Feature Articles

Free Webinar TODAY: HIPAA Email Security 101: PHI, Encryption, and What’s Required

Posted by Steve Alder

According to the Paubox 2026 Healthcare Email Security Report, in 2025, 170 email-related data breaches were reported to the HHS’ Office for Civil Rights (OCR). While healthcare organizations are getting better at preventing email-related data breaches, an analysis of email security configurations found that in 2025, 41% of healthcare organizations fell into the high-risk category, an increase from the previous year.

On top of those large healthcare data breaches are the thousands of smaller breaches that affect fewer than 500 individuals, a large percentage of which are due to poor email security configurations and errors by healthcare employees. Each email incident erodes trust, can be costly to resolve, and potentially puts the organization at risk of a HIPAA penalty, yet email compliance failures are easily avoided.

On May 21, 2026, the leading healthcare email security company, Paubox, is hosting a webinar to explain HIPAA email security 101. The webinar consists of a practical session covering the fundamentals of HIPAA-compliant email, what constitutes PHI, and how to identify the indicators of PHI, as well as the key email security requirements that HIPAA-regulated entities must have in place to ensure that sensitive information is protected and patient privacy is assured. Attendees will also learn about the common compliance errors made by organizations and healthcare employees when communicating via email, and how to avoid them.

Webinar attendees will learn how encryption works and why it is vital for HIPAA compliance

Reserve your spot today to learn how HIPAA applies to email and the requirements for HIPAA-compliant email communications. 

Why Attend?

  • Attendees will learn the fundamentals of HIPAA-compliant email communications, what constitutes PHI, and the common compliance mistakes made by healthcare organizations, and how to avoid them. This webinar is eligible for 1 self-reported CPE. Attendees will receive a certificate of attendance that may be used as supporting documentation when submitting credits to applicable certifying bodies.

WEBINAR DETAILS

HIPAA Email Security 101: PHI, Encryption, and What’s Required

Wednesday, May 20, 2026

10 a.m. PT | 11 a.m. MT | 12 p.m. CT | 1 p.m. ET | 6 a.m. BST

Register for the Webinar

 

Speaker: Dawn Halpin, HIPAA Evangelist, Paubox

Dawn Halpin, Paubox

Dawn Halpin, a graduate of Marquette University and the University of Wisconsin-Milwaukee, is a HIPAA Evangelist at the email security firm Paubox. Paubox is a leader in HIPAA-compliant email security for the healthcare industry and is trusted by more than 8,000 organizations, including Cost Plus Drugs, Rippling, and Covenant Health.

 

 

The post Free Webinar TODAY: HIPAA Email Security 101: PHI, Encryption, and What’s Required appeared first on The HIPAA Journal.

HIPAA Risk Assessment

Posted by Steve Alder

A HIPAA risk assessment assesses threats to the privacy and security of PHI, the likelihood of a threat occurring, and the potential impact of each threat so it is possible to determine whether existing policies, procedures, and security mechanisms are adequate to reduce risks and vulnerabilities to a reasonable and appropriate level.    

The requirements for covered entities and business associates to conduct a HIPAA risk assessment appear twice in the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act. However, it may be necessary for organizations to conduct risk assessments beyond these requirements.

The first requirement to conduct a HIPAA risk assessment appears in the HIPAA Security Rule (45 CFR § 164.308 – Security Management Process). This standard requires covered entities and business associates to conduct an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI”.

The second requirement appears in the HIPAA Breach Notification Rule (45 CFR § 164.402). This standard only applies when there has been an impermissible acquisition, access, use, or disclosure of unsecured PHI (in any format), and a HIPAA risk assessment is necessary to determine whether the event is notifiable to HHS and the affected individual(s).

However, beyond the HIPAA risk assessment requirements of the HIPAA Security and Breach Notification Rules, risks exist to the confidentiality, integrity, and availability of PHI when it is not in electronic format – for example, when unauthorized disclosures are made verbally or when a printed medical report is left unattended in an area of public access.

Because of these risks, it may be necessary to conduct a HIPAA privacy risk assessment which not only takes into account risks to the confidentiality, integrity, and availability of non-electronic PHI, but which also covers individuals’ access rights (to their PHI), Business Associate Agreements, and other Organizational Requirements of HIPAA.

HIPAA Security Risk Assessment

The objective of a HIPAA security risk assessment is outlined in the General Rules (CFR 45 § 164.306) that precede the Administrative, Physical, and Technical Safeguards of the HIPAA Security Rule. These are to:

  • Ensure the confidentiality, integrity, and availability of all electronic PHI the covered entity or business associate creates, receives, maintains, or transmits.
  • Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
  • Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part (the HIPAA Privacy Rule).
  • Ensure compliance with this subpart (the HIPAA Security Rule) by its workforce. Note: This is achieved via security awareness training and the enforcement of a sanctions policy.

With regards to the Administrative, Physical, and Technical Safeguards of the HIPAA Security Rule, the General Rules allow a “flexibility of approach” in how the standards are implemented. Despite the flexibility of approach clause, it is important that all standards are implemented unless an implementation specification is not “reasonable and appropriate” and an equivalent alternate measure is implemented in its place. The full list of Administrative, Physical, and Technical implementation specifications is:

Standards Sections Implementation Specifications

(R)=Required, (A)=Addressable

 Implementation Commentary
Security Management Process 164.308(a)(1) Risk Analysis (R), Risk Management (R), Sanction Policy (R), Information System Activity Review (R) Organizations should perform a comprehensive risk analysis to identify potential vulnerabilities to ePHI. Develop and document a risk management strategy that prioritizes remediation activities. Enforce a sanction policy for employees who fail to comply with security policies, and implement tools for reviewing system activity regularly to detect any unauthorized access.
Assigned Security Responsibility 164.308(a)(2) (R) Assign a senior-level individual (such as a CISO or Privacy Officer) to be responsible for ensuring the implementation and oversight of security policies and procedures across the organization. This individual should have authority and resources to enforce HIPAA compliance.
Workforce Security 164.308(a)(3) Authorization and/or Supervision (A), Workforce Clearance Procedure (A), Termination Procedures (A) Establish and document procedures for supervising workforce members who access ePHI. Screen employees before granting access, and ensure prompt deactivation of accounts and access upon termination or role change to prevent unauthorized access.
Information Access Management 164.308(a)(4) Isolating Health Care Clearinghouse Function (R), Access Authorization (A), Access Establishment and Modification (A) Create controls to isolate systems that manage ePHI, especially if a healthcare clearinghouse is part of a larger organization. Define procedures for granting, modifying, and removing user access based on job roles. Access should be reviewed periodically and updated accordingly.
Security Awareness and Training 164.308(a)(5) Security Reminders (A), Protection from Malicious Software (A), Log-in Monitoring (A), Password Management (A) Develop a formal training program that includes regular security updates, awareness of phishing and malware threats, instructions for recognizing suspicious activities, and best practices for password management. Training should be documented and mandatory for all employees.
Security Incident Procedures 164.308(a)(6) Response and Reporting (R) Develop and maintain a written incident response plan that defines how to detect, report, and respond to security incidents. Train staff on recognizing incidents, and test the plan through simulated exercises to improve readiness.
Contingency Plan 164.308(a)(7) Data Backup Plan (R), Disaster Recovery Plan (R), Emergency Mode Operation Plan (R), Testing and Revision Procedure (A), Applications and Data Criticality Analysis (A) Implement a robust contingency planning framework that includes regular data backups, disaster recovery procedures, and emergency mode operations to ensure continuity of care. Conduct periodic testing and revise plans based on outcomes. Assess and prioritize data and application criticality to focus recovery efforts effectively.
Evaluation 164.308(a)(8) (R) Regularly evaluate your security program’s effectiveness through audits, risk assessments, and policy reviews. Document evaluation results and implement improvements as needed to address any weaknesses or evolving threats.
Business Associate Contracts 164.308(b)(1) Written Contract or Other Arrangement (R) Enter into Business Associate Agreements (BAAs) with all vendors who handle ePHI on your behalf. Ensure these agreements outline security responsibilities and establish that the associate is subject to HIPAA rules.
Facility Access Controls 164.310(a)(1) Contingency Operations (A), Facility Security Plan (A), Access Control and Validation Procedures (A), Maintenance Records (A) Implement procedures to control physical access to facilities where ePHI is stored. This includes locking doors, using ID badges, and ensuring that emergency access is planned. Document maintenance activities and control how visitors and staff are validated before entering sensitive areas.
Workstation Use 164.310(b) (R) Define appropriate uses of workstations that access ePHI. Restrict the use of unauthorized software and internet access, and place workstations in secure locations where unauthorized individuals cannot view screen content.
Workstation Security 164.310(c) (R) Physically secure workstations by using cable locks, locking office doors, and ensuring terminals are not left unattended when logged in. This helps prevent unauthorized access or tampering.
Device and Media Controls 164.310(d)(1) Disposal (R), Media re-use (R), Accountability (A), Data Backup and Storage (A) Develop policies for securely disposing of media containing ePHI, such as shredding paper records or wiping hard drives. Maintain a media tracking system to ensure accountability and store backups securely offsite or in the cloud.
Access Control 164.312(a)(1) Unique User Identification (R), Emergency Access Procedure (R), Automatic Logoff (A), Encryption and Decryption (A) Assign unique user IDs for tracking access to systems containing ePHI. Ensure emergency access is available when needed. Set automatic logoff policies to reduce risk from unattended terminals, and encrypt data both at rest and in motion where appropriate.
Audit Controls 164.312(b) (R) Use software tools that track and log all access to ePHI, including login attempts, file accesses, and modifications. Regularly audit these logs to identify unusual activity and respond to potential breaches.
Integrity 164.312(c)(1) Mechanism to Authenticate Electronic Protected Health Information (A) Use checksums, digital signatures, or similar tools to ensure that ePHI has not been altered or destroyed in an unauthorized manner. Validate these mechanisms regularly to ensure reliability and security.
Person or Entity Authentication 164.312(d) (R) Ensure users authenticate themselves before accessing ePHI using secure methods such as strong passwords, biometric verification, or multi-factor authentication. Regularly update and review authentication policies.
Transmission Security 164.312(e)(1) Integrity Controls (A), Encryption (A) Encrypt data transmissions such as emails or data sent via APIs to protect ePHI from interception. Implement integrity controls like message authentication codes to ensure that data is not altered during transmission.

