The rise in technology has paved the way for businesses to automate their processes, centralize their islands of information and keep track of every digital file on record. Long gone are the days of manual entry or physical bookkeeping. This shift, however, from the physical to the virtual world, has also enabled new types of threats to come forward. Including hackers, computer viruses, and malware. While not everything is vulnerable to this, sensitive information like health information is susceptible to this type of threat. Fortunately, that’s where HIPAA compliance steps in and ensures individuals are protected from any kind of virtual menace. To do so digitally from your ERP system Odoo HIPAA compliance module is a good fit for it.

What is HIPAA?

HIPAA stands for Health Insurance Portability and Accountability Act. Enacted in 1996 by US Federal law, HIPAA protects the privacy and security of an individual’s health information and provides the individual with rights over their health information. This act’s intent is to reform the healthcare industry by reducing costs, simplifying administrative processes and burdens, and improving the privacy and security of individuals’ health information.

Simply put, HIPAA is meant to protect your sensitive health information in this ecosystem as well as, regulate how it can be used or disclosed.

2 Types of Organizations that are regulated under HIPAA:

• Covered Entities

• • • Are the source of protected health information (PHI) and where it is first generated; they are the ones with the direct relation with the individuals whose PHI is being kept — ex: healthcare providers, health plans, healthcare cleaning houses

• Business Associates

• • • Covered entities must often share PHI with third parties such as medical billing, answering services, software companies, marketing companies, and insurance brokers – in order to perform their operations. Those third parties are referred to as business associates under HIPAA; they receive PHI from a covered entity or another business associate.
    • They are to sign a business associate contract and give it to covered entities who then keep this documentation

What is HIPAA Privacy?

HIPAA Privacy Involves protections for Personal Health Information (PHI) from a people standpoint as well as supporting individuals’ rights. Essentially, this is protection for employees, partners, and clients. Its two main objectives are to:

1. To protect the privacy and security of an individual’s PHI (ex: business associate contracts, policies and procedures, awareness training for staff, breach notification process, etc.)
2. To provide rights to individuals on their PHI (ex: patient rights forms and policies and procedures)

Complying with HIPAA Privacy

An organization must implement the following 3 components.

1. Compliance Officers: An organization must designate an individual to take responsibility for implementing and overseeing HIPAA Privacy compliance at the organization
2. Employee Training: An organization must train all of its workforces that has access to PHI on HIPAA awareness training and at a minimum of 2 years thereafter and when the regulations change
3. Formal Documents & Controls: An organization must implement formal documents and controls to protect PHI that the organization has access to or maintain. This includes formal policies and procedures, patient rights documents, business associate contracts, breach notifications, etc.

What is HIPAA Security?

HIPAA Security regulations are technology neutral and scalable which means every organization has flexibility in the technology they use to implement those safeguards as long as they meet the requirements. Involves protections for Electronic Personal Health Information (ePHI)  from an electronic or IT standpoint. Its two main objectives are:

1. To make sure that ePHI is not hacked, stolen, or misused (ex: protections involve firewalls, antivirus, strong passwords, security logging, building security, screensaver locks, encryption, media controls, standards for destruction and disposal, etc.)
2. To make sure that ePHI is not destroyed and is available (ex: protections involve data backups both onsite and offsite, as well as antivirus, disaster recovery plan, etc.

Complying with HIPAA Security

An organization must implement the following 3 components:

1. Compliance Officers: An organization must designate an individual to take responsibility for implementing and overseeing HIPAA Security compliance at the organization
2. Validate & Fix: An organization must perform a risk assessment to validate their facilities, technology infrastructure and security measures against the HIPAA Security standards, identify any gaps or deficiencies, and correct them. They should perform this validation at least once a year thereafter.
3. Formal Documents & Controls: An organization must implement formal documents and controls to protect ePHI that the organization has access to or maintain. This includes formal policies and procedures and documents required and specified by the HIPAA Security standards.

Why Does HIPAA Compliance Matter?

For starters, many of HIPAA’s requirements are just best practices already implemented in other industries. HIPAA can be considered a common federal “minimum floor” for everyone to achieve. Now as for why, well – for a plethora of reasons:

• Morality: No one would their private health information be shared or distributed
• Financial Penalties: Penalties can reach up to $50,000 if HIPAA compliance is not followed in the healthcare industry
• Public Exposure (your company could be susceptible to loss of market share)
• Loss of Accreditation: no one would trust your company or want to do business with it if there was a risk or previous history of sensitive information leaks
• Litigation Damages: anyone can sue you for the distribution of their personal information, especially if it was not consensual
• Imprisonment: You run the risk of being put behind bars,
• And so much more

HIPAA Controls Implementation in Odoo

There are countless ways to make sure your Odoo ERP, or any business management software, is HIPAA Compliant. One of those ways, apart from going to an ERP partner for verification, is by implementing HIPAA controls in Odoo.

• Strong Password Generation

• A strong password should include a mix of lower-case and upper-case letters, numbers, and special numbers.
• A very strong password should include all kinds of characters and be at least 12 characters long.
• Every 3 months users need to change their password for security.

• Audit Logging

• PHI and ePHI data logs enable a separate audit-log table
• Every transaction related to PHI and ePHI data should log into an audit-log table
• All the objects related to PHI and ePHI information having the functionality to update the value of the fields should log into the chatter for tracking change log.

• Auto Logoff

• As a general practice, users should log off the system they are working on when their workstation is unattended.  However, there will be times when workers may not have the time, or will not remember, to log off a workstation.  Automatic logoff is an effective way to prevent unauthorized users from accessing EPHI on a workstation when it is left unattended for a period of time. 

• Advance Level Access Right Configuration for ePHI and PHI Data

• Security rule for the access PHI and ePHI data based on the access rights
• Restricted to downloading any PHI and ePHI data

Bista Solutions: Odoo HIPAA Compliance Partner

The Bista team has over 2 decades of ERP experience, with over 250 resources at your disposal. These include certified developers as well as functional and technical ERP and AI automation consultants. Furthermore, each member of our team is HIPAA certified. Our expertise stretches across ERP implementation, business analysis, AI automation, and digital transformation. Connect with our experts today to see how we can ensure your business is Odoo HIPAA compliant.