Building a HIPAA-compliant rules engine for text-based service company
1–10 of 16 posts
Re: Building a HIPAA-compliant rules engine for text-based service company
#2Disappointed to see almost no details or specifics in the section about HIPAA compliance
Re: Building a HIPAA-compliant rules engine for text-based service company
#3Disappointed to see almost no details or specifics in the section about HIPAA compliance
Because there isn't as much to HIPAA compliance as people like to think. The HIPAA security rule defines a set of administrative, physical and technical safeguards that must be met - how you accomplish those is up to you.
(And yes, there's more to HIPAA than the security rule - but not everything in the regulations applies to every covered entity, and the combined regulation document you need to read to get started is a total of 115 pages you can read in a day or two).
Re: Building a HIPAA-compliant rules engine for text-based service company
#4Disappointed to see almost no details or specifics in the section about HIPAA compliance
I’ve been struggling to find a “HIPAA for dummies” or at least something I can understand in a few days.
Best I can tell, being HIPAA compliant isn’t exactly difficult, it’s just costly if you fail. Encrypt everything, delete patient data when you don’t need it, automatically log out users after as short a time as acceptable, and have a legal team ready to handle contracts.
Re: Building a HIPAA-compliant rules engine for text-based service company
#5What a useless article. I was hoping to see some interesting details about how their rules engine could differ from those I've written for clients.
Re: Building a HIPAA-compliant rules engine for text-based service company
#6Disappointed to see almost no details or specifics in the section about HIPAA compliance
Because there isn't as much to HIPAA compliance as people like to think. The HIPAA security rule defines a set of administrative, physical and technical safeguards that must be met - how you accomplish those is up to you. (And yes, there's more to HIPAA than the security rule - but not everything in the regulations applies to every covered entity, and the combined regulation document you need to read to get started i…
Would you happen to know where I can read these rules? It would be really helpful to me.
Re: Building a HIPAA-compliant rules engine for text-based service company
#7What a useless article. I was hoping to see some interesting details about how their rules engine could differ from those I've written for clients.
They probably used CLIPS, PyKE, Durable Rules, or PyKnow, since they mentioned doing it in Python. Most folks in heal care tech use Drools though. All of the analyst types know how to write rule for it, and it works pretty well even if you aren't a java shop.
Re: Building a HIPAA-compliant rules engine for text-based service company
#8Earlier quoted context omitted.
Because there isn't as much to HIPAA compliance as people like to think. The HIPAA security rule defines a set of administrative, physical and technical safeguards that must be met - how you accomplish those is up to you. (And yes, there's more to HIPAA than the security rule - but not everything in the regulations applies to every covered entity, and the combined regulation document you need to read to get started i…
Would you happen to know where I can read these rules? It would be really helpful to me.
Here's a link to the dry text of the HIPAA regulations:
https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad...
Part 164 subsection C covers the entirety of the security rule, and is less than 10 pages.
Ultimately, these are the fundamental ones that you need to pay attention to when developing or deploying software that deal with ePHI:
Keep anything that stores (e)PHI physically (and electronically) secure
Limit access to (e)PHI to only those who need it
Keep records of access to (e)PHI by users (no shared accounts, each individual must be uniquely identifiable)
Encrypt (e)PHI _where possible_; this is an addressable requirement which means it is not mandatory, but should be followed where technically and administratively feasible
All of this is literally common sense to most developers when dealing with PHI. There are more obnoxious security frameworks some healthcare companies opt to follow like Hitrust (the personal hell I live in), but it's not like CMS or any other government agency mandates anything beyond the HIPAA regulations.
Re: Building a HIPAA-compliant rules engine for text-based service company
#9Disappointed to see almost no details or specifics in the section about HIPAA compliance
I’ve been struggling to find a “HIPAA for dummies” or at least something I can understand in a few days. Best I can tell, being HIPAA compliant isn’t exactly difficult, it’s just costly if you fail. Encrypt everything, delete patient data when you don’t need it, automatically log out users after as short a time as acceptable, and have a legal team ready to handle contracts.
I wrote this guide that you might find useful: https://harries.co/mvp-hipaa-compliance/
This is great too: https://www.aptible.com/hipaa and https://github.com/truevault/hipaa-compliance-developers-gui...
Re: Building a HIPAA-compliant rules engine for text-based service company
#10Earlier quoted context omitted.
Would you happen to know where I can read these rules? It would be really helpful to me.
Here's a link to the dry text of the HIPAA regulations: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad... Part 164 subsection C covers the entirety of the security rule, and is less than 10 pages. Ultimately, these are the fundamental ones that you need to pay attention to when developing or deploying software that deal with ePHI: Keep anything that stores (e)PHI physically (and electronically) secure L…
Thank you so much, that is extremely helpful