 

The final section of the HIPAA Security Rule covers Business Associate Agreements and other Organizational Requirements. This section requires covered entities to ensure their Business Associate Agreements require business associate to comply with the HIPAA Security Rule and report any security incidents (not just data breaches) to the covered entity. With regards to the Organization Requirements, the standard in 45 CFR § 164.314 applies to group health plans; but all covered entities in hybrid, affiliated, or OHCA arrangements should review the content of this standard as well.

HIPAA Breach Risk Assessment

The second “required” HIPAA risk assessment is actually optional inasmuch as the HIPAA Breach Notification Rule states any that impermissible acquisition, access, use, or disclosure of PHI is presumed to be a breach unless a low probability of compromise can be demonstrated via a risk assessment that takes at least the following factors into account:

  • The nature and extent of breached PHI including the types of identifiers and the likelihood of reidentification,
  • The unauthorized person (if known) who acquired, accessed, or used the breached PHI or to whom an impermissible disclosure was made,
  • Whether PHI was actually acquired or viewed (read HHS’ guidance on ransomware to establish what constitutes “acquired or viewed” in cyberattacks),
  • The extent to which the risk to PHI has been mitigated.

The reason for the HIPAA breach risk assessment being described as optional is that covered entities and business associates could – if they wish – skip this HIPAA assessment and notify every impermissible acquisition, access, use, or disclosure of PHI. The drawback to this approach is that it may result in business disruption if HHS’ Office for Civil Rights feels your organization is experiencing an above-average number of data breaches and decides to conduct a compliance review.

It can also cause a loss of trust from individuals served by the organization if patients and plan members are receiving frequent breach notifications – especially if they are advised to take measures to protect themselves against fraud, theft, and loss unnecessarily because “breached” PHI has not actually been acquired or viewed. Although “optional”, it can be a good idea to conduct a HIPAA breach risk assessment to prevent unavoidable notifications.

HIPAA Risk Assessment Workflow- the hipaajournal.com

HIPAA Privacy Risk Assessment

Due to the requirement to conduct risk assessments being in the HIPAA Security Rule, many covered entities and business associates overlook the necessity to conduct a HIPAA privacy risk assessment. A HIPAA privacy risk assessment is equally as important as a security risk assessment but can be a much larger undertaking depending on the size of the organization and the nature of its business.

In order to complete a HIPAA privacy risk assessment, an organization should appoint a Privacy Officer, whose first task it is to identify organizational workflows and get a “big picture” view of how the requirements of HIPAA Privacy Rule impact the organization´s operations. Thereafter the Privacy Officer needs to map the flow of PHI both internally and externally in order to conduct a gap analysis to identify where breaches may occur.

The final stage of a HIPAA privacy risk assessment should be the development and implementation of a HIPAA privacy compliance program. The program should include policies to address the risks to PHI identified in the HIPAA privacy assessment and should be reviewed as new work practices are implemented or new technology is deployed.

As required by 45 CFR § 164.530, it is essential employees are trained on any policies and procedures developed as a result of a HIPAA privacy risk assessment and when material changes to policies and procedures impact employees’ functions. Although covered entities and business associates may comply with this requirement “to tick the box”, better trained staff make fewer HIPAA errors, so training on HIPAA policies and procedures should be embraced as a risk mitigation strategy.

Not Identifying Risks Can be Costly

The severity of fines for non-compliance with HIPAA has historically depended on the number of patients affected by a breach of PHI and the level of negligence involved. Few fines are now issued in the lowest “Did Not Know” HIPAA violation category, because there is little excuse for not knowing a legal requirement exists to protect PHI.

More recently, the majority of fines have been under the “Willful Neglect” HIPAA violation category, where organizations knew – or should have known – they had a responsibility to safeguard PHI. Many of the largest fines – including the $5.5 million fine issued against the Advocate Health Care Network – are attributable to organizations failing to identify where risks to the integrity of PHI exist.

However, since the start of the second round of HIPAA audits, fines have also been issued for potential breaches of PHI. These are where flaws in an organization´s security have not been uncovered by a HIPAA risk assessment, or where no assessment has been conducted at all. In March 2016, North Memorial Health Care of Minnesota paid more than $1.5 million to settle related HIPAA violation charges.

It’s Not Just Large Organizations in the Firing Line

Although the majority of headlines relating to HIPAA violations concern large medical organizations and large fines for non-compliance, there are very many small medical practices also investigated by the Office for Civil Rights (OCR) or subject to HIPAA audits. Since 2003, OCR has received more than 300,000 reports of alleged HIPAA violations. Less than 2% of these relate to data breaches involving 500 individuals or more.

A significant problem for small and medium sized medical practices is that not all insurance carriers cover the cost of a HIPAA breach. The cost of a HIPAA breach not only includes the fine, but also the cost of hiring IT specialists to investigate the breach, the cost of repairing public confidence, and the cost of providing credit monitoring services for individuals. Insurers may also limit their coverage according to the nature of the HIPAA violation and the level of negligence.

Without insurance coverage, the cost of a HIPAA breach could potentially close a small medical practice. However, this scenario can be mitigated by conducting a HIPAA risk assessment and implementing measures to resolve any uncovered issues. An assessment can be complicated and time-consuming, but the alternative is potentially terminal to small medical practices and their business associates.

Business Associates Must Be Included

Every covered entity that creates, receives, maintains, or transmits PHI has to conduct an accurate and thorough HIPAA risk assessment in order to comply with the Security Management requirements of the HIPAA Security Rule. This condition of HIPAA compliance not only applies to medical facilities and health plans. Business associates, subcontractors, and vendors must also conduct a HIPAA security risk assessment. Similar to covered entities, fines for non-compliance can be issued by OCR against business associates for potential breaches of PHI.

OCR treats these risks seriously. In December 2014, the agency revealed that 40% of all HIPAA breaches involving an exposure of more than 500 patient records are attributable to the negligence of business associates. In June 2016, it issued its first fine against a business associate – the Catholic Health Care Services of the Archdiocese of Philadelphia agreeing to pay $650,000 following a breach of 450 records. The non-profit organization had failed to conduct a HIPAA risk assessment since 2013.

