HIPAA Compliance News

OCR Clarifies HIPAA Rules on Disclosures to Family, Friends and Other Individuals

Posted by HIPAA Journal

The recent attack in Las Vegas has prompted the Department of Health and Human Services’ Office for Civil Rights to clarify HIPAA Rules on disclosures to family, friends and other individuals.

Following Hurricane Irma and Hurricane Maria, OCR issued a partial waiver of certain provisions of the HIPAA Privacy Rule in the disaster areas of both hurricanes. OCR sometimes, but not always, issued such a waiver after a natural disaster when a public health emergency has been declared.

However, OCR did not issue a HIPAA Privacy Rule waiver after the attack in Las Vegas, and neither was a waiver issued following the Orlando nightclub shootings in 2016. OCR does not usually issue waivers of HIPAA Rules following shootings and other man-made disasters. Healthcare organizations involved in the treatment of victims of the Las Vegas shootings were required to continue to follow the provisions of the HIPAA Privacy Rule.

In its reminder about HIPAA Rules on disclosures to family, friends and other individuals, OCR explained that the HIPAA Privacy Rule allows healthcare organizations to disclose PHI to family, friends, and other individuals that have been identified by a patient as being involved in his or her care. PHI may also be shared to help identity or locate individuals involved in a patient’s care, or to notify them of the patient’s location, health status, or death.

In an emergency situation, covered entities should try to obtain verbal permission from the patient to share information, although when this is not possible, such as when a patient is incapacitated, it is down to the professional judgement of the covered entity to determine whether sharing information is in the patient’s best interest.

In the case of natural disasters, PHI may need to be shared with disaster relief organizations to assist with disaster relief efforts. While permission should be obtained, it is not necessary if obtaining permission would interfere with the organization’s ability to respond to an emergency situation.

The HIPAA Privacy Rule permits covered entities to inform the media about a specific patient’s general health condition (critical, stable, deceased, or treated and released) if a request is made about a patient that is mentioned by name, provided the patient has not previously objected to the sharing of such information, in which case the patient’s request should be honored.

Any sharing of other information, such as test results, details of an illness, or other health information, must generally only be shared if permission has first been obtained from the patient in writing.

Whenever PHI is shared, the minimum necessary standard applies and any PHI shared must be limited to the minimum necessary information to achieve the purpose for which the information is shared.

The provisions of the HIPAA Privacy Rule are detailed in: 45 CFR 164.510(b) – Disclosures to family, friends, and other individuals involved in a patient’s care; 45 CFR 164.510(a) – Disclosures to the media and individuals not involved in a patient’s care; 45 CFR 164.508 – HIPAA authorizations; 45 CFR §§ 164.502(b) and 45 CFR §§ 164.514(d) – The minimum necessary standard.

The post OCR Clarifies HIPAA Rules on Disclosures to Family, Friends and Other Individuals appeared first on HIPAA Journal.

What are the HIPAA Breach Notification Requirements?

Posted by HIPAA Journal

All HIPAA covered entities must familiarize themselves with the HIPAA breach notification requirements and develop a breach response plan that can be implemented as soon as a breach of unsecured protected health information (PHI) is discovered. HIPAA training for staff must also include the procedures for reporting breaches of unsecured PHI.

While most HIPAA covered entities should understand the HIPAA breach notification requirements, organizations that have yet to experience a data breach may not have a good working knowledge of the requirements of the Breach Notification Rule. Vendors that have only just started providing a service to Covered Entities may similarly be unsure of the reporting requirements and actions that must be taken following a breach.

The issuing of notifications following a breach of unencrypted PHI is an important element of HIPAA compliance. The failure to comply with HIPAA breach notification requirements can result in a significant financial penalty in additional to that impose for the data breach itself. With this in mind, we have compiled a summary of the HIPAA breach notification requirements for covered entities and their business associates.

