In previous blog posts, we explained what HITRUST is, and the importance of eVero achieving HITRUST r2 certification. Now we tackle the most commonly asked question: What exactly is the difference between HIPAA and HITRUST?
HIPAA and HITRUST are both regulations and standards for healthcare organizations to ensure that patient information is confidential and protected. Although these two terms are often used interchangeably, they are very different. HIPAA is a U.S. law that consists of several compliance regulations that healthcare organizations must meet, while HITRUST is a certifiable security and privacy framework that outlines prescriptive controls and requirements that can be used to prove HIPAA compliance.
While they both are focused on securing patient information, comparing HIPAA and HITRUST is not an apples-to-apples comparison. There are key differences between being HIPAA-compliant and HITRUST-certified that businesses need to keep in mind when evaluating a potential technology partner.
About HIPAA
The Health Insurance Portability and Accountability Act of 1996, or HIPAA, is a U.S. federal statute signed into law by President Clinton in 1996. In addition to giving workers the ability to carry forward health insurance coverage between jobs, HIPAA defines requirements that covered entities (i.e., health plan providers, healthcare providers, and healthcare clearinghouses) and their business associates (i.e., software providers, data storage companies) must follow to protect patient information. Regardless of whether the data is being created, received, stored, or transmitted, HIPAA simultaneously protects data against security threats.
While HIPAA regulations outline essential practices for protecting sensitive data, they do not offer a comprehensive security approach for evolving threats and liabilities. As a result, organizations often have insufficient security processes in place, leaving their systems vulnerable to threats. And in today’s digital world, data breaches continue to escalate because these unclear standards do not appropriately protect sensitive data.
HIPAA requires organizations to conduct annual self-audits, but it does not provide an official framework or methodology for verifying compliance with the law. A common process organizations follow to prove HIPAA compliance is to follow a security framework, like HITECH, and undergo third-party audits and attestations.
About HITRUST
HITRUST is one of the premier security frameworks used to demonstrate HIPAA compliance. It was established to ensure the confidentiality of sensitive medical information in a way applicable and used by covered entities and business associates. It covers over 1200 controls, or policies, each of which can be mapped to over 40 compliance and regulatory frameworks across varying industries such as HIPAA, ISO, NIST, GDPR, and more. Specifically, it details prescriptive controls that must be in place to achieve HIPAA compliance based on the organization’s risk factors.
A HITRUST certification means that the organization (including its products) has undergone rigorous scrutiny, and its systems, processes, and procedures are verified as secure. Organizations that select a HITRUST-certified IT provider as a technology partner have access to the best-in-class security, policies, procedures, and technology while transitioning away from the high costs and responsibilities associated with becoming HITRUST-certified themselves.
HITRUST is not required by law. However, 81% of hospitals and 83% of health payers have adopted the framework. Though not required by the US government, many organizations in the healthcare space require it from their vendors. (source: HITRUST)
Due to its strict and prescriptive nature, the HITRUST certification has established itself as a gold standard for organizations to prove they have the necessary controls in place for data protection.
The HIPAA vs HITRUST comparison
Trying to compare the two or figure out if HITRUST or HIPAA is better for an organization is the wrong way to look at this. Instead, the question should be “What is the best way to demonstrate an organization’s HIPAA compliance?”
HIPAA is certainly a valuable security tool for healthcare organizations overall, however, HITRUST’s enhanced security framework approach encourages organizations to go beyond the minimum HIPAA requirements. Since HITRUST includes requirements from HIPAA as well as other data protection frameworks, it creates a universal protection standard — void of any inconsistencies. Organizations handling patient information must follow HIPAA’s regulations, but by becoming a HITRUST-certified technology partner, they can ensure they are enabling the best protection possible.
In summary, HIPAA is a compliance framework, and HITRUST is a tool that can be used to achieve and report on HIPAA and other compliance standards. HITRUST is not just a reliable way to achieve HIPAA compliance, it’s the only way to become officially certified in HIPAA compliance.
In our next blog post, we’ll review the benefits an organization will see when working with a HITRUST-certified vendor.