More recently, the proportion of data breaches attributable to a lack of compliance by business associates may appear to have reduced, but this is not necessarily the case. Under the HIPAA Breach Notification Rule (CFR § 164.410), a business associate is required to notify a covered entity when a breach of unsecured PHI occurs. It is then the covered entity’s responsibility to notify HHS and the affected individual(s) – so it may be the case many data breaches are recorded as being attributable to a covered entity when in fact a business associate is at fault.

Developing a Risk Management Plan and Implementing New Procedures

A HIPAA risk assessment should reveal any areas of an organization’s security that need attention. Organizations then need to compile a risk management plan in order to address the weaknesses and vulnerabilities uncovered by the assessment and implement new procedures and policies where necessary to close the vulnerabilities most likely to result in a breach of PHI.

The risk levels assigned to each vulnerability will give an organization direction on the priority that each vulnerability needs to be given. The organization can then create a remediation plan to tackle the most critical vulnerabilities first. The remediation plan should be complemented with new procedures and policies where necessary, and appropriate workforce training and awareness programs.

It has been noted by OCR that the most frequent reason why covered entities and business associates fail HIPAA audits is because of a lack of procedures and policies – or inadequate policies and procedures. It is important that the appropriate procedures and policies are implemented in order to enforce changes to the workflow that have been introduced as a result of the HIPAA risk assessment.

Tools to Assist with a HIPAA Risk Assessment

Conducting a HIPAA risk assessment on every aspect of an organization’s operations – not matter what its size – can be complex. This is particularly true for small medical practices with limited resources and no previous experience of complying with HIPAA regulations. To help reduce the complexity of conducting HIPAA risk assessments, in 2014, OCR released a downloadable Security Risk Assessment (SRA) tool that helps small and medium sized medical practices with the compilation of a HIPAA risk assessment.

The SRA tool is very helpful in helping organizations identify some locations where weaknesses and vulnerabilities may exist – but not all. In the User Guide accompanying the software, it is stated at the beginning of the document “the SRA tool is not a guarantee of HIPAA compliance”. This is because, although the tool consists of 156 questions relating to the confidentiality, availability, and integrity of all PHI, there are no suggestions on how assign risk levels or what policies and procedures to introduce.

Much the same applies to other third-party tools that can be found on the Internet. They may also help organizations identify some weaknesses and vulnerabilities, but not provide a fully compliant HIPAA risk assessment. Indeed, many third-party vendors publish disclaimers in the small print of their terms and conditions similar to that at the beginning of the SRA tool User Guide. The conclusion is that tools to assist with a HIPAA risk assessment can be helpful for identifying issues but are not suitable for providing solutions to all issues.

HIPAA Risk Assessment FAQ

Where are risks most commonly identified?

Where risks are most commonly identified vary according to each organization and the nature of its activities. For example, a small medical practice may be at greater risk of impermissible disclosures through personal interactions, while a large healthcare group may be at greater risk of a data breach due to the misconfiguration of cloud servers.

What is a “reasonably anticipated threat”?

A reasonably anticipated threat is any threat to the privacy of individually identifiable health information or to the confidentiality, integrity, or availability of PHI that is foreseeable. These not only include threats from external bad actors, but also threats originating from human error or a lack of knowledge due to a lack of training. This is why a “big picture” view of organizational workflows is essential to identify reasonably anticipated threats.

What is the difference between a risk assessment and a risk analysis?

The difference between a risk assessment and a risk analysis is that a risk assessment identifies the risks to HIPAA compliance, whereas a risk analysis assigns risk levels for vulnerability and impact combinations. The objective of assigning risk levels to each risk is so that risks with the potential to be most damaging can be addressed as priorities. Most HIPAA risk analyses are conducted using a qualitative risk matrix.

Who is responsible for conducting a HIPAA security risk assessment?

The responsibility for conducting a HIPAA security risk assessment usually lies with a HIPAA Compliance Officer; or, if the responsibility for HIPAA compliance is shared between a HIPAA Privacy Officer and a HIPAA Security Officer, the risk assessment and analysis should be conducted by the HIPAA Security Officer with assistance from his or her colleague depending on the nature of risks identified.

Are there different types of risk assessment for covered entities and business associates?

There are not different types of risk assessment for covered entities and business associates. Both covered entities and business associates need to conduct “A-to-Z” risk assessments for any Protected Health Information created, used, or stored. While business associates may experience a lower volume of PHI than a covered entity, the risk assessment has to be just as thorough and just as well documented.

What is a HIPAA risk assessment?

A HIPAA risk assessment is a risk assessment that organizations subject to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act have to complete in order to be compliant with the “Security Management Process” requirements. Non-compliant organizations have been filed for failing to comply with this requirement of HIPAA.

What is the difference between a HIPAA risk assessment and a HIPAA compliance assessment?

The difference between a HIPAA risk assessment and a HIPAA compliance assessment is that a HIPAA risk assessment identifies potential threats and vulnerabilities so measures can be implemented to mitigate their likelihood. A HIPAA compliance assessment is usually an assessment performed by a third party to assess an organization´s compliance with the HIPAA Privacy, Security, and Breach Notification Rules.

Why can I not find a HIPAA risk assessment template on the Internet?

You will not find a HIPAA risk assessment template on the Internet because covered entities and business associates vary significantly in size, complexity, and capabilities, and there is no “one-size-fits-all” HIPAA risk assessment. Due to the number of variables, there is no such thing as a HIPAA risk assessment template; and, if you do source a template from the Internet, you should treat it with caution as it may not include every potential risk to PHI maintained by your organization.

When is a HIPAA risk assessment necessary?

A HIPAA risk assessment is necessary in two instances. The first instance appears in the HIPAA Security Rule (45 CFR § 164.308 – Security Management Process). The second instance occurs under the HIPAA Breach Notification Rule (45 CFR § 164.402), which applies when there has been an impermissible acquisition, access, use, or disclosure of unsecured PHI. However, organizations should conduct risk assessments more often than these requirements, particularly related to non-electronic PHI and organizational requirements.

What is the objective of a HIPAA security risk assessment?

The objective of a HIPAA security risk assessment is to identify risks to the confidentiality, integrity, and availability of all electronic PHI the covered entity or business associate creates, receives, maintains, or transmits. The risk assessment should not only focus on external threats, but also those within the organization attributable to malicious insiders or a lack of security awareness training.

What factors are considered in a HIPAA breach risk assessment?

The factors considered in a HIPAA breach risk assessment include the nature and extent of breached PHI, the types of identifiers and the likelihood of re-identification, the unauthorized person who accessed or used the breached PHI, whether PHI was actually acquired or viewed, and the extent to which the risk to PHI has been mitigated.

What could be the consequence of not identifying risks to PHI in a risk assessment?

The consequences of not identifying risks to PHI in a risk assessment are an increased likelihood of a data breach or impermissible disclosure, and – following on from such an event – a sanction issued by HHS’ Office for Civil Rights for failing to conduct a thorough risk assessment. It is important to be aware there are no excuses for failing to conduct a thorough risk assessment as covered entities and business associates “know or should know” they have a responsibility to safeguard PHI.

Do the HIPAA risk assessment requirements apply to Business Associates?

The HIPAA risk assessment requirements apply to business associates as business associates are required to comply with the HIPAA Security and Breach Notification Rules and the two HIPAA standards relating to HIPAA risk assessments appear in these Rules. Business associates are also advised to conduct HIPAA Privacy Rule risk assessments if the nature of their activities for a covered entity could violate the privacy of individually identifiable health information.

What tools can assist organizations with a HIPAA risk assessment?

The tools that can assist organizations with a HIPAA risk assessment include a downloadable Security Risk Assessment (SRA) tool released by HHS’ Office for Civil Rights in 2014 to help small and medium-sized medical practices with the compilation of a HIPAA risk assessment. There are also many tools available from third party compliance experts that are best used for identifying issues in situations not covered by the Security Risk Assessment Tool (i.e., HIPAA Privacy Rule compliance).

The post HIPAA Risk Assessment appeared first on The HIPAA Journal.

FREE Webinar: Compliance Best Practices & Live Demo on Tues May 19

Posted by Steve Alder

Workforce Compliance

Healthcare compliance isn’t a checklist, it’s a program. And most organizations are managing it across a tangle of spreadsheets, binders, and disconnected tools.

