Government
HIPAA Compliance
After an information privacy violation, access to protected health information was restricted to verified users, with re-authentication on every sensitive task.
- Customer
- Government agency
- protected inside SAP HR
- PHI
Why SAP records are in scope
HIPAA, the American Health Insurance Portability and Accountability Act, as amended by the Final Rule and the HITECH Act provisions of 2009, is a set of rules to be followed by doctors, hospitals and also employers.
Protected Health Information includes name, birth date, social security numbers, health insurance and many other identifying data elements tied to employer-sponsored health plans, most of which are customarily stored in SAP HR records. The duty of privacy compliance and safeguards under Title II therefore extends to SAP records.
The situation
- The agency uses SAP for most business processes, including HR and payroll
- An information privacy violation had occurred before bioLock was installed, where employees’ electronic protected health information was accessed by unauthorised parties
- The agency faced the risk of increased civil and criminal penalties
The challenge
- HIPAA requires disclosure of any breach of protected data, and employers are covered entities if they provide healthcare benefits to employees
- SAP HR data is stored in infotypes, for example infotype 0167 for health plans, which have to be individually controlled to avoid unauthorised access
- Both administrative and technical safeguards are required, and standard passwords cannot provide the granular access control that SAP infotypes need
What was implemented
- Biometric credential profiles created for users authorised to view or edit data defined as protected health information
- Individual biometric user profiles associated with specific tasks in SAP HR
- Biometric re-authentication enforced for every sensitive task
- A tamper-proof log file trail implemented for each protected transaction
The access controls address unique user identification, emergency access procedure, automatic logoff, and encryption and decryption.
This page describes one customer’s implementation. Whether any particular deployment satisfies a regulation depends on that organisation’s own processes and assessment.