Some healthcare organizations have a HIPAA compliance program that needs updating. This one didn’t have one at all.
A large multispecialty physician group practice, operating as a management services organization representing more than 100 physicians, engaged Amplix to conduct its annual HIPAA Security Risk Assessment. What the assessment found wasn’t a program with gaps. It was the absence of a program entirely.
| Quick Answer Building a HIPAA compliance program from the ground up starts with a full risk assessment to identify what’s missing, followed by documented policies and procedures, a proper Notice of Privacy Practices, and staff training. Amplix’s assessment of a multispecialty physician group found no formal compliance program in place and built one from scratch, addressing everything from unsecured decommissioned equipment to unencrypted backups. |
The Challenge
No Program, No Documentation, No Baseline
The organization’s policies and procedures were incomplete or entirely unavailable, and its Notice of Privacy Practices, a document HIPAA requires every covered entity to maintain and post, wasn’t present anywhere, online or otherwise.
- No previous vulnerability assessment had ever been conducted
- Decommissioned equipment containing PHI was left in unsecured areas
- Business associate agreements were often incomplete, out of date, or nonexistent
- Backups, laptops, and other devices were unencrypted
- Thousands of paper records sat in most office locations with poor physical security controls
The Approach
A Risk Assessment That Started from Zero
Amplix conducted a full HIPAA Security Risk Assessment, evaluating the organization’s operational environment against HIPAA’s Security and Privacy requirements to identify threats, vulnerabilities, and gaps in existing safeguards. Because so little formal documentation existed to begin with, the assessment functioned less as a gap analysis against an existing program and more as the foundation for building one.
The Solution
A Documented Compliance Program, Built from the Ground Up
Amplix’s recommendations covered the full scope of what a functioning HIPAA compliance program requires:
- Reviewed and modified HIPAA Security and Privacy policies where they existed, and developed them where they didn’t
- Recommended specific improvements to paper records protection across all office locations
- Delivered recommendations on physical security improvements to address unsecured equipment and facilities
- Provided a plan for asset inventory and management, including excess and decommissioned systems containing PHI
- Recommended a personnel training program covering HIPAA Security and Privacy policies, procedures, and Breach Notification requirements
The Outcome
A Compliance Foundation Where None Existed Before
The organization went from having no documented compliance program to having a full risk assessment, a prioritized set of policy and physical security recommendations, and a training plan covering every category of HIPAA requirement. Rather than patching individual gaps, the organization now has a foundation it can build on and revisit at each annual assessment cycle.
Why Amplix
Some organizations need a compliance program refined. Others need one built. Amplix approaches both the same way: with a full risk assessment that identifies exactly what’s missing, and a practical plan to close it. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about your own HIPAA compliance program.
Frequently Asked Questions
What is a Notice of Privacy Practices?
It’s a document required under HIPAA that explains how a covered entity may use and disclose a patient’s protected health information, and outlines the patient’s rights regarding that information.
Does a Notice of Privacy Practices have to be posted?
Yes. Covered entities must make their Notice of Privacy Practices available to patients and post it in a clear and prominent location, and many also post it on their website.
What is a HIPAA compliance program?
A HIPAA compliance program is the combination of policies, procedures, risk assessments, training, and documentation an organization maintains to meet HIPAA’s Security and Privacy Rule requirements.
What happens if a healthcare organization has no formal HIPAA compliance program?
It faces significant regulatory risk, since HIPAA requires documented policies, a completed risk assessment, and staff training. Building a program typically starts with a full risk assessment to establish what’s missing.
Why is physical security part of a HIPAA risk assessment?
Physical safeguards, like secure storage for paper records and controlled disposal of decommissioned equipment, are one of the three required categories under HIPAA’s Security Rule, alongside administrative and technical safeguards.