Join Compliancy Group for a live session designed to cut through the complexity and give you a clearer picture of what an effective compliance program actually looks like and how to build one.

They will walk through industry best practices across the four core areas of compliance, sharing the dos and don’ts that separate defensible programs from costly gaps, and then show you exactly how Compliancy Group’s platform manages each area in one connected system.

What Will be Covered?

  • Risk & Assessment — How to conduct, document, and act on risk assessments the way OIG and OCR expect
  • Workforce Compliance — Training, attestations, and the employee-level accountability that auditors look for
  • Vendor Compliance — Why 70% of 2025 breaches trace back to business associates, and how to manage third-party risk
  • Incident Management & Hotline Reporting — Building a culture of reporting and a process that protects your organization

This isn’t a standard product demo. It’s a practical session built for compliance-responsible leaders who want real guidance and want to see what simplified, visible, and defensible looks like in practice.

 

WEBINAR DETAILS

Compliance Best Practices & Live Demo Session

  Date: Tuesday, May 19th 2026

Time: 1:00 p.m. ET | 12:00 p.m. CT | 11:00 a.m. MT | 10:00 a.m. PT

Format: Live webinar

 

 

Speaker: Liam Degnan, Director, Solutions Engineering

Liam Degnan Compliancy GroupLiam Degnan brings more than eight years of experience in risk management, SaaS sales, and healthcare compliance. As Compliancy Group’s Senior Solutions Engineer, he advises healthcare decision-makers, healthcare providers, and medical vendors. He speaks on a variety of platforms and topics, with an emphasis on simplifying HIPAA, OSHA, SOC 2, and other healthcare compliance regulations.

 

 

The post FREE Webinar: Compliance Best Practices & Live Demo on Tues May 19 appeared first on The HIPAA Journal.

ComplianceJunction HIPAA Training Receives SCCE Accreditation

Posted by Steve Alder

The Society of Corporate Compliance and Ethics (SCCE) has recently accredited ComplianceJunction’s ‘HIPAA Training for Organizations’ training course. The SCCE is an Eden Prairie, MN-based non-profit association dedicated to enabling the lasting success and integrity of organizations by promoting high standards in compliance and ethics programs. The SCCE, which has more than 19,000 members in over 100 countries, provides resources, education, and networking opportunities for ethics and compliance professionals and offers professional certification through the Compliance Certification Board (CCB). The CCB is an independent body that recognizes individuals with competence in the practice of compliance and ethics.

ComplianceJunction’s mission is to help healthcare organizations train their employees on HIPAA compliance and ensure they understand their responsibilities when it comes to health information privacy. ComplianceJunction has developed a training course that provides an overview of the Health Insurance Portability and Accountability Act (HIPAA) and serves as a foundation for developing a comprehensive HIPAA training program. The training has been used by more than 1,000 healthcare organizations and over 100 universities to raise awareness of the HIPAA regulations.

“ComplianceJunction’s customers include practice owners and senior managers who want to ensure that their staff members are kept up to date on the HIPAA regulations and their organization maintains compliance with the HIPAA training requirements,” explained ComplianceJunction’s Ryan Coyne. “The SCCE accreditation means their employees can now earn CEUs for completing the course, which provides an extra incentive for completing the training.” Healthcare professionals who complete the accredited HIPAA training course will earn 2.6 Continuing Education Units (CEUs) that demonstrate they are taking steps to stay up-to-date with current regulations and are continuing their education and professional development.

“The ComplianceJunction HIPAA training offers a detailed overview of HIPAA fundamentals, laying a solid foundation for developing a comprehensive training program. The modules and case studies are excellent tools to engage staff in further discussion and uncover additional role-specific training needs,” said Joanne Curran, Director of Health Information Management at the Greater Lawrence Family Health Center. “Staff appreciate the opportunity to earn CEUs for completing the training series and look forward to additional training offerings.”

The post ComplianceJunction HIPAA Training Receives SCCE Accreditation appeared first on HIPAA Journal.

How to Choose HIPAA Compliance Software

Posted by Ian

The best HIPAA compliance software gives a covered entity a structured way to meet HIPAA’s requirements: automated documentation, an ongoing risk management process, and a clear view of where the program stands.

In most organizations, responsibility for HIPAA compliance falls to an administrator, practice manager, or compliance officer who manages it alongside other responsibilities and without a formal background in healthcare regulation. For these individuals, the best HIPAA compliance software reduces the administrative burden, removes the need for deep compliance expertise, and lessens the likelihood of an expensive breach.

What Are The Benefits Of HIPAA Compliance Software?

The benefits of using HIPAA compliance software for an administrator or practice manager are as follows:

  • Reduced Administrative Burden: HIPAA compliance software automates many administrative tasks related to compliance management, such as tracking training requirements, managing documentation, and maintaining an organization’s HIPAA Security Risk Analysis. This frees up time and reduces the administrative burden.
  • Effective Risk Management: HIPAA compliance solutions provide tools for conducting risk assessments, identifying vulnerabilities, and implementing risk mitigation strategies.
  • Confidence In Role: The best HIPAA compliance software removes the need for specialized compliance knowledge. It offers a clear view of compliance status, guided workflows, and access to live compliance experts so that someone without a compliance background can manage the role effectively.
  • Peace of Mind: By using HIPAA compliance tracking software, organizations have a documented record that keeps pace with HIPAA as the regulations themselves change, without needing to track updates independently. This peace of mind reduces the stress and uncertainty associated with compliance management.

What To Consider When Purchasing HIPAA Compliance Software?

By following our buyer’s guide framework, you can make a thorough assessment of the best HIPAA compliance software options and select the most suitable solution to support your organization’s requirements. There are three aspects to consider when purchasing HIPAA compliance software which are discussed in detail below:

1. Essential Functionality

2. Software Specifications

3. Business Considerations

1. What Essential Functionality Is Required For HIPAA Compliance Software?

The best HIPAA compliance software should be a flexible system that follows a recognized framework like the HHS Office of Inspector General’s (OIG) Seven Fundamental Elements Of An Effective Compliance Program. It should offer a guided setup process and documentation tailored to the organization.

The solution needs to ultimately provide proof of compliance for patients, clients, and auditors.

For compliance officers with little experience, the initial setup of the software is key. The best HIPAA compliance solutions offer some form of live compliance coaching to guide you through each step of setting up your HIPAA compliance program.

The following essential functionality will allow you to confidently address your organization’s compliance requirements:

1. Risk Assessment

  • Risk assessment tools
  • Streamlined questionnaires for user-friendly risk analysis
  • Risk scoring
  • Gap identification
  • Ongoing HIPAA risk assessment maintenance
  • Remediation planning

2. Incident Response

  • Breach incident reporting
  • Breach management tools
  • Live breach support guidance

3. Policies & Procedures

  • Policies and procedures tailored for your practice
  • Policy and procedure management
  • Central storage of policies and procedures
  • Employee portal for easy access to review policies

4. Employee Training

  • Train, track, and manage HIPAA compliance training for employees
  • Up-to-date HIPAA compliance training modules
  • Personalized, individual employee training certificates

5. Vendor/ Business Associate Management

  • Identify and track business associates
  • Business associate agreement generation and management
  • Ability to loop business associates into your compliance program directly to eliminate silos

6. Multi-Site Management

  • Manage the compliance levels at each site in an organization separately

7. Reporting

  • Centralized documentation storage
  • Audit logging and reports
  • Visuals showing overall compliance status and gaps at a glance

Healthcare Compliance CategorieWhat other features should you consider for your HIPAA compliance solution?

  • Does the software dynamically generate documentation tailored for your practice, saving you from manually completing generic forms?
  • If you have compliance questions, does the software provide access to compliance experts?
  • Is the platform cloud-based and automatically updated to comply with the latest compliance legislation?
  • OSHA compliance is a separate regulatory obligation from HIPAA, but many practices need to manage both. If that applies to you, it’s worth checking whether your chosen software handles both, which can simplify things, but evaluate that capability as a convenience rather than as part of what makes the software HIPAA-compliant.

2. What Are The Software Specifications To Consider For HIPAA Compliance Solutions?

Software specifications are aspects of a solution, such as usability or scalability, that are not about specific functionality but describe the broader qualities of the software. Specifications will help inform your decision when comparing HIPAA compliance software solutions.

