Despite advances in security technology and increased governmental cybersecurity initiatives, attackers will not abandon their pursuit of patient data. Patient data is valuable. It can be used to file false claims, acquire prescription drugs, or receive medical care. Patient data often includes enough information to steal a person's identity entirely, allowing criminals to open credit accounts, file fraudulent tax returns, or receive government-issued ID cards.In light of recent data breaches, it's clear that the healthcare industry is less prepared with HIPAA compliance than patients would expect. HIPAA compliance, especially the Security Rule, has never been more necessary as the value of patient data continues to rise on the dark web.Far too often, it's the simple, easy-to-correct things that go unnoticed and create vulnerabilities that lead to a data breach. Even organizations with layers of sophisticated IT defenses can be tripped up by an employee who opens an errant email or uses a less-than-complex password.

This guide is not intended to be a legal brief on all aspects of HIPAA regulations. Rather, it approaches HIPAA from the perspective of a security analyst, focusing on how to protect electronic patient data. This guide will examine the policies, procedures, and security controls recommended to keep electronic patient data private and secure as described under HIPAA's Privacy and Security Rules. It also discusses Breach Notification and Enforcement Rules.Ultimately, our goal is to help you keep patient data safe.