Between patients and staff, there is a lot of sensitive, private data and information that healthcare facilities must process and protect. Maintaining HIPAA compliance is paramount. Building a strong infrastructure and the right processes goes a long way in helping a facility stay HIPAA-compliant, but there are also a lot of seemingly innocuous mistakes that can lead to a breach of privacy and a HIPAA violation. Here are some of the most common HIPAA violations and some common mistakes that lead to HIPAA violations, and how to avoid them:

9 Common HIPAA Violations

These are some of the most common HIPAA violations:

1. Unauthorized access to patient records/information, including insufficient access controls to ePHI (electronic protected health information).
2. Not allowing patients timely access to their records upon request.
3. Improperly storing or disposing of PHI (protected health information).
4. Using unsecured devices for messaging.
5. Sharing PHI without authorization, including on social media.
6. Not notifying individuals of breaches promptly.
7. Failing to conduct risk assessments.
8. Failing to train staff adequately on HIPAA compliance or procedures.
9. Allowing third-party vendor access to PHI without proper contracts in place.

6 Common Mistakes That Lead to HIPAA Violations (And How to Avoid Them)

These are some everyday common mistakes that can lead to HIPAA violations, and some ways to avoid each of them:

1. Having conversations about patients in open spaces.
2. Not using secure messaging to send patient information.
3. Using generic or shared logins.
4. Leaving access open to computers in shared spaces.
5. Not logging out of systems.
6. Not regularly updating software and hardware.

Mistake #1 – Having Conversations About Patients in Open Spaces

One of the most common mistakes that can lead to a HIPAA violation is discussing patient information in open spaces. Even in facilities with secure access, places like hallways, nurse stations, or waiting rooms are not private. Even if you don’t mention any names specifically, identifiable information can still slip into the conversation and be overheard.

How to Avoid Patient Information Being Overheard

Here are some things you can do to prevent patient information from being overheard and causing a HIPAA violation:

1. Keep any discussions with or about patients in private areas only.
2. If you must have a conversation internally in a less secure or private space, use code names.
3. Implement sound masking, especially in open and semi-open spaces where conversations including patient information could occur.
4. Work with staff to define standard processes and guidelines to further reduce the risk of a violation and maintain compliance.
5. Regularly revisit processes and retrain staff on compliance processes.

Mistake #2 – Not Using Secure Messaging to Send Patient Information

Regular SMS and standard email are not encrypted to be HIPAA-compliant. Using the wrong system or not having the right encryption on messages are mistakes to avoid when implementing secure messaging. Whether via email or text, unsecured messaging systems will result in HIPAA violations if any patient information or patient-related information is sent using them.

How to Avoid HIPAA Mistakes With Messaging Systems

Here are some tips to help avoid common HIPAA mistakes with messaging around patient information:

1. Understand HIPAA text messaging rules.
2. Limit how much PHI is included in texts or emails.
3. Use secure messaging via a patient portal or HIPAA-compliant messaging system.
4. Use available access controls and user roles to secure systems and limit information access to prevent unauthorized access to sensitive data.
5. Define and implement strict standards and procedures for electronic communication with or about patients.
6. Include information on spotting and avoiding phishing attempts, spam, malware, etc., and regularly update it to keep staff informed.
7. Educate patients on your messaging systems, explain the associated risks, and get written consent for electronic communication.
8. Conduct regular audits to ensure there are no vulnerabilities in current processes and patient consent is current and documented.

Mistake #3 – Using Generic or Shared Logins

Password sharing is not HIPAA-compliant. It also makes it difficult to determine who is accessing what. Additionally, should a HIPAA violation occur, there isn’t a way to conduct a useful audit, even with access logs.

Generic logins and shared logins are also security risks. The more generic a login, the more vulnerable it is to a data breach. Similarly, the more people who have access to a shared login, the larger the risk of a data breach.

