As a HIPAA deadline approaches, survey finds most are ready, although issues remain

Healthcare and related organizations have just over two weeks to meet new rules for protecting patient data or face possible fines, criminal penalties and negative publicity. While many IT professionals involved with Health Insurance Portability and Accountability Act compliance say they will meet the April 20 deadline, some warn that determining compliance is anything but clear-cut.

"It's not like after April 20 we can breathe a big sigh of relief and forget about HIPAA compliance. That's when we have to start proving ourselves," says Doug Torre, director of networking and technical services at Catholic Health System, an integrated healthcare delivery network in and around Buffalo, N.Y.

An AMR Research survey found that among the 225 companies that participated, some $3.7 billion will be spent this year on HIPAA compliance (one-third of the companies will fund it through general IT budgets). In another study, though, from healthcare information management firm Phoenix Health Systems, one-quarter of 318 organizations surveyed don't expect to meet the deadline for compliance with the HIPAA Security Rule.

The Security Rule specifications, which have been available for about two years, call for administrative, technical and physical safeguards designed to protect patient data.

The possible civil penalty for being in noncompliance is $100 per violation, not to exceed $25,000 per year for identical violations. Criminal penalties range from $50,000 to $250,000 and one to 10 years in prison.

Administrative safeguards account for more than half of the provisions. They involve a risk analysis, assigning responsibility to an information security officer, training employees and documenting security procedures such as data backup and disaster recovery. Physical safeguards include means for workstation disposal, media reuse and securing areas where electronic protected health information (EPHI) may be stored. The technical safeguards, which many in IT focus on, spell out system authentication, encryption and decryption of data, and transmission of EPHI within and outside an organization.

Of the organizations that responded to Phoenix Health's survey, the top reason cited for failing to comply is "achieving successful integration of new systems, policies and procedures across the enterprise."

Integrating these systems and putting in new systems where needed to mitigate risk is a big undertaking, says Larry Rapisarda, CTO for Harvard-Pilgrim Healthcare in Wellesley, Mass., which put security measures in place well before HIPAA was passed in 1996.

Rapisarda's team addressed the administrative safeguards first.

"We set up a compliance team that included information security officers, legal, project managers," he says. "From a security perspective, we have put a lot of attention to risk analysis and identifying risk. Another big component was roles-based security."

Rapisarda says that while the organization will be compliant on April 20, it still is looking for software that will bulk up its technical safeguards.