Government & Compliance
HIPAA for public agencies: who is covered and what it requires
When the health privacy rules apply to government entities and what the security rule expects of their systems.
The Health Insurance Portability and Accountability Act's privacy and security rules apply to covered entities and their business associates. Many public agencies are covered in whole or in part, and many vendors become business associates without realizing it.
Who is covered
Health care providers that transmit health information electronically, health plans, and health care clearinghouses. County health departments, public hospitals, behavioral health programs, emergency medical services that bill, and employee health plans are frequently covered. Agencies with both covered and non-covered functions can designate themselves as hybrid entities and apply the rules to the covered components.
Business associates
Vendors that create, receive, maintain, or transmit protected health information on behalf of a covered entity. Cloud providers, software vendors, and consultants with access to the data qualify. A written business associate agreement is required, and business associates are directly liable for security rule compliance.
The security rule
Requires administrative, physical, and technical safeguards, including risk analysis, access controls, audit controls, integrity controls, transmission security, workforce training, contingency planning, and periodic evaluation. It is flexible about how, and specific about what must be addressed.
What systems need
Access controls tied to role, audit logging of access to records, encryption in transit and typically at rest, backup and recovery, and secure development and configuration. Test environments must not contain real protected health information.
Common findings
Missing or outdated risk analysis, missing business associate agreements, inadequate access review, unencrypted devices, and lack of audit log review.
Relationship to other rules
Substance use treatment records have additional federal confidentiality protections. State laws may be stricter. Public records exemptions typically protect health information.
What to expect from vendors
Expect a business associate agreement before access to protected health information. Have a security program that satisfies the security rule. Use synthetic data for development.