Axxera Inc

Health Information Privacy - HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.1 To fulfill this requirement, HHS published what are commonly known as the HIPAA privacy rule and the HIPAA. The Privacy Rule, orStandards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “electronic protected health information” (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.

Axxera HIPAA Healthcare Compliance Services

Axxera offers a full breadth of services to help healthcare organizations address HIPAA compliance Security Standards. We have extensive experience partnering with healthcare providers and we can help you improve your security and compliance posture while reducing costs. As described below, our Enterprise Security Services and Professional Services align directly with many components of the HIPAA Security Standards.

HIPAA Compliancy

Administrative HIPAA Compliancy
Standard	Summary of Requirements	Solutions
Security Management Process	Implement policies and procedures to prevent, detect, contain and correct security violations.
	Specifications include:	Axxera Security Consulting team aligned with HIPAA requirements can conduct the required Security Assessment (SA) and recommend appropriate security measures and controls.
	Security Assessment (SA)	Axxera Security Monitoring ( MSSP ) and SIEM On-Demand Services or SIEM Product which can be deployed at security concious customers site can facilitate the review of system activity such as logs and access reports (AR). Management and tracking of security incidents from identification to tickets closure is also provided via the Axxera Portal / Console
	Security / Risk Management / ITIL based activity Review	SIEM Product Managed Firewall Managed Intrusion Prevention and Detection Security Monitoring SIEM On-Demand
Workforce Security / Information Management	Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information (EPHI) and to prevent those workforce members who do not have access from obtaining access to electronic protected health information.
Workforce Security / Information Management	Specifications include:	Axxera Consulting team can help you develop appropriate policies and procedures to secure EPHI. Axxera Secure consulting can also review existing access control policies and procedures to identify any flaws and recommend improvements in regards to security and HIPAA requirements
Security Awareness and Training	Implement a security awareness and training program for all members of its workforce including management.	Axxera works with 3rd parties and provide onsite
Security Incident Procedures	Implement policies and procedures to address security incidents.
	Specifications include:	Axxera SIEM, Security Monitoring and SIM On-Demand Service identify and provide first line response to security incidents via Ticketing system. Which provide unlimited remote incident response support for MSSP services or train SOC to handle and address Security incidents, which are addressed via Console and viewed via Portal, incidents are associated with tickets and are fully documented from identification to closure for tracking and audit purposes.
	Response and reporting	Axxera Security Consulting can also help you develop HIPAA-compliant procedures for responding to incidents and reporting them. Axxera can also review your existing incident response procedures for compliance with HIPAA requirements and industry best practices via ITIL based Incident response system.
		Axxera CI SIEM Product ( Client site )
Contingency Plan	Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems that contain EPHI.
	Specifications include:	Axxera's Security Consulting can help you develop and review procedures for business continuity and disaster recovery in accordance with HIPAA requirements and industry best practices.
	Data backup plan	Security Consulting
	Disaster recovery plan
	Emergency mode operation plan
	Testing and revision procedures
	Applications and data criticality analysis
On Going Evaluation	Perform a periodic technical and non-technical evaluation that establishes the extent to which an entity’s security policies and procedures meet the above administrative safeguard requirements.	Axxera Security Consulting team can perform periodic evaluations of your security policies and procedures to determine the extent to which they comply with HIPAA administrative safeguard requirements.
On Going Evaluation		Security Consulting

Technical HIPPA Compliancy
Standard	Summary of Requirements	Solutions
Access Control	Implement technical policies and procedures for electronic information systems that maintain EPHI to allow access only to those persons or software programs that have been granted access rights.
	Specifications include:	Axxera SIEM Product, Security Monitoring and SIM On-Demand services can monitor the logs of information systems such as servers or applications that maintain EPHI to detect unauthorized access.
	User ID	Axxera Security Consulting team can help you develop appropriate technical policies and procedures to control the access of staff and applications to EPHI. We can also review your existing technical policies and procedures for access control to identify areas of weakness and make recommendations for improvement.
	Emergency access procedure	SIEM Product ( Customer Onsite )
	Automatic logoff
	Encryption and decryption
Audit Controls	Implement hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use EPHI.	Axxera can manage and monitor access controls via ITIL based Ticketing / Incident Management system. Also can deploy the SIEM product and integrate with 3rd party security tools like (Anti-virus, Malware detection etc)
		Axxera SIEM Product ( Customer onsite ) Security Monitoring, Log Retention and SIM On-Demand services facilitate the recording and examination of system activity such as logs and access reports. Axxera Hosted Intrusion Prevention/Detection services can be used to provide active response to critical systems. Management and tracking of security incidents from identification to full closure is also provided via the Axxera Ticketing System, Console ( SOC ) and Portal.
		SIEM Product (Customer Onsite) Security Monitoring Log Retention SIEM On-Demand Host Intrusion Prevention (HIPS) Security Consulting
Transmission Security	Implement technical security mechanisms to guard against unauthorized access to EPHI that is being transmitted over an electronic communications network.
	Security measures to ensure that EPHI is not improperly modified; and
	Mechanisms to encrypt EPHI	Once determined,Axxera can provide protection for EPHI in transit that includes Managed Firewall & VPN services, Encrypted Email services, and Security Monitoring services to provide assurance for data at rest. Management and reporting on transmission security is also provided via the Axxera CI Ticketing system, Console, Portal.
	The appropriate control should be determined through a risk analysis to ensure that EPHI is protected in a manner commensurate with the associated risk when it is transmitted from one place to another.	Email Encryption SIEM Product ( Customer Onsite )

HIPAA

Join Our Community