Contact Us
Blog October 20, 2014

3 HIPAA Security Myths Debunked

The Health Insurance Portability & Accountability Act (HIPAA) is designed, in part, to guard against unauthorized access to, and use of, patient information. It introduces a distinct set of guidelines and requirements for protecting patient data for those who use it to deliver healthcare services. Though HIPAA applies to all forms of patient information, particular challenges arise surrounding the security and protection of electronic data. Electronic Protected Health Information (ePHI), which pertains to any individually identifiable health data (e.g. name, phone number, email address, etc.), is difficult to secure given the ubiquity of computers, the Internet and the diverse network of healthcare entities that share information. The pressure to comply with HIPAA regulations is great, whether you’re a data security novice or a well-seasoned veteran. And consequences for non-compliance are very real, with violations resulting in substantial civil and criminal penalties, in addition to steep financial penalties.


While there is a lot of information out there, it can be difficult to sort through it all. So, we have highlighted – and debunked – three common HIPAA myths. We hope they can help you improve your processes:

  1. Myth: A security risk analysis is optional for small providers. False. Risk analyses are mandatory for covered entities and providers (or business associates) of all types and size. These include:
    • Healthcare Providers: doctors, clinics, nursing homes, etc., but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard;
    • A Health Plan: health insurance companies, HMOs, company health plans, government programs that pay for healthcare, such as Medicare, Medicaid, and military and veterans’ health care programs; and
    • A Health Care Clearinghouse: entities that process non-standard health information they receive from another entity in to a standards (i.e., standard electronic format or data content), or vice versa.
  1. Myth: I only need to do a risk analysis once. False.To comply with HIPAA, you must continue to review, correct or modify, and update security protections – not only from a firmware or hardware side, but also from a desktop user perspective in terms of requiring secure areas where people handle or access PHI.
  1. Myth: My provider took care of everything I need to do about privacy and security. False.With these solutions, it is important to note that no HIPAA compliant hosting provider can guarantee that their customers will be HIPAA compliant just by using their hosting services. Rather, they support or augment HIPAA compliance. Ultimately it is up to each healthcare organization to ensure compliance beyond its data centers.

Being at the forefront of the cloud hosting industry, Connectria can address your organization’s HIPAA compliance needs regardless of the type of healthcare organization and application you are running. Check out our HIPAA Compliant Hosting services or contact us for more information.

Related Resources

Partner Powered AWS Funding Opportunities
Many IT leaders are challenged to find the cloud support their business needs. Organizational timelines for cloud adoption, cloud migration, and cloud maturity are being…
Case Study May 19, 2023
How PohlmanUSA Leverages AWS
Connectria Key Takeaways from POWERUp 2023
Common’s POWERUp conference, the largest IBM i conference event worldwide, was held last week in Denver, Colorado. This event brings IBM executives, industry experts, and…