1. Ease Of Use

  • Assess the software’s overall user experience, including the user interface and navigation around the solution.
  • Does it include guided workflows for conducting compliance activities? This is vital to make it easier for individuals without deep compliance expertise to navigate the compliance process.
  • How user-friendly are the training modules that employees will be required to take as part of the organization’s compliance?
  • Consider how often staff will actually log into the platform. A solution that requires significant reorientation every visit, or that requires a support call to complete routine tasks, adds friction that discourages consistent use. The best solutions make it immediately clear what needs to be done and guide the user through it.

2. Scalability & Flexibility

  • Can the software accommodate your organization’s current scale, for example, to manage multiple locations?
  • Does it allow for that management without compromising the location specificity expected by the regulations?
  • Can it scale up and adapt to your organization’s evolving future needs?

3. Integration Capabilities

  • Cloud-based solutions are the easiest to implement, and have the advantage that ongoing infrastructure maintenance is the responsibility of the software vendor.

4. Future Proofing

  • How will the software vendor address regulatory changes and updates to ensure ongoing compliance in a timely manner?

3. What Are The Business Considerations When Choosing Software?

You may find that when evaluating functionality and specifications, a favored vendor will emerge and you feel ready to award them the business right away. It is highly recommended that you don’t allow yourself to be pressured into a fast decision before fully examining the commercial and business considerations.

1. Vendor Reputation

  • Is the software endorsed by any medical associations?
  • Is the software endorsed by any IT businesses/MSPs?
  • Do they have current case studies and testimonials from other healthcare organizations that have successfully implemented the software?
  • Check the online reviews to see what users like and dislike. Take with a grain of salt as most reviews tend to be one of two extremes, but trends do matter.
  • Ask specifically whether any customers have been through an OCR investigation while using the software and what the outcome was.

2. Vendor Training & Support

  • Does the vendor offer live support to guide you through the setup of their HIPAA compliance software solution?
  • Is there a separate cost for this, or is it included in the price?
  • After setup what ongoing support is offered and is this included in the vendor’s annual charges?
  • Will the vendor assist in the event of a breach or investigation?

3. Costs

  • Look for a transparent breakdown of pricing structures, including initial setup costs, licensing fees, and any additional charges for support or updates.
  • Confirm that the core HIPAA requirements (risk assessment, policies and procedures, training, and Business Associate Agreement management) are included in the base plan.
  • Is there a one-time purchase cost or is it a subscription-based model? Subscriptions have become the most common way to purchase cloud-based software.
  • If cost is an issue and it appears that the solutions on your shortlist are similar, ensure you create a price comparison table taking all factors into account, such as extra costs for training or support. For example, whether HIPAA training is included or not.
  • Does the vendor offer exclusive discounts? For example, they may offer a group discount for an association you may already be a member of.
  • When comparing costs, factor in the value of your own time. A lower-priced solution that requires significantly more manual effort may not represent better value once the true cost of that time is considered.

4. Software License Period

  • What is the commitment period and what does it mean for the level of support you can expect?
  • Commitment structures tend to work both ways. Month to month arrangements offer flexibility but may be offset with upfront costs for onboarding and lack of ongoing support.
  • An annual commitment usually signals a more substantial support model. The vendor has both the runway and the reason to make sure your program works.
  • For upfront cost concerns, look for vendors who offer payment flexibility within an annual commitment. Payment schedule and commitment length are not always the same thing.
  • Read the small print on any agreement before signing so you are aware of your obligations.

Free Buyer’s Guide

We have compiled a free buyer’s guide to choosing HIPAA compliance software. This includes a checklist for the three aspects discussed in this article where you can rate up to three different solutions and compare your results.

This guide to choosing the best HIPAA compliance software can be downloaded by filling in the form on this page.

 

The post How to Choose HIPAA Compliance Software appeared first on The HIPAA Journal.

HIPAA Pays Off: Why Invest in Compliance – Free Webinar Aug 17

Posted by Ian

Are you aware that investing in HIPAA compliance can actually result in increased revenue? Conversely, putting HIPAA compliance on the back burner can be detrimental to the organization.

The HIPAA compliance specialists, Compliancy Group, will be hosting a webinar to explain how investing in compliance can result in increased revenue.

Attendees will learn how and why investing time and money into HIPAA compliance can result in a positive year and will be provided with real-life examples of HIPAA-regulated entities that have invested time and money into their HIPAA compliance programs and have reaped the benefits.

Free Webinar Details

Thursday, August 17, 2023

11:00 a.m. PT ¦ 12:00 p.m. MT ¦ 1:00 pm CT ¦ 2:00 pm ET

Host: Compliancy Group

Speaker: Liam Degnan, Compliancy Group, Director of Strategic Initiatives

Please Use The Form On This Page To Sign Up

The post HIPAA Pays Off: Why Invest in Compliance – Free Webinar Aug 17 appeared first on HIPAA Journal.

What Are HIPAA Laws?

Posted by Ian

The main objective of HIPAA law is to protect the privacy of an individuals’ health information while at the same time permitting needed information to be disclosed for patient care and other purposes such as billing. This balance helps protect the rights of patients while ensuring smooth operation of the healthcare system.

HIPAA Law Checklist For HIPAA Law ComplianceHIPAA compliance laws set the standards for protecting sensitive patient data that healthcare providers, insurance companies, and other covered entities must adhere to. You can use our HIPAA Law Compliance Checklist to check your compliance requirements and avoid HIPAA violations.

What follows is an overview of the main components of HIPAA Law:

The HIPAA Law Privacy Rule

A key component of HIPAA compliance law is the Privacy Rule, which sets out national standards for when protected health information (PHI) may be used and disclosed.

PHI refers to any information about health status, provision of health care, or payment for health care that can be linked to a specific individual. This interpretation of PHI is broad and encompasses any part of a patient’s medical record or payment history.

Under the Privacy Rule, healthcare providers must implement necessary safeguards to protect the privacy of PHI. These safeguards are both physical (like locking filing cabinets) and technical (like password-protected electronic health records). Patients also have the right under the Privacy Rule to access, inspect, and obtain a copy of their PHI.

The HIPAA Law Security Rule

Another component of HIPAA compliance is the Security Rule. This rule applies specifically to electronic protected health information (ePHI), and covers the three types of security safeguards required: administrative, physical, and technical. These safeguards help to ensure that electronic patient data is secure from unauthorized access, loss, or damage.

Administrative safeguards focus on creating policies and procedures designed to clearly show how a Covered Entity must comply with HIPAA. Physical safeguards involve securing the physical facilities and equipment where data is stored and accessed. Technical safeguards refer to the technology and policy and procedures for its use that protect ePHI and control access to it.

HIPAA Privacy Officers

Under the HIPAA compliance laws, organizations are obligated to designate a privacy officer responsible for implementing and maintaining the policies. PHI access should be strictly limited on a “need-to-know” basis, thereby ensuring that only those who need this information to perform their job responsibilities can access it.

Who Is Subject To HIPAA?

The standards for electronic transactions which qualify an organization as a HIPAA-Covered Entity appears in CFR 45 Part 2. Generally, an organization is a HIPAA Covered Entity when it is:

  • A healthcare provider that conducts electronic transactions.
  • A health plan
  • A healthcare clearinghouse

Exceptions to this definition occur where an organization that does not qualify as a Covered Entity are somewhat involved in covered transactions.  For example, if they act as an intermediary between an employee, a healthcare provider, and a health plan.

Additionally, an organization that self-administers a health plan but has less than fifty participants is not considered to be a Covered Entity.

HIPAA Law For Business Associates

A vital aspect of compliance is the execution of Business Associate Agreements (BAAs) with any third-party vendors accessing PHI. These agreements set the standard for PHI use and disclosure by business associates, placing limits and conditions on their actions involving PHI.

Does HIPAA Apply To Employment Records?

One potentially confusing area of the Administrative Simplification Regulations relates to employment records, HIPAA law, and employers. This is because the definition of individually identifiable health information in §160.103 includes “information collected from an individual or created or received by a health care provider, health plan, employer, or health care clearinghouse.”

However, the definition of Protected Health Information (also in §160.103) excludes “employment records held by a Covered Entity in its role as an employer.” This exclusion applies to individually identifiable health information an employer might receive and maintain in an employment record to explain – for example – the reason for a leave of absence due to sickness or an injury.

