February 20, 2020
HIPAA compliance solution – GateKeeper Enterprise
GateKeeper Enterprise is widely used for automated HIPAA compliance by many healthcare practitioners. The Health Insurance Portability and Accountability Act (HIPAA) provides guidelines for privacy standards to protect patients’ private medical records and other health information via technology and process – applies to healthcare providers and Business Associates (BA) working with confidential patient information. GateKeeper helps IT directors meet HIPAA compliance through authentication and auditing automation rather than people-dependent technology.
Case Study: Hospital that saves time maintaining HIPAA compliance using GateKeeper.
| Section | Key Activity | Criteria | GateKeeper Solution |
| 164.306(b) | Flexibility of Approach | (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart. (2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors: (i) The size, complexity, and capabilities of the covered entity or business associate. (ii) The covered entity’s or the business associate’s technical infrastructure, hardware, and software security capabilities. (iii) The costs of security measures. (iv) The probability and criticality of potential risks to electronic protected health information. |
GateKeeper Enterprise increases the security, and decreases the complexity of the covered entity by providing an automatic mechanism for the locking of a workstation when a user is no longer in proximity. A user does not have to manually lock their workstation when they are no longer present. This security mechanism decreases the potential risks to ePHI. |
| 164.308(a) (S)(ii)(C) |
Security Awareness, Training, and Tools — Log-in Monitoring | Procedures for monitoring log-in attempts and reporting discrepancies. | GateKeeper Enterprise provides auditing and monitoring of all login events. Therefore, IT admins can see all login events on PCs, regardless of method. |
| 164.310(c) | Workstation Security | Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users. | GateKeeper provides a mechanism to automatically prevent unauthorized access to unattended computers. Therefore, when a user walks away, the computer will automatically lock. A HIPAA compliance solution feature for increasing security without burdening the users. |
| 164.312(a) (2)(i) |
Access Control — Unique User Identification |
Assign a unique name and/or number for identifying and tracking user identity. | Each GateKeeper token address is associated with a user identity. Therefore, users can be identified and tracked by the unique hardware dongle identifier. Even on shared computers/accounts, GateKeeper can accurately distinguish individual users. Moreover, even on shared computers with shared windows logins, GateKeeper will ID unique users. |
| 164.312(a) (2)(iii) |
Access Control — Automatic Logoff |
Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. | Combined with an organization’s group policy for automatic logoff, GateKeeper provides an additional layer of access control by automatically locking a workstation when a user is no longer in proximity. In fact, GateKeeper uses proximity AND time to reduce the window of risk. |
| 164.312(b) | Audit Controls | Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. | GateKeeper Enterprise audits user login activity within the network automatically. Therefore, admins can get automatic reports emailed to them. |
| 164.312(d) | Person or Entity Authentication | Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed. | GateKeeper Enterprise uses a hardware security token associated with an active directory account to create a multi-factor authentication (MFA) system. Therefore, users must have two factors of proof before being granted access to ePHI. |
Check out some GateKeeper reviews by happy healthcare customers using GateKeeper for HIPAA compliance. Instead of painfully dealing with HIPAA compliance requirements manually, IT admins use GateKeeper to automate multiple controls.
See GateKeeper Enterprise advanced MFA in action.
Take a self-guided tour of how you can evolve from passwords. Then you're really saving time with automation.