Summary of the HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule – 45 CFR §§ 164.400-414 – requires covered entities and their business associates to report breaches of unsecured electronic protected health information and physical copies of protected health information. A breach is defined as the acquisition, access, use, or disclosure of unsecured protected health information in a manner not permitted by HIPAA Rules.

According to the HHS´ guidance on the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured protected health information is presumed to be a breach unless the covered entity or business associate demonstrates there is a low probability the protected health information has been compromised based on a risk assessment of at least the following factors:

  1. The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;
  2. The unauthorized person who used the protected health information or to whom the disclosure was made;
  3. Whether the protected health information was actually acquired or viewed; and
  4. The extent to which the risk to the protected health information has been mitigated.

HIPAA breaches include unauthorized access by employees as well as third parties, improper disclosures, the exposure of protected health information, and ransomware attacks. Exceptions include: Breaches of secured protected health information such as encrypted data when the key to unlock the encryption has not been obtained; “any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure;” An inadvertent disclosure by a person who is authorized to access PHI, to another member of the workforce at the organization who is also authorized to access PHI; When the covered entity or business associate makes a disclosure and has a good faith belief that the information could not have been retained by the person to whom it was disclosed.

In the event of a reportable HIPAA breach being experienced, the HIPAA breach notification requirements are:

Notify Individuals Impacted – or Potentially Impacted – by the Breach

All individuals impacted by a data breach, who have had unsecured protected health information accessed, acquired, used, or disclosed, must be notified of the breach. Breach notifications are also required for any individual who is reasonably believed to have been affected by the breach.

Breach notification letters must be sent within 60 days of the discovery of a breach unless a request to delay notifications has been made by law enforcement. In such cases, notifications should be sent as soon as that request has expired. While it is permissible to delay reporting of a breach to the HHS for breaches impacting fewer than 500 individuals (see below), that delay does not apply to notifications to breach victims.

Breach notification letters should be sent by first class mail to the last known address of breach victims, or by email if individuals have given authorization to be contacted electronically.

The HIPAA breach notification requirements for letters include writing in plain language, explaining what has happened, what information has been exposed/stolen, providing a brief explanation of what the covered entity is doing/has done in response to the breach to mitigate harm, providing a summary of the actions that will be taken to prevent future breaches, and giving instructions on how breach victims can limit harm. Breach victims should also be provided with a toll-free number to contact the breached entity for further information, together with a postal address and an email address.

Notify the Department of Health and Human Services

Notifications must be issued to the Secretary of the Department of Health and Human Services, via the Office for Civil Rights breach reporting tool. The HIPAA breach notification requirements differ depending on how many individuals have been impacted by the breach.

When the breach has impacted more than 500 individuals, the maximum permitted time for issuing the notification to the HHS is 60 days from the discovery of the breach, although breach notices should be issued without unnecessary delay. In the case of breaches impacting fewer than 500 individuals, HIPAA breach notification requirements are for notifications to be issued to the HHS within 60 days of the end of the calendar year in which the breach was discovered.

Notify the Media

HIPAA breach notification requirements include issuing a notice to the media. Many covered entities that have experienced a breach of protected health information notify the HHS, relevant state attorneys general, and the patients and health plan members impacted by the breach, but fail to issue a media notice – a violation of the HIPAA Breach Notification Rule.

A breach of unsecured protected health information impacting more than 500 individuals must be reported to prominent media outlets in the states and jurisdictions where the breach victims reside – See 45 CFR §§ 164.406. This is an important requirement, as up-to-date contact information may not be held on all breach victims. By notifying the media, it will help to ensure that all breach victims are made aware of the potential exposure of their sensitive information. As with the notifications to the HHS and breach victims, the media notification must be issued within 60 days of the discovery of the breach.

Post a Substitute Breach Notice on the Home Page of the Breach Entity’s Website

In the event that up-to-date contact information is not held on 10 or more individuals that have been impacted by the breach, the covered entity is required to upload a substitute breach notice to their website and link to the notice from the home page. The link to the breach notice should be displayed prominently and should remain on the website for a period of 90 consecutive days. In cases where fewer than 10 individuals’ contact information is not up-to-date, alternative means can be used for the substitute notice, such as a written notice or notification by telephone.