HIPAA Law Enforcement and Penalties

Enforcement of HIPAA regulations is managed by the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS). If an entity is found to be non-compliant with HIPAA, they can face hefty fines and penalties. Fines are tiered based on the entity’s knowledge and handling of the breach.

The HIPAA Safe Harbor Law, introduced in January 2021, takes into account existing security practices when determining HIPAA violation penalties. For instance, if an entity didn’t know and, by exercising reasonable diligence, wouldn’t have known of a violation, the penalty may be less severe. However, if a violation is due to willful neglect and not corrected, the penalty can be very significant.

Summary: HIPAA Compliance Laws

HIPAA compliance laws are an essential aspect of healthcare, ensuring the protection and secure handling of sensitive patient health information. By establishing a framework of compliance through its Privacy and Security Rules, HIPAA has become a linchpin of patient rights and privacy within the healthcare sector.

As healthcare professionals, understanding and adhering to HIPAA regulations is not just a legal obligation but also a commitment to maintaining the trust and confidence of the patients they serve. The adherence to HIPAA compliance laws forms a crucial part of any covered entity’s operational framework.

The post What Are HIPAA Laws? appeared first on HIPAA Journal.

Seven Elements Of A Compliance Program

Posted by HIPAA Journal

The Seven Elements HIPAA Compliance Software SolutionThe seven elements of a compliance program are integrated processes organizations can adopt to help develop a culture of compliance in the workplace; and, when applied effectively, the seven elements can also be used to streamline operational processes, optimize organizational performance, and reduce overall costs.

Because HIPAA compliance can be confusing, we have compiled this guide to the seven elements to make them relevant for HIPAA. Some compliance software solutions guide compliance officers through the seven elements as part of their set-up process.

Summary Of The Seven Elements

While the seven elements of a compliance program apply to all industries, they originated in the healthcare industry in the 1990s. This was in response to the growing level of healthcare fraud and abuse and an alleged “compliance disconnect” at the executive level in many hospitals and health systems.

These are the seven elements, which we outline in more detail below:

#1: Implement written policies, procedures, and standards of conduct.
#2: Designate a compliance officer and a compliance committee.
#3: Conduct effective training and education.
#4: Develop effective lines of communication.
#5: Conduct internal monitoring and auditing.
#6: Enforce standards through well-publicized disciplinary guidelines.
#7: Respond promptly to detected offenses and undertake corrective action.

The Seven Elements For Effective HIPAA Compliance

Despite being more than twenty-five years old – and not necessarily having been adopted to tackle the same issues – many organizations still use the seven elements in their original format.

The Background to the Seven Elements

In 1991, the Department of Health and Human Services (HHS) launched the Workgroup for Electronic Data Interchange (WEDI). WEDI had the objective of reducing administrative costs in the healthcare system by promoting electronic claims submission.

It achieved its objective by requiring insurance carriers to reimburse healthcare providers more quickly for electronic claims than for paper claims, thus encouraging providers to submit more claims electronically.

As a result, the percentage of claims submitted electronically over the next five years more than doubled – making it harder for adjudicators to identify fraud and abuse attributable to unbundling, duplication, and global service violations.

According to a Congressional Report published by the General Accounting Office in 1995, it was estimated that as much as 10 percent of national healthcare spending was attributable to waste, fraud, and abuse (around $98 billion at the time).

The following year, the long-running Caremark Derivative Litigation case concluded – a case in which it was claimed the company’s board of directors had failed in their fiduciary duty of care to ensure the company’s compliance program was enforced.

Although cleared of “lacking good faith in the exercise of monitoring duties or conscientiously permitting a known violation to occur”, the company settled multiple felony charges against it by paying $250 million in civil and criminal fines.

The relevance of this case is that Caremark’s primary operations were providing patient care and managed care services; and, although the company had implemented compliance policies to prevent breaches of Anti-Referral Payments Laws, a series of violations resulted in shareholders claiming the board of directors had failed to adequately enforce the policies and, as a result, exposed the company to regulatory fines.

This accusation was not lost on the HHS’ Office of Inspector General (OIG).

OIG Publishes First Model Compliance Plan

The year after the conclusion of the Caremark Derivative Litigation case, OIG published its first model compliance plan (62 FR 9435-9441). Although aimed at clinical laboratories, the model compliance plan consisted of seven “compliance plan elements” that subsequently evolved into “the seven fundamental elements of an effective compliance program” in later compliance plans for hospitals, home health agencies, hospices, and nursing facilities.

The primary objective of the plan is fairly transparent. In the preamble to each of the plans, OIG states “many providers and provider organizations have expressed an interest in better protecting their operations from fraud and abuse through the adoption of voluntary compliance programs.” The word “fraud” is repeated a further twenty-eight times in the compliance plan for hospitals (63 FR 8987) and the compliance plan for nursing facilities (65 FR 14289).

It is also noticeable that, from the second plan onward, each plan includes a footnote stating “recent case law suggests that the failure of a corporate Director to attempt in good faith to institute a compliance program in certain situations may be a breach of a Director’s fiduciary obligations” – referencing the Caremark Derivative Litigation case. Clearly, OIG wanted to send the message that, if a voluntary compliance plan was implemented, oversight of the plan was expected.

The biggest influence for the creation of the seven elements of a compliance program (fraud prevention) is sometimes overlooked. This is not necessarily a bad thing because – around the same time – the passage of HIPAA introduced fraud controls and transaction standards that made it harder for healthcare providers to defraud or abuse the system. However, the seven elements can be adapted for more positive purposes than preventing, detecting, and responding to fraud.

What are the Seven Elements of a Compliance Program?

The Seven Elements Of A Compliance ProgramSince the first appearance of the seven elements, some versions have been amended or extended to meet organizational or regulatory requirements.

For example, when the Affordable Care Act made a compliance program a requirement of Medicare participation for some healthcare providers (42 CFR §483.85), an element was added that prohibits organizations from delegating discretionary authority to individuals who “the organization knew, or should have known through the exercise of due diligence, had the propensity to engage in criminal, civil, and administrative violations of the Social Security Act.”

However, as mentioned in the introduction to this article, many organizations that have implemented a compliance plan voluntarily still use the seven elements of a compliance program in their original format.

Please use the form on this page to arrange to receive a free copy of the HIPAA Compliance Checklist to use with the seven elements of a compliance program.

#1 Implement written policies, procedures, and standards of conduct

The best HIPAA compliance softwareThe seven elements of a compliance program are often depicted as a linear “start-to-finish” program or as a wheel that starts revolving again when it is completed its first cycle. Neither depiction is entirely accurate, as the seven elements of a compliance program have to integrate with each other at all times to make the program work effectively and facilitate improvements to the program.

The first of the seven elements of a compliance program is a suitable example of why it is important to view a compliance program holistically because it calls for the development of standards (etc.) under the direction of a compliance officer. Yet organizations are not advised to designate a compliance office until element #2:

“Every compliance program should develop and distribute written compliance standards, procedures, and practices that guide the facility and the conduct of its employees throughout day-to-day operations. These policies and procedures should be developed under the direction and supervision of the compliance officer, the compliance committee, and operational managers.”

If you view the seven elements of a compliance program as a linear program, you could be confused when the second element instructs you to designate the compliance officer you need to complete the first element. You might also be confused if you view the compliance program as a wheel, because it means you will need to rotate the wheel counter clockwise from #2 to #1.

#2 Designate a compliance officer and compliance committee

The temptation with element #2 is to delegate the role of compliance officer and the membership of a compliance committee to members of the same HR, legal, or operations teams or department heads of these teams. This can be a mistake if (for example) the legal team does not understand the real-life challenges of compliance in the workplace.

While it is a good idea to head the compliance committee with a person of authority, it is beneficial to include personnel with public-facing roles (i.e., healthcare professionals) and a mixture of personnel from IT, security, and administration who can provide insights on which policies will work and which won’t without changes to working practices.

#3 Conduct effective training and education

Integrating training and education into a compliance program should not be difficult for most organizations in the healthcare industry, as the majority are required to comply with the HIPAA training requirements, while some are also required to provide annual compliance training as a condition of participation in the Medicare program.

