HIPAA Requirements

§ 164.308 Administrative safeguards.

A covered entity or business associate must, in accordance with § 164.306:

1. Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.
2. Implementation specifications
3. Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. We conduct quarterly analyses and testing of the security and accuracy of the web application and APIs. So far, we have conducted one risk analysis that described the 1upHealth platform and testing efforts.
4. Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a). Our team is continuously looking for ways to improve our security practices. If our risk analyses reveal potential vulnerabilities, 1upHealth’s technology team makes the necessary changes to reduce risks. Our team members use GitHub, a software versioning and source code management system, to track bug reports and respond to issues.
5. Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate. All of our team members receive HIPAA training, and they closely follow HIPAA Security and Privacy rules. If any of our members fail to comply, their administrative rights are taken away and administrative accounts are suspended until they re-review the relevant HIPAA training documents.
6. Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. We use Amazon Web Services (AWS) and Linode for data storage and hosting. AWS and Linode are both built to support HIPAA compliance, as described in their documentation, and include powerful auditing and logging capabilities. Additionally, every object in our database is timestamped with created and updated values that enable our team to track changes.
7. Assigned security responsibility. Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate. Ricky Sahu is 1upHealth’s security official responsible for the development and implementation of the policies and procedures required by HIPAA.
8. Workforce security. Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.
9. Implementation specifications
10. Authorization and/or supervision (Addressable). Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. Qualified members of the team go through am onboarding process involving HIPAA training. With successful completion of the training, members receive administrative access to the web application, granted (ii). All activity by administrative users is tracked in the same way that patient and provider user activity is tracked.
11. Workforce clearance procedure (Addressable). Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate. Only 1upHealth administrators with patient or provider facing responsibilities have immediate access to patient health information. Administrative users are distinguished based on their role, so this type of delineation is simple. Technology team members who develop the web applications and APIs may be granted access to our administrative interface to ensure the application is functioning properly on production servers.
12. Termination procedures (Addressable). Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section. Our administrative members have the necessary power to grant or terminate access to patient health information through our administrative interface.
13. Information access management. Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.
14. Implementation Specifications
15. Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Not applicable. 1upHealth is not a clearinghouse.
16. Access authorization (Addressable). Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism. Qualified members are given accounts only after completing HIPAA training, and they access patient health information through our administrative interface.
17. Access establishment and modification (Addressable). Implement policies and procedures that, based upon the covered entity’s or the business associate’s access authorization policies, establish, document, review, and modify a user’s right of access to a workstation, transaction, program, or process. This is implemented through the paragraph above
18. Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management).
19. Implementation specifications
20. Security reminders (Addressable). Periodic security updates. We have a recurring calendar event for seasonal risk analyses and security update. Additionally, we constantly evaluate our security practices.
21. Protection from malicious software (Addressable). Procedures for guarding against, detecting, and reporting malicious software. AWS and Linode implement the necessary precautions to detect malicious software. Our team members protect their workstations with operating system and software security updates.
22. Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies. Any user’s electronic footprint regarding activity touching 1upHealth patient data is recorded in logs.
23. Password management (Addressable). Procedures for creating, changing, and safeguarding passwords.All passwords are hashed, salted, and encrypted. Any user (patient, provider, or admin) has the ability to change or reset his or her password, but can never see another user’s password
24. Security incident procedures. Implement policies and procedures to address security incidents.
25. Implementation specification
26. Response and reporting (Required). Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomesAll security incidents are identified and reported to our security officer. The security officer takes the necessary precautions to mitigate the incident and notifies the parties involved in the incident. These incidents are documented internally and available upon request.
27. Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.
28. Implementation specifications
29. Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.Data backup is accomplished through AWS. 1upHealth pushes backs up our database periodically and AWS allows us to retrieve copies of documents stored in its servers.
30. Disaster recovery plan (Required). Establish (and implement as needed) procedures to restore any loss of data. We use AWS Simple Storage Service (S3) for file storage. Scheduled processes automatic backup production data into S3. These services store backups for a “user-defined period”
31. Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode. In case of an emergency (i.e. data breach or data loss), AWS and Linode provide the necessary tools to retrieve information, block incoming traffic to our servers, and continue the use of 1upHealth web applications and APIs in a controlled manner.
32. Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans. We do not have specific testing and revision procedures to test emergency scenarios. However, our codebase includes over hundreds of unit and integration tests that are run before every deployment to ensure application health and security.
33. Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components. The security of files stored in S3 and unique user identifiers stored in our production databases are of utmost importance. AWS (S3 & EC2) and Linode (Server) services we utilize to store the sensitive data provide the necessary tools to prevent data loss and store data securely.
34. Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity’s or business associate’s security policies and procedures meet the requirements of this subpart.
35. Our team evaluates our security practices on a regular basis. We analyzed potential risks and vulnerabilities of our services continuously and have started producing quarterly risk analysis reports. In the case that a report reveals a vulnerability, necessary precautions will be taken to reduce exposure to the given risk.