Data Breaches Experienced by HIPAA Business Associates

Business associates of HIPAA-covered entities must also comply with the HIPAA breach notification requirements and can be fined directly by the HHS’ Office for Civil Rights and state attorney generals for a HIPAA Breach Notification Rule violation.

Any breach of unsecured protected health information must be reported to the covered entity within 60 days of the discovery of a breach. While this is the absolute deadline, business associates must not delay notification unnecessarily. Unnecessarily delaying notifications is a violation of the HIPAA Breach Notification Rule.

It is usually the covered entity that will issue breach notifications to affected individuals, so any breach notification will need to be accompanied with details of the individuals impacted. It is a good practice to issue a breach notification to a covered entity rapidly, and to provide further information on the individuals impacted once the investigation has been completed. Under the terms of a HIPAA-compliant Business Associate Agreement (BAA), a business associate may be required to issue breach notifications to affected individuals.

Timeline for Issuing Breach Notifications

Breach notifications should be issued as soon as possible and no later than 60 days after the discovery of the breach, except when a delay is requested by law enforcement. Investigating a breach of protected health information can take some time, but once all the necessary information has been obtained to allow breach notifications to be sent they should be mailed.

HIPAA-covered entities must not delay sending breach notification letters. It is possible to receive a HIPAA violation penalty for delaying notifications, even if they are sent within 60 days of the discovery of the breach. There have been several recent cases of HIPAA breach notification requirements not being followed within the appropriate time frame, which can potentially result in financial penalties.

State Breach Notification Laws May Be Stricter than HIPAA

U.S. states have their own breach notification laws. Typically, notifications must be issued to breach victims promptly and a notice also submitted to the state attorney general’s office. Some states require breach notifications to be issued well within the HIPAA deadline.

Delaying breach notifications until the 60-day limit of HIPAA could well see state laws violated, leading to financial penalties from state attorney generals. State laws frequently change so it is important to keep up to date on breach notification laws in the states in which you operate.

Penalties for Violations of HIPAA Breach Notification Requirements

HIPAA covered entities must ensure the HIPAA breach notification requirements are followed or they risk incurring financial penalties from state attorneys general and the HHS’ Office for Civil Rights.

In 2017, Presense Health became the first HIPAA-covered entity to settle a case with the Office for Civil Rights solely for a HIPAA Breach Notification Rule violation – after it exceeded the 60-day maximum time frame for issuing breach notifications. Presense Health took three months from the discovery of the breach to issue notifications – A delay that cost the health system $475,000. The maximum penalty for a HIPAA Breach Notification Rule violation is $1,500,000, or more if the delay is for more than 12 months.

Responding to a Healthcare Data Breach

how-to-respond-to-a-healthcare-data-breach

HIPAA Breach Notification Requirements FAQs

What is the difference between a HIPAA breach and a HIPAA violation?

A HIPAA breach is when unsecured PHI is acquired, accessed, used, or disclosed in a manner not permitted by the Privacy and Security Rules. A HIPAA violation occurs when a Covered Entity, Business Associate, or a member of the workforce fails to comply with any standard in the Privacy, Security, or Breach Notification Rules. It is not necessary for a breach to occur in order for there to be a HIPAA violation – for example, the failure to respond to a patient access request within 30 days is a HIPAA violation, but not a HIPAA breach.

Why must staff be trained on reporting HIPAA breaches?

Staff must be trained on reporting HIPAA violations to their supervisors, managers, or the Privacy Officer. It is not necessary for staff to know the mechanics of the HIPAA breach notification requirements beyond that point, but they must be aware of the consequences of delaying a report in terms of the impact it will have on patients impacted by the breach, the consequences for their employer if notifications are delayed longer than necessary, and on their own jobs if a breach comes to light weeks after it has happened.

What is the difference between secured PHI and unsecured PHI?