Of significance, in the original seven elements of a compliance program, OIG notes that the continual retraining of personnel at all levels (emphasis added) is a significant element of an effective compliance training program. Along the same lines, OIG adds that adherence to the elements of the compliance program should be a factor in evaluating the performance of managers and supervisors.

#4 Develop effective lines of communication

The development of effective lines of communication is pivotal to the seven elements of a compliance program because effective lines of communication are necessary for members of the workforce to raise questions, report violations, and provide feedback on corrective action plans that may necessitate amendments to policies and procedures and further training.

Ideally the creation and maintenance of effective lines of communication between the compliance officer/committee and the workforce should include a hotline or anonymous reporting system to receive questions, reports, and feedback. Organizations should also adopt procedures to protect the anonymity of complainants and to protect whistle-blowers from retaliation.

#5 Conduct internal monitoring and auditing

This element of an effective compliance program provides an opportunity for executive officers to demonstrate oversight by requesting compliance reports and audits from the compliance officer. In healthcare environments, these reports and audits should be conducted regularly to comply with the HIPAA requirement for regular risk analyses and be available at all times for executive review.

If executive officers participate in this element, it also provides an opportunity to extend lines of communication “from the top to the bottom”. Although it is not always practical to have members of the workforce communicate directly with executive officers (and vice versa), the involvement of executive officers demonstrates a commitment to compliance throughout the entire organization.

#6 Enforce standards through well-publicized disciplinary guidelines

Most organizations distribute disciplinary guidelines at the point of training. Indeed, in the healthcare industry, the standards relating to training and sanctions are almost adjacent to the Administrative Requirements of the Privacy Rule – so it is rare that an explanation of the organization’s sanctions policy is not included in initial HIPAA training.

With regard to enforcing standards, it is important that sanctions are applied fairly. If one group of the workforce is sanctioned more often or more harshly than another group for no justifiable reason, executive officers need to find out why. While it may be the case that one manager is enforcing standards over-zealously, it may equally be the case that another manager is allowing the workforce to take shortcuts with compliance “to get the job done”.

#7 Respond promptly to detected offenses and undertake corrective action

When the seven elements of a compliance plan were originally published in the 1990s, this element focused almost entirely on detecting fraud, reporting it, and enforcing sanctions or implementing measures to prevent it from happening again. With fraud prevention being a less important objective of a compliance plan than it was twenty-five years ago, this element can be used to monitor the effectiveness of the compliance program and improve it where necessary.

For example, if an offense has occurred due to a loophole in a policy (element #1), a lack of training (#3), a communication failure (#4), or a monitoring issue (#5), the compliance officer (#2) can evaluate the existing policies, procedures, and standards, and adjust them as necessary (#7). If the offense has occurred due to the actions of a non-compliant member of the workforce, it may be necessary to increase the penalties in the sanctions policy (#6) to be more of a deterrent.

The Challenges and Benefits of Adopting a Compliance Plan

Software For Compliance OfficersAdopting the seven elements of a compliance plan can be challenging for an organization starting from scratch. It can be difficult to get leadership buy-in because compliance is not perceived as a revenue generator, it can be difficult to define compliance roles in a complex regulatory environment, and it can be difficult to pull everything together with limited resources.

In healthcare environments, these challenges are mitigated by the fact that many of the elements are – or should be – already in place. HIPAA-covered entities should have developed policies and procedures to comply with the Privacy Rule, have a training and sanctions program up and running, and have procedures for conducting internal audits and responding to data breaches.

All that needs to be done in many healthcare environments is for the compliance officer to bring together the seven elements of a compliance plan into one integrated plan. When managed effectively, the plan will help organizations develop a culture of compliance that can help to reduce costs (i.e., regulatory fines), enhance the organization’s operations (i.e., through improved communication), and advance the quality of healthcare.

This final benefit of adopting a compliance plan is one many organizations are only starting to realize as it has only recently been demonstrated that, when patients believe PHI will remain confidential, they tend to be more forthcoming about healthcare issues. This enables healthcare professionals to make better-informed diagnoses and prescribe more effective courses of treatment, which results in better patient outcomes, satisfaction scores, workplace morale, and staff retention.

Get Help Developing Your Compliance Plan

Multiple sources on the Internet offer help with developing a compliance plan. One of the best is the HHS’ Office of Inspector General compliance guidance web page which includes updated guidance on the seven elements of a compliance program in its General Compliance Program Guidance document.

However, if your organization is a multi-disciplined Covered Entity or Business Associate, and you need more granular help developing a compliance plan, it may be worthwhile reviewing our HIPAA compliance checklist.

Steve Alder, Editor-in-Chief, The HIPAA Journal

The post Seven Elements Of A Compliance Program appeared first on The HIPAA Journal.

AI in Healthcare

Posted by HIPAA Journal

The topic of AI in healthcare often gets mixed reactions. While some people are firm believers in the benefits of AI in healthcare and the considerable benefits to patients, others have concerns about the ethics of AI in healthcare and there is considerable apprehension about the use of AI in healthcare attributable to a lack of knowledge about AI. In this article, we will explain what artificial intelligence is, the benefits of AI in healthcare, and how concerns about the ethics of AI in healthcare need to be overcome. 

What is Artificial Intelligence (AI)?

One of the reasons why some people approach the topic of AI in healthcare with a degree of apprehension is that different sources offer different definitions of AI. It is also the case that some sources confuse AI with Machine Learning (ML), which strictly speaking is a subset of AI. To quote Microsoft’s definitions of the two terms: 

Artificial intelligence is the capability of a computer system to mimic human cognitive functions such as learning and problem-solving. Through AI, a computer system uses math and logic to simulate the reasoning that people use to learn from new information and make decisions.

Machine learning is an application of AI. It is the process of using mathematical models of data to help a computer learn without direct instruction. This enables a computer system to continue learning and improving on its own, based on experience.

Therefore, while AI and ML are closely connected, they are not the same. Generally, a computer system uses AI to think like a human and perform tasks on its own, whereas ML is how a computer system develops its intelligence. Importantly, many of the concerns related to AI in healthcare revolve around how computer systems develop Artificial Intelligence and their capabilities to learn and make decisions without human instruction.

How Computer Systems Develop Artificial Intelligence

There are many different standard and hybrid techniques that determine how computer systems develop Artificial Intelligence. Generally, most follow the same two-stage process:

Supervised Learning

Most new AI systems start with a supervised learning process in which labeled datasets with known outcomes are fed into a system to train an algorithm on how to classify data. The outcomes produced by the system are then weighted to match the previously known outcomes. Often, this stage is followed by “semi-supervised learning” in which labeled datasets guide the algorithm as it classifies unlabeled datasets and predicts outcomes for the unlabeled data.

Unsupervised Learning

In unsupervised learning, the trained algorithm has to detect underlying patterns and relationships in never-before-seen unlabeled data in order to produce accurate outcomes. With unsupervised learning, it is important to remember that the aim is to make sense of data in the context of a specific question. How the answer is determined will depend on how the algorithm has been trained and weighted during the supervised and semi-supervised stages.

While this explanation might fail to reassure those who are concerned or apprehensive about AI – because “answers” are dependent on how the algorithm has been trained, the quality of data used to train the algorithm, how the output is weighted, and what the question is that the algorithm is trying to answer – artificial intelligence has in fact been present in many areas of everyday life for several years. For example:

  • Most people have played a video game against an AI-driven computer
  • AI is used by the finance industry to detect potential credit card fraud
  • The security industry uses AI to monitor multiple clusters of CCTV systems 
  • Netflix “because you watched” recommendations are produced by AI
  • AI produces the routes recommended by Google Maps and other travel apps
  • Many email spam filters and antivirus software solutions are fine-tuned by AI

But, what about AI in healthcare? How is that being used, who is using it, and what are the benefits? Additionally, are concerns about the ethics of AI in healthcare justified; and, if so, what can be done to overcome the concerns? These questions are easier to answer with an understanding of what AI is and how computer systems develop artificial intelligence.

Examples of AI in Healthcare

AI in healthcare is an umbrella term for all the many different ML algorithms and other cognitive technologies that are used in the healthcare industry. Some algorithms are more advanced than others, most have been designed to answer specific questions, and – even when the specific question is the same – some have been trained or weighted differently from others.

