HIPAA Compliance

Companies that operate within the FDA Regulated Business Sectors, including pharmaceuticals, medical devices, labs and life sciences, must have compliance agreements with their business associates to comply with the regulatory requirement of HIPAA (Health Insurance Portability/Accountability Act of 1996).  

Enforcement and monetary penalties for violating HIPAA have increased consistently over the last several years. The average total penalty incurred for HIPAA Violations in 2019 is reported to be greater than $1.2 Million.  

To comply with HIPAA requirements, an organization must have strict guidelines for the protection of a patient’s protected health Information (PHI) at all times. This includes PHI within the four walls of the organization and when shared with service providers that receive, transmit or store PHI on behalf of the organization. The service providers are referred to as “Business Associates” under HIPAA regulations. The responsibility of protecting PHI falls on the organization and so they must ensure that all business associates take reasonable actions to provide for the protection of PHI.  

HIPAA regulations explicitly list covered entities as companies subject to HIPAA laws. To ensure that these companies can demonstrate compliance with HIPAA regulations, they sign business associate agreements with each of their service providers, which outline provider responsibilities along with which provider security measures are currently implemented for compliance. If any of these companies do not have proper business associate agreements in place, then the company could be subjected to being directly liable for violations by their service providers due to their negligent acts. 

QMS and HIPAA 

The majority of the public perceives HIPAA to be applicable to only health care providers. However, most manufacturers in pharmaceutical, life sciences, laboratory, and medical device industries directly interact with HIPAA regulations, especially where companies have a complaint investigation process in place or where they are conducting clinical trials for testing product safety and efficacy. For medical device manufacturers, a QMS is critical to ensure that manufacturers of implanted or life-sustaining devices identify issues or complaints regarding the manufacture of devices and protect the PHIs associated with the device. 

Why is HIPAA important?

HIPAA is responsible for many important functions in the US healthcare system. One of the most important functions from the consumer's perspective is privacy and security of protected health information from cyber thieves.  

Criminals want access to health information. Using a patient's PHI, a criminal can gather enough demographic information from a patient to perform a phishing attack. A criminal can then use a patient's stolen identity to commit fraud by filing false claims or by applying for a credit card or loan using a patient's sensitive information. HIPAA will reduce the number of data breaches and make it more difficult for cyber criminals.  

HIPAA also gives consumers a "Right of Access" to their health records. Patients have the right to access their medical and personal health information and could request their provider to have the corrections made for accurate information.  

In addition, HIPAA provides consumers with protection against fraud and misrepresentation of the insurance they purchase. Patients can be assured that any claim submitted to the insurance company is treated honestly and ethically. Corrupt providers face strict penalties through civil fines or criminal prosecution.