HIPAA Compliant Mailing FAQ

Commonly Asked Questions About HIPAA Compliance in the Print-Mail Industry

What are the benefits of outsourcing mailing for the healthcare industry?

Outsourcing your healthcare-related print and mail can have many benefits for your communications and business objectives, including: HIPAA compliant print, mail and eDelivery, ironclad data security and privacy, increased savings on cost, time and resources, full workflow transparency, cross-channel communications expertise, lowered risk of unplanned business interruptions with a DR/business continuity plan, access to the latest technology and innovation to improve communication channels

What experience does FSSI have working with healthcare and insurance providers?

With over 40 years of HIPAA-compliant document processing and mailing expertise, we’re a trusted patient statement vendor whose solutions can reduce production costs, stimulate collections and comply with emerging regulations. We have worked with both healthcare providers and health insurance companies to securely process printed and electronic communications containing PII and PHI.

How does a HIPAA-compliant print and mail company like FSSI maintain HIPAA compliance?

Print and mail companies like FSSI maintain HIPAA compliance by continually meeting all HIPAA compliant and security standards to keep sensitive data secure, including:

Under HIPAA, what is considered PHI?

Health information alone is not PHI, but when it includes one of these identifiers it becomes PHI:

What is the difference between PHI and ePHI?

PHI is any health information that can be tied to an individual. This includes information used while providing healthcare, processing payments for healthcare or in health insurance. ePHI is basically PHI stored electronically on a hard drive, server, thumb drive or another electronic device.

What are the three main security requirements of HIPAA?

The main HIPAA security requirements fall into three categories:

• Physical – Includes the physical safeguards in place to secure access to physical equipment including computers, internet routers, data storage and other data devices.
• Administrative  – Includes the policies and procedures that impact ePHI as well as risk management, system architecture and maintenance related to these security measures. This also includes other administrative aspects like HR and employee training.
• Technical  – Includes the cybersecurity of the computers, mobile devices, encryption, network security, device security and anything related to the actual technology of storing and communicating ePHI.

What are the four main HIPAA rules and how do they affect compliance?

The four essential HIPAA rules that govern compliance are:

• The Privacy Rule –In this rule, any identifiable patient data is subject to privacy covered by the covered entity or associated business.
• The Security Rule – This rule established the national standards for the mechanisms required to protect PHI data. These procedures extend across all stages of operations within the company.  This includes technology, administration, physical safeguards for computers and devices, and anything that could impact the safety of Protected Health Information.
• The Breach Notification Rule –This rule specifies what an entity must do when a security breach occurs. Organizations must have a plan in place to notify the public and victims in the event of a breach.
• The Omnibus Rule – This rule states that HIPAA requirements also cover associates, contractors and anyone working with a company. These companies need to update their gap analysis, risk assessment, and compliance procedures accordingly to cover any individuals working on their behalf.

Does FSSI validate addresses before mailing?

Depending on the needs of the client, FSSI can use address verification tools, such as the USPS’ Coding Accuracy Support System (CASS), NCOA and Move Update Compliance, to help ensure each statement, bill or invoice reaches the hands of its recipient. Working with a CASS-certified provider ensures that your address data follows postal formatting and requirements and is in compliance with USPS standards. 

What is HITRUST certification? Does FSSI have it?

HITRUST stands for the Health Information Trust Alliance. It was founded in 2007 and uses the “HITRUST approach” to help organizations from all sectors – but especially healthcare – effectively manage data, information risk and compliance.

HITRUST certification by the HITRUST Alliance enables vendors and covered entities to demonstrate compliance with HIPAA requirements based on a standardized framework.

HITRUST was organized with the intent to provide an option for the healthcare sector to address information risk management across a matrix of third-party assurance assessments, with the hope of consolidating, reducing, and in some cases, eliminating the need for multiple reports. HITRUST refers to this design element as “assess once, report many.”

While FSSI does not have HISRUST CSF Certification, it has passed the HIPAA compliance requirements to be a HIPAA-certified print and mail provider. Both certifications have similar guidelines. Being HIPAA compliant ensures that FSSI follows the best practices for keeping highly sensitive data secure when accessing processing and storing protected health information.

Is First Class Mail considered to be HIPAA compliant?

HIPAA rules state that you must send PHI-related documents through First Class postal mail – never using standard mail. In some situations, you must use even Certified Mail, requiring the recipient to sign for the receipt of the mailpiece. An additional plus when sending mail certified, is that it’s also trackable, down to a signed record of delivery.

What are examples of HIPAA violations?

The following list includes examples of ways an organization can violate HIPAA – also extending to contractors and any vendor working with the organization:

Need an experienced HIPAA-compliant print and mail provider? Call 714-436-3300 today for a no-obligation consultation or to speak with a healthcare specialist about FSSI’s stringent data security and privacy practices.