Consequently, there are many examples of AI in healthcare from patient-orientated AI such as chatbots that can listen to a patient’s symptoms and health concerns, to pharma-orientated AI that can help bring life-saving treatments to market faster. Between either end of the healthcare spectrum, there are many more examples of AI in healthcare:

Medical Imaging

Using computer vision to identify health conditions in medical images is quickly becoming a primary use for AI-driven technology. More advanced algorithms can distinguish tumors from lesions and other diseases – resulting in more accurate diagnoses, faster administration of treatments, and better patient outcomes. 

Precision Medicine

Similarly, computer systems that have been trained on precision medicine can develop medicinal or behavioral regimes specifically tailored to each patient depending on their condition, metabolic profile, microbiome composition, diet, lifestyle, sleep patterns, and many more data points collected and analyzed over years.

Physician Guidance

While robots performing major surgeries may still be a science fiction fantasy, some AI technologies have been developed that can guide physicians during minimally invasive surgical procedures via automated workflows and decision support. Most often, these technologies are used in treating strokes and heart conditions and for endovascular procedures.

Detecting Patient Deterioration

In post-acute environments, healthcare providers dedicate a lot of resources to checking vital signs to identify postoperative adverse events. AI-enabled tools can help care teams by calculating early warning scores that detect patient deterioration due to events such as respiratory failure or cardiac arrest – thus enabling more rapid responses. 

Predictive Equipment Maintenance

As well as detecting patient deterioration, AI can be deployed to predict when medical equipment is in need of maintenance. Through remote sensing, AI can monitor the performance of medical hardware to proactively identify when it may need maintenance or replacement – reducing downtime, preventing avoidable interruptions to clinical practice, and mitigating patient delays.

Automated Resource Allocation

A major administrative challenge for large healthcare providers is patient flow and resource allocation. The failure to have the right resources in the right place at the right time puts patients at risk and increases unnecessary bed occupancy. However, using AI to identify patterns from real-time and historical data enables providers to optimize flow management efficiency.

Healthcare AI Companies 

Compiling a list of healthcare AI companies is difficult because companies face multiple challenges in developing AI solutions that demonstrate real-world performance, meet medical needs, and address regulatory requirements. Consequently, many start-ups fail to make an impact in the healthcare industry and redirect their talents elsewhere. Some of those currently making an impact include:

PathAI

PathAI was founded with the aim of developing AI technology that could reduce error rates in pathology. The company’s AISight pathology platform was developed, trained, and validated using more than fifteen million annotations, and PathAI is now in the process of developing diagnostic solutions for gastroenterologists, dermatologists, oncologists, urologists, and gynecologists.

Regard

Unlike patient-orientated AI which can help users identify the causes of symptoms, Regard is an end-to-end AI solution for physicians that analyzes and synthesizes patient data, recommends diagnoses, and automates note-taking. By mitigating the risk of misdiagnoses and tackling repetitive tasks, physicians have more time available to see more patients and maximize revenues.

Freenome

Freenome is one of a number of healthcare AI companies that combine computational biology and machine learning to support better cancer management through early detection and precision intervention. Freenome’s AI platform can be deployed at general screenings or used to detect signs of cancer in diagnostic and blood tests.

Beth Israel Lahey Health

The Beth Israel Deaconess Medical Center – also known as Harvard University’s teaching hospital – used 25,000 images of blood samples to develop an AI-enhanced microscope that can detect harmful bacteria such as staphylococcus and E. coli much faster than is possible using manual scanning. To date, the microscopes have achieved a 95% accuracy rate.

VirtuSense

VirtuSense uses AI sensors to track inpatients’ movements so that providers and caregivers can be notified of potential falls. The company’s product range includes VSTAlert, which can predict when a patient intends to stand up to alert care reams, and VST Balance, which employs AI and machine vision to analyze a person’s risk of falling within the next year.

Benefits of AI in Healthcare

The above examples of AI in healthcare and technologies developed by healthcare AI companies focus on the “in-house” benefits of AI in healthcare inasmuch as they help deliver accurate diagnoses and treatment plans, prevent adverse events and accidents, and improve patient flow management. Outside of hospital environments, there are many further benefits of AI in healthcare. 

From a patient’s perspective, AI technologies not only improve outcomes and help prevent adverse events in hospitals but can also enhance the remote patient experience. Advocates of AI in healthcare see AI as a way of providing convenient access to medical advice in the home, increasing patient engagement, and empowering patients to take more responsibility for their health and well-being.

Further benefits of AI in healthcare relate to how quickly pharmaceutical companies can bring new drugs to markets. Drug development processes can be significantly accelerated with AI technologies that quickly extract meaningful information from large datasets to predict harmful interactions with existing drugs, improve the quality of clinical trials, and reduce time to approval.

One recent example of the benefits of AI in healthcare is how AI was used during the COVID-19 pandemic to detect outbreaks, facilitate diagnoses, and accelerate gene sequencing. It is hoped that, as a tool for public health, AI can be used in the future to predict and track the spread of other infectious diseases by analyzing data from government, healthcare, and other sources.

Ethics of AI in Healthcare 

According to a survey conducted by Dataiku in 2020, concern about the ethics of AI in healthcare is the primary organizational challenge stalling the adoption of AI in healthcare environments. Although specific concerns differ by organization, the concerns can generally be categorized as informed consent to use data, safety and transparency, algorithmic fairness, and data privacy. 

These concerns are not unique to the United States nor to the healthcare industry. Governments and regulatory agencies across the world have struggled to resolve this challenge – with many implementing rules and regulations to govern how AI is used. In the United States, a patchwork of state and federal laws partially addresses the challenge, but many concerns remain.

To help support governments and regulatory agencies pass fair and consistent legislation, in 2021 the World Health Organization published guidance on the “Ethics and Governance of Artificial Intelligence for Health”. This comprehensive publication endorses six key ethical principles for consideration by governments, developers, companies, and society as a whole:

  • Protect human autonomy
  • Promote human well-being, safety, and the public interest 
  • Ensure transparency, explainability, and intelligibility
  • Foster responsibility and accountability
  • Ensure inclusiveness and equity
  • Promote AI that is responsive and sustainable

Although political influences have resulted in the United States AI strategy shifting towards a market-orientated approach, the National Defense Authorization Act 2021 instructed the National Institute of Standards and Technology (NIST) to develop a framework for trustworthy AI systems that establishes common definitions and characterizations for aspects of trustworthiness. 

With the exception of protecting human autonomy, the five remaining key ethical principles endorsed by the World Health Organization likely will be incorporated into the framework according to NIST’s latest report to Congress. If approved by Congress, the NIST AI standards could resolve many of the concerns about the ethics of AI in healthcare.

How NIST Standards Could Accelerate AI Adoption in Healthcare

In January 2021, a HITECH Act update came into effect – an amendment that gave the HHS’ Office for Civil Rights enforcement discretion when investigating data breaches if the breached organization could demonstrate twelve month’s continuous compliance with “standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the NIST Act” or a similar Act.

There is no evidence that HIPAA Covered Entities and Business Associates took their compliance obligations any more seriously after the enactment of the HITECH Act update, but it is noticeable that – despite a significant increase in the number of financial penalties issued by HHS’ Office for Civil Rights in the past two years – only four have been for violations of the Security Rule.

If there are amendments to the NIST Act to incorporate AI standards, and if a law is passed giving HHS’ Office for Civil Rights enforcement discretion when the standards are applied in healthcare organizations, this could accelerate AI adoption in healthcare as not only would it resolve many of the concerns about the ethics of AI in healthcare, it would also resolve the second highest challenge to the adoption of AI in healthcare (according to Dataiku) – the lack of regulatory guidance.

The Future of AI in Healthcare

The future of AI in healthcare is unclear if concerns about the ethics of AI in healthcare and the lack of regulatory guidance are allowed to continue. If the situation remains as it is, AI will continue to be incorporated into healthcare processes in piecemeal stages – which will continue to add value to healthcare operations and improve the patient experience but may result in inequalities that could make the wider adoption of AI in healthcare much more difficult in the future. 

Alternatively, and notwithstanding that AI technologies are improving and becoming more sophisticated all the time, federal agencies – including the HHS – could introduce temporary guidance on the use of AI until such time as effective standards are developed. This would give healthcare organizations more confidence to adopt AI technologies with benefits for patients, organizations, and public health in general.



The post AI in Healthcare appeared first on HIPAA Journal.