6 Tips For More Secure Logins

More secure logins and stronger cybersecurity and data security practices can help avoid a HIPAA violation due to a data breach or compromised login. Here are some tips for more secure logins:

1. Make sure every staff member who needs a login has their own unique login.
2. Use strong passwords and password protection, like two-factor authentication.
3. Implement unique passkeys instead of traditional passwords.
4. Create cybersecurity standards and train your staff on security systems and good data security practices.
5. Assign role-based access to ensure users only see what they need to see and do not have access to any data they shouldn’t.
6. Regularly audit cybersecurity practices and processes, as well as users and access.

Mistake #4 – Leaving Access Open to Computers in Shared Spaces

In busy environments, logging in and out of computers can take up time. It’s also easy to overlook when someone is rushed and juggling multiple things at once. However, unlocked devices are serious security risks and absolutely increase the risk of a HIPAA violation. In a shared space, anyone who has access to that space and walks by an unlocked device could access sensitive data, intentionally or unintentionally.

How to Keep Computers in Shared Spaces Secure

Here are a few ways to avoid a HIPAA violation caused by unlocked computers in shared spaces:

1. Make it standard procedure to lock screens any time a staff member steps away from them.
2. Implement automatic timeouts that will log out/lock computers after a period of inactivity as additional safeguards.
3. Apply privacy screens on computers in shared spaces, especially more open spaces or spaces with public access.
4. Install partitions or partial coverage to block the easy view of computer screens without obstructing the line of vision to the rest of the space for the person using it.
5. Use access control where you can to limit and monitor who has access to the space.

Mistake #5 – Not Logging Out of Systems

Similar to leaving computers unlocked, not logging out of systems is another common mistake that can lead to HIPAA violations and other issues. If a computer was unlocked and a user was still logged into a billing system, patient record, etc., anyone with access to that computer could also gain access to those systems and files. It is important for staff to log out of systems when they are done and log out/lock devices any time they step away from them.

How to Avoid HIPAA Violations Caused By Users Not Logging Out of Systems

In addition to securing devices when not in use, these are the biggest ways to avoid HIPAA violations and other data breaches caused by users not logging out of systems:

1. It should be standard practice to always log out of a system when a user is finished with it.
2. System settings should be adjusted to log out automatically when a session or user has been inactive for a period of time.
3. Work with your staff to define these parameters and processes for optimal protection without disrupting their work.

Mistake #6 – Not Regularly Updating Software and Hardware

One of the best practices for managing and maintaining security systems is to regularly update software and hardware components when needed. The same thing applies to the devices and systems your facility uses to store, process, and access patient information and data.

Outdated software is a security risk that leaves your devices and systems vulnerable to data breaches. Unreliable signals and connectivity can also cause issues, which is why healthcare facilities need to test wireless networks. Data breaches can result in serious consequences for your facility, including and in addition to HIPAA violations.

This can also apply to outdated hardware that is no longer eligible for necessary security updates or support. These are some of the risks and challenges of legacy security systems. In addition to regular software updates, it’s also important to regularly review your equipment and replace components or upgrade devices when needed to reduce security risks and vulnerabilities. Investing in a maintenance plan with your security systems integrator can help ensure security systems and components are maintained and updated regularly. This is a key benefit of service plans for your security systems.

How to Avoid Data Breaches or HIPAA Violations Due to Outdated Software

Here are a few tips for avoiding data breaches or HIPAA violations caused by outdated software:

1. Turn on automatic updates for software and applications, including device systems, browsers, EMRs, and other software on the device.
2. Use strong antivirus software and keep it updated.
3. Have processes for checking to ensure software and hardware are up to date.
4. Audit hardware and software regularly to track inventory and updates, and identify when replacements/upgrades are needed.

Make Sure Your Systems Help Maintain Security and HIPAA Compliance

These are just a few of the common mistakes that lead to HIPAA violations. Most of the time, small oversights or little mistakes due to rushed routines can be common causes. This is often why messaging systems and existing processes or protocols are critical elements of hospital security assessments.

Good internal processes can help cut down on these instances that can lead to HIPAA violations. Having the right mix of security and communications systems also makes a big difference. If you need to upgrade the security of your facility or improve secure communications, contact NEPPS at 1-800-736-1456.