Health Information Compliance Alert

Here's what the final HIPAA security rule says about the amount of flexibility your facility is allowed:

(2) -In deciding which security measures to use, a covered entity must take into account the following factors:

(i)-The size, complexity and capabilities of the covered entity

(ii)-The covered entity's technical infrastructure, hardware and software security capabilities

(iii)-The costs of security measures

(iv)-The probability and criticality of potential risks to electronic protected health information.