HIPAA

GDPR

ISO 27001

PCI DSS

To ensure the privacy and security of health information

To improve the quality of healthcare

To reduce healthcare costs

To increase access to healthcare

Healthcare providers

Health plans

Healthcare clearinghouses

Business associates

Encryption of electronic protected health information (ePHI)

Regular security risk assessments

Employee training on HIPAA requirements

All of the above

$50,000 per violation

$100,000 per violation

$250,000 per violation

$1,000,000 per violation

Unauthorized access to ePHI

Disclosure of ePHI without patient consent

Failure to encrypt ePHI

Failure to provide patients with a Notice of Privacy Practices

Implement a comprehensive security program

Provide employee training on HIPAA requirements

Regularly monitor and audit your security systems

All of the above

OCR is responsible for investigating HIPAA violations

OCR is responsible for issuing HIPAA regulations

OCR is responsible for providing technical assistance to HIPAA covered entities

All of the above

Use strong passwords and regularly change them

Implement multi-factor authentication

Use a firewall to protect your network

Back up your data regularly

6 years

10 years

15 years

20 years

Identification of potential risks and vulnerabilities

Evaluation of the likelihood and impact of risks

Implementation of security measures to address risks

Documentation of the risk assessment

Annually

Biennially

Triennially

Quadrennially

A description of how ePHI will be used and disclosed

A description of the patient's rights regarding their ePHI

A list of the covered entity's contact information

A statement that the patient has the right to opt out of receiving marketing materials

10 days

30 days

60 days

90 days

Use strong passwords and regularly change them

Implement multi-factor authentication

Use a firewall to protect your network

Allow employees to access ePHI from their personal devices