Secured PHI is generally defined as Protected Health Information that has been rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of technologies or methodologies specified in § 13402 of the HITECH Act. HIPAA is technology neutral, but the implementation specifications relating to Access Controls and Transmission Security state encryption is required unless an equivalent protection is implemented, or the use of encryption is unreasonable and inappropriate in the circumstances.

What is an example of a “good faith belief” that PHI has not been retained?

If, for example, a healthcare professional shows an X-ray image to a person not authorized to view the image but realizes a mistake has been made before it is likely any information relating to the image has been read, it is highly likely that PHI has not been retained and the Covered Entity can reasonably accept – in good faith – there has been no disclosure of unsecured PHI. In this scenario, it is important the healthcare professional reports the unauthorized disclosure to a higher authority, and that the report – along with the good faith determination – is documented.

Why do individuals have to give authorization before they receive email notifications?

Because email is not a secure communication channel, Covered Entities must obtain the authorization of an individual before sending an email that contains PHI. (If the email does not contain PHI, no authorization is necessary). Breach notifications have to inform individuals what PHI was accessed, so therefore Covered Entities can only communicate a breach by email if they have a prior authorization.

When must a HIPAA breach be reported?

A HIPAA breach must be reported whenever unsecured PHI or ePHI has been used or disclosed impermissibly unless there is a low probability that data has been comprised based on the risk assessment mentioned above. Also mentioned above was the timetable for reporting HIPAA breaches – within sixty days if the breach involves 500 or more records, and by the end of the calendar year if the breach involves fewer than 500 records.

The post What are the HIPAA Breach Notification Requirements? appeared first on HIPAA Journal.

How Employees Can Help Prevent HIPAA Violations

Posted by HIPAA Journal

Employees can help prevent HIPAA violations by fully understanding what PHI is, knowing when PHI can permissibly be used and disclosed, and by following their employers’ policies on the compliant use of healthcare technologies and communication devices. Employees can also help prevent HIPAA violations by reporting ongoing poor practices to a manager or compliance officer.

One of the key goals of compliance officers is to prevent HIPAA compliance violations whenever possible. To achieve this goal, many compliance officers rely on technological solutions or sanctions policies to deter employees from noncompliant behaviors. However, by taking a more positive approach, employees can help prevent HIPAA violations.
Ten Most Common HIPAA Violations

Use the article in conjunction with our free HIPAA Violations Checklist to understand what is required to ensure full compliance. Please use the form on this page to arrange for your copy.

Most Frequent Complaints

According to the Department of Health and Human Services´ Enforcement Highlights web page, the most frequent complaint received by HHS´ Office for Civil Rights relates to impermissible uses and disclosure of PHI. This is not surprising considering the variety of scenarios in which an authorization to use or disclose PHI is required, when individuals may or may not have the right to object to a use or disclosure, or when permissible uses or disclosures are subject to “other requirements”.

However, it is not only the variety of scenarios that can result in HIPAA violations. Many impermissible uses and disclosures occur due to a lack of understanding of what PHI is. The failure to understand what PHI is – and what it isn´t – can result in the next four most frequent violations occurring:

  • Lack of Privacy Rule safeguards for PHI
  • Lack of patient access to PHI
  • Lack of Security Rule safeguards for ePHI
  • Use or disclosure of more than the minimum necessary PHI

How to Prevent HIPAA Violations of this Nature

The obvious way to prevent HIPAA violations of this nature is to train all members of the workforce – not just employees – on what is considered PHI under HIPAA. Many HIPAA training courses fail to include this fundamental basic of HIPAA compliance in their curriculum – focusing on the HIPAA training requirements of §164.530 and §164.308 to tick the box of compliance, rather than putting policy and procedure training and security and awareness training into context.

However, if members of the workforce do not fully understand what PHI is, it is not hard to imagine why it may be used or disclosed impermissibly, why patients allege access requests are not being acted on, and why more than the minimum necessary PHI is being disclosed. It may also explain why those with a responsibility for the privacy and security of PHI fail to implement reasonable and appropriate Privacy Rule policies or Security Rule safeguards.

