Covered Entities

 

To comply with the Health Insurance Portability and Accountability Act’s Security Rule, practices must continue to review, correct or modify and update security protections.

 

If you are a QPP Eligible Physician you are required to  

​

Conduct or review a security risk analysis in accordance with the requirements in 45 CFR 164.308(a)(1), including addressing the security (to include encryption) of ePHI data created or maintained by certified electronic health record technology (CEHRT) in accordance with requirements in 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the MIPS eligible clinician’s risk management process.

​

​

​

The security risk analysis requirement under the HIPAA Security Rule (45 CFR 164.308(a)(1)) must assess the potential risks and vulnerabilities to the confidentiality, availability, and integrity of all ePHI that an organization creates, receives, maintains, or transmits.

 

This includes ePHI in all forms of electronic media, such as hard drives, floppy disks, CDs, DVDs, smart cards or other storage devices, personal digital assistants, transmission media, or portable electronic media.

 

At a minimum, MIPS eligible clinicians should be able to show a plan for correcting or mitigating deficiencies and that steps are being taken to implement that plan.

​

​

In 2016 it was mentioned in a Comment: Some commenters believed that reporting the Protect Patient Health Information objective and measure is redundant and burdensome, as the security risk analysis and other privacy and security areas are already included under HIPAA requirements.
Response: Yes, we agree that a security risk analysis is included in the HIPAA rules. However, it is our experience that some EPs are not fulfilling this requirement under the EHR Incentive Programs. To reinforce its importance, we are including it as a requirement for MIPS eligible clinicians