, training records and business associate agreements.
It is a required, accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold. It should be reviewed regularly and when your environment changes.
Yes. Business associates that create, receive, maintain or transmit PHI must sign a business associate agreement and are directly liable for meeting the Security Rule.
Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must be reported to HHS within the same period, and smaller breaches are reported to HHS annually.
An addressable specification is not optional. You must implement it if reasonable and appropriate, implement an equivalent alternative, or document why neither is reasonable for your organization.
Yes. The Texas Medical Records Privacy Act, Chapter 181 of the Texas Health and Safety Code, applies to a broader group of organizations than HIPAA, and Texas breach notification law sets its own deadlines.
Yes. DESSS is based in Houston and helps healthcare providers, health plans and business associates across Houston and Texas complete HIPAA risk analyses, implement safeguards and prepare for incidents.
If they create, receive, maintain or transmit PHI for a covered entity, yes. They are business associates, must sign a business associate agreement and are directly responsible for meeting the Security Rule.
HIPAA COMPLIANCE
Start your Houston HIPAA risk analysis
Book a call to scope your HIPAA security risk analysis and see where your ePHI safeguards stand today.
RELATED
Related Compliance and Security Pages
Other compliance frameworks we support, and the DESSS security services that produce the evidence auditors ask for.
RELATED
Related Compliance and Security Pages
Other compliance frameworks we support, and the DESSS security services that produce the evidence auditors ask for.