How to Prevent Other Types of HIPAA Violations

In addition to providing training on what PHI is, it can help prevent HIPAA violations to highlight the most common violations by members of the workforce and explain how to follow HIPAA guidelines in order to send the message “we know this happens – we don´t want it happening here”. The most common violations of HIPAA by members of the workforce include (but are not limited to).

Sharing passwords to systems containing PHI

Healthcare workers often share passwords to EHRs and other health IT systems – not out of malice, but “to get the job done” when their credentials are not sufficient to access required information. This is a violation of §164.312; and while it is the responsibility of the IT team to ensure each member of the workforce has “unique user identification”, employees should not share passwords, but rather pester the IT team to provide them with the credentials they need.

Leaving devices unsecured and unattended

Devices that can access PHI must have security features such as automatic logoff and PIN-lock (or other device locking process) enabled. All PHI on the device – or accessible by the device – should be encrypted. If a device or workstation used by a member of the workforce does not have these security features enabled, the risk of a data breach exists if a device or workstation is left unattended. This is a risk that is easy to prevent with the right technology.

Using unsecure channels of communication

There are two potential HIPAA violations here. The first relates to transmission security when communicating PHI, while the second relates to an individual´s right to request how they are contacted. HIPAA allows for Covered Entities to use unsecure channels of communication to contact individuals, but individuals should be warned of the risks, and both the warning and the individual´s consent to use the channel of communication should be documented.

Disposing of PHI improperly

While most healthcare organizations have now transitioned to electronic health records, paper documents are still widely used. Any document containing PHI must be kept secure while in use and disposed of properly at end of life. The rules relating to the disposal of PHI also apply to electronic PHI – particularly when systems on which PHI is stored are decommissioned or when removable media and backup tapes are purged for re-use.

Accessing PHI out of curiosity

The accessing of patient health records by employees, without any legitimate reason for doing so, is a serious violation of HIPAA. While most healthcare employees respect the privacy of patients, there have been numerous cases over the years of patients snooping on the records of patients. It is important for all members of the workforce to be made aware that audit logs are implemented to protect patient health information in the workplace and can identify when employees have access PHI without good reason.

Sharing PHI on social media without authorization

One of the reasons it is important that all members of the workforce know what is considered PHI under HIPAA is so that they do not inadvertently or deliberately share PHI on social media without authorization. Even something as apparently innocuous as commenting on a personality being seen at a medical center is a HIPAA violation that could lead to a sanction being applied or a complaint by the personality being made to HHS´ Office for Civil Rights.

The Benefits of Training Employees How to Avoid HIPAA Violations

Training employees how to avoid HIPAA violations not only reduces the number of violations but can also help reduce the number of unjustified complaints made to the organization and to HHS´ Office for Civil Rights. A significant statistic on HHS´ Enforcement Highlights web page, is that many reported violations are not violations at all. Of more than 300,000 complaints received since 2003, more than 200,000 have been rejected because “they did not present an eligible case for enforcement”. Among the reasons given by HHS for rejecting two-thirds of complaints were:

  • The complaint was made against an organization not subject to HIPAA
  • The activity described in the complaint did not violate any HIPAA Rules
  • The complaint was withdrawn by the individual on review.

Training employees to avoid HIPAA violations so they understand what PHI is can be beneficial in reducing unjustified complaints made by individuals who themselves do not know what PHI is. Employees can pass their knowledge on to patients and plan members to reduce the number of complaints made about impermissible uses and disclosures or disclosing more than the minimum necessary PHI – saving compliance officers valuable time replying to unjustified complaints or responding to HHS enquiries in the complaints review process.

How Employees Can Help Prevent HIPAA Violations: FAQs

Where does the Privacy Rule state the permissible uses and disclosures of PHI?

The Privacy Rule states the permissible uses and disclosures of PHI – including those requiring an authorization or in circumstances when an individual has the right to object – in sections §164.502 to §164.514 of the Administrative Simplification Regulations. Many of the standards apply to infrequent events, but it is important members of the workforce know what to do when these infrequent events occur.

How might somebody with a responsibility for security fail to implement safeguards?

The reason why somebody with a responsibility for security might fail to implement safeguards is that a lot of misinformation exists on the Internet. For example, if a Security Officer safeguards the so-called 18 HIPAA identifiers, but no other identifiers, details such as Medicare Beneficiaries Identifiers, social media handles, and emotional support animals (that could be used to identify an individual) could remain unsecured.

What is the problem with sharing passwords to systems containing PHI?

The problem with sharing passwords to systems containing PHI is that if an employee shares their login credentials with a colleague, and the colleague misuses PHI or disclosures PHI impermissibly, the HIPAA violation will be attributed to the owner of the login credentials rather than the colleague who was using them.

Does a personal mobile device have to have HIPAA security features enabled?

A personal mobile device must have HIPAA security features enabled if it is used to access systems containing PHI or communicate PHI with a colleague or patient. In such cases, the device has to be configured to meet the standards of the Security Rule. While applying the standards may seem like an imposition on the owner of the device, they are a best practice for personal data security even if the device is not used to access or communicate PHI.

Is it possible to share PHI on social media with authorization?

It is possible to share PHI on social media with authorization; but, in order to do so, the authorization form must state why PHI is being shared. It also has to be documented that the individual has been made aware that it may not be possible to revoke the authorization. This is because once content is posted on a social media platform, any further use or disclosure is out of the control of the person who posted it.

What is the best way to prevent HIPAA violations?

The best way to prevent HIPAA violations is to ensure HIPAA-compliant policies and procedures are developed, Security Rule safeguards are implemented, and all members of the workforce are thoroughly trained on HIPAA compliance. In addition, Covered Entities and Business Associates need to keep on top of monitoring compliance with the policies and procedures and ensure sanctions are applied consistently and fairly whenever necessary.

How can a healthcare organization avoid HIPAA violations?

A healthcare organization can avoid HIPAA violations by empowering members of the workforce to be the eyes and ears of HIPAA compliance. This can be achieved by implementing an anonymous communication channel through which members of the workforce can raise concerns about non-compliant practices and risks to the privacy of individually identifiable health information.

How is it possible to protect patient health information in the workplace?

There are several ways it is possible to protect patient health information in the workplace. One of the best ways is to minimize the number of designated record sets per patient. This makes it easier to identify where PHI is created, used, and maintained, so appropriate safeguards can be implemented to prevent impermissible disclosures and breaches of unsecure PHI.

What are the top five HIPAA tips for staff?

The five top HIPAA tips for staff can vary according to the role of the individual and the operations of their employer. For example, a nurse working in an ED will have very different compliance challenges than a claims processor working as a business associate. However, there are some common HIPAA tips that apply to all staff:

  • Pay attention to HIPAA training; and, if there is something you don´t understand, ask.
  • Ensure you are aware what PHI is and your employer´s policies for disclosing PHI.
  • If you identify a HIPAA violation in the workplace, report it and document your report.
  • Never share login credentials without first checking with a member of the IT team.
  • Don´t rely on colleagues if you are unsure about HIPAA compliance. Check with a manager or your Privacy/Security Officer.

What advice should a new member of the workforce be given on how to not violate HIPAA?

The advice a new member of the workforce should be given on how to not violate HIPAA is to follow the policies developed by your employer. This is because a member of the workforce cannot be held liable for a violation of HIPAA if their employer´s policies are not HIPAA compliant. It is important to be aware that an employer´s sanctions policy only applies to the policies the employer has developed – which are not necessarily the same as the HIPAA standards.

What are the key HIPAA do’s and don’ts for employees?

The key HIPAA do’s and don’ts for employees are to comply with your employer´s HIPAA policies and – if you feel they contradict HIPAA – don´t assume you know better. In addition, if you see a HIPAA violation in the workplace, do report it – don’t be afraid of alienating work colleagues. Finally, do make sure you participate in security and awareness training and don´t share login credentials.

Why is protecting PHI in the workplace important?

Protecting PHI in the workplace is important because impermissible uses and disclosures of PHI and breaches of unsecured PHI can result in loss, fraud, and reputational damage. This not only applies to the subject(s) of the PHI, but also to healthcare organizations and health plans who could end up providing – and paying for – expensive treatments to criminals in possession of stolen PHI.

How does reporting HIPAA violations in the workplace support HIPAA compliance?

Reporting HIPAA violations in the workplace supports HIPAA compliance in a number of ways. For example, reporting HIPAA violations can alert Privacy Officers to the need for more training, the need to fill gaps in HIPAA policies, and/or the need to better monitor workplace compliance. Once these needs are identified and resolved, the workplace will likely become more HIPAA compliant.

What are HIPAA reminders for staff?

HIPAA reminders for staff can take various forms. They can be verbal reminders from a supervisor who has observed a member of staff taking a compliance shortcut, they can be refresher training provided periodically by a conscientious employer, or they can be the HIPAA security reminders required by the Administrative Safeguards of the Security Rule (45 CFR §164.308(5)(ii)(A)).

What strategies are used to prevent HIPAA privacy violations?

The strategies used to prevent HIPAA privacy violations can vary from organization to organization, but generally they consist of education, supervision, and enforcement – Education being the HIPAA training all new members of the workforce are required to undergo, supervision being the monitoring of staff compliance and security technologies, and enforcement being the fair and consistent application of a HIPAA sanctions policy.

What is the HIPAA policy for healthcare employees?

There is no single HIPAA policy for healthcare employees. In many cases, there are hundreds of HIPAA policies for healthcare employees – although most employees will not be aware of them all. This is because the Privacy Rule only requires covered entities to train healthcare employees “on the policies and procedures […] necessary and appropriate for members of the workforce to carry out their functions with the covered entity”. Although healthcare employees are required to comply with HIPAA, they will only be trained on the HIPAA policies relevant to their roles.

What are the breach prevention best practices according to HIPAA?

HIPAA itself is technology neutral and does not provide breach prevention best practices per se. Indeed, even though the Security Rule stipulates Administrative, Physical, and Technical Safeguards must be implemented to protect the confidentiality, integrity, and confidentiality of electronic PHI, the Rule itself has a “flexibility of approach” clause in its “General Rules” (45 CFR §164.306(b)(1)).

However, since the publication of the Security Rule, the National Institute of Standards and Technology (NIST) Guide SP 800-53 has been widely acknowledged as the source of breach prevention best practices for HIPAA. In 2016, the Department of Health and Human Services published a “crosswalk” to help covered entities and business associates better comply with the Security Rule.

It is important for covered entities and business associates to be aware that adopting the measures in the crosswalk or in NIST´s latest guidance (SP 800-66r2) does not guarantee compliance with the Security Rule. However, the two publications contain what many experts believe to be the most comprehensive breach prevention best practices for HIPAA.

What HIPAA laws do healthcare providers have to comply with?

The HIPAA laws healthcare providers have to comply with are the Privacy Rule, the Security Rule, and the Breach Notification Rule if they qualify as a HIPAA covered entity. Not all healthcare providers qualify as a covered entity; however, if a non-qualifying healthcare provider provides a service to or on behalf of a covered entity as a “business associate”, they may also have to comply with the Privacy Rule (or parts thereof) as well as the Security Rule, and the Breach Notification Rule.

All covered entities and business associates must comply where appropriate with the General Provisions of 45 CFR Parts 160 and 164, while healthcare providers that conduct electronic transactions for which the Department of Health and Human Services has published standards have to comply with all applicable provisions of 45 CFR Part 162 (mostly relating to transactions between health plans and healthcare providers for eligibility, authorization, billing, and payment).

What are the Rules of HIPAA for healthcare organizations?

The Rules of HIPAA for healthcare organizations that qualify as HIPAA covered entities are:

  • The Privacy Rule – the standards for the privacy of individually identifiable health information.
  • The Security Rule – the standards for the protection of electronic protected health information.
  • The Enforcement Rule – the processes for HHS investigations and imposition of sanctions by HHS.
  • The Breach Notification Rule – the standards for notifying individuals and HHS of a data breach.
  • The Final Omnibus Rule – the amendments to existing HIPAA Rules introduced by the HITECH Act.

Most healthcare organizations are required to comply with the above Rules of HIPAA, plus – where applicable – the General Provisions of 45 CFR Parts 160 and 164 of the Administrative Simplification Regulations. Healthcare organizations and business associates that conduct transactions for which the Department of Health and Human Services has published standards are also  required to comply with the General Provisions and the Transactions, Identifier, and Code Set Rules in 45 CFR Part 162.

What is one good way to avoid violating HIPAA?

One good way to avoid violating HIPAA if you are a member of a covered entity´s or business associate´s workforce is to apply the information you learn in HIPAA training to your day-to-day roles – especially the information relating to permissible uses and disclosures of PHI because this is the most alleged HIPAA violation reported to HHS´ Office of Civil Rights via the Complaint Portal.

What can employees do to prevent a security breach in the workplace?

Employees can do a lot to prevent a security breach in the workplace. Possibly the most important thing employees can do is to use unique, complex passwords for each online account, never disclose or share passwords, and protect sensitive accounts and databases with 2-factor authentication – even if your employer does not require these basic security measures.

What does the mitigation of a violation of PHI mean?

The mitigation of a violation of PHI is a strange term to use because usually people talk in terms of HIPAA violations and PHI breaches – the two terms meaning different things. A HIPAA violation is any failure to comply with the standards of the Administrative Simplification Regulations (45 CFR Parts 160 – 164) and the Confidentiality of Substance Abuse Disorder Patient Records (42 CFR Part 2).

A violation of any of these standards doesn´t necessarily result in a breach of unsecured PHI; but when it does, lessening (or mitigating) the impact of the breach can reduce the amount of harm an individual suffers, the risk of compromised PHI being used to commit insurance fraud, and the amount an organization could be fined for failing to comply with the HIPAA standards.

Can an employer disclose medical information to other employees?

Whether or not an employer can disclose medical information to other employees depends on state privacy laws rather than HIPAA. Employers are exempt from HIPAA in their role as an employer, so any health information collected, maintained, or transmitted by an employer as part of an employee’s employment record is not subject to the protection of the Privacy Rule.

Can an employer request medical information?

An employer can request medical information about an employee from a healthcare provider if the information requested is required to comply with state and/or federal requirements for reporting workplace injuries and illnesses. However, the healthcare provider is only allowed to disclose the minimum necessary medical information to meet the reporting requirements.

An employer can also request medical information from an employee to justify an absence, to enroll an employee in a group health plan or wellness program, to maintain the health and safety of other members of the workforce, to comply with the Family Medical Leave Act, or to accommodate members of the workforce under the Americans with Disabilities Act.

My HIPAA rights were violated by my employer. What should I do?

It is unlikely that your HIPAA rights were violated by your employer because, except in a few circumstances, employers are exempt from HIPAA In their role as employer. However, there may be state privacy laws that limit what individually identifiable health information an employer can disclose, and you should discuss your options with your HR department or a legal professional.

The post How Employees Can Help Prevent HIPAA Violations appeared first on HIPAA Journal.

Is OneDrive HIPAA Compliant?

Posted by HIPAA Journal

Many covered entities want to take advantage of cloud storage services, but can Microsoft OneDrive be used? Is OneDrive HIPAA compliant?

Many healthcare organizations are already using Microsoft Office 365 Business Essentials, including exchange online for email. Office 365 Business Essentials includes OneDrive Online, which is a convenient platform for storing and sharing files.

Microsoft Supports HIPAA-Compliance

