Health Insurance Portability and Accountability Act of 1996, popularly known as HIPPA, is a legislation of the United States that provides security and data privacy of medical information. However, there is a still lot to be done to ensure HIPPA compliance through a comprehensive testing approach.
Firstly, HIPPA compliance defects must be given high priority by indicating them properly in a bug tracking system. A proper naming convention with the keyword “HIPPA” can help in prioritizing bugs with high-risk areas. These bugs are made clearly visible to Project Leader and are fixed with highest priority.
However, there are some of the major testing areas or strategies that ensure HIPPA compliance.
Sanity Testing
Conducting initial sanity testing is very important to detect major bugs in the HIPPA compliance. Sanity testing should be done in the following areas:
- Verify the following for a high-risk role.
- User is able to authenticate successfully and is granted all the access.
- Each action is tracked and recorded in detail.
- Verify encryption
- Electronic Protected Health Information (EPHI)
- Audit trial entries
Role Matrix
Since the application makes use of role based access, the first task would be to identify all the roles in the system and their access level. The roles are identified by considering the risk associated with each level and consulting the customer. The risk level is identified based on the data, which includes the frequency of use, the chance of error, and its impact on the customer.
The role matrix uses a color code that indicates the security risk level, with Red=High, Yellow=Medium, and Green=Low.
Test Cases
HIPPA compliance is supported by a traceable record of the test and test cases with explicit details. Here, each step is broken further into low-level action with a specific expected result.
Other Important Areas for HIPPA Compliancy Testing
HIPPA compliance testing is divided into five main areas.
- User authentication
- Ownership-based: ID cards
- Knowledge-based: User Id/Password
- Biometric-based: Fingerprint
- Login failure for: Empty & invalid user id/empty & invalid password/expired account, etc.
- Locked-out account
- Login success after password change
- Characteristics of password change itself
- Login idle timeout
- Login credentials
- Information disclosure
- Role-based access (RBA)
- Patient allocation (PA)
- Audit trail
- That all expected audit trail entries exist
- That each audit trail entry contains Date and timestamp of the action, user id, etc.
- Entries conform to the software’s clarity requirements
- All attempts to breach security are recorded
- Audit trail is encrypted
- Data transfers
- Data access between all workstations and mobile devices
- Data transfer to an external location
- The movement of data to an offline storage
- Information on correct data use
360logica’s healthcare application testing services and QA consulting is based on the understanding of the critical healthcare application and means to improve them. Over the last few years, we have been helping some of the prominent healthcare application clients, and have gained extensive expertise in testing healthcare related applications, including SaaS, EHR, and EMR products. With a sole focus on test coverage and compatibility related to platform, device, and browser, we enable you to boost your business.
Quality and predictability hold key in any software related to the healthcare industry. This brings the precedence of testing and ensuring quality of healthcare applications. We offer proficient healthcare software testing services by adhering to the entire needed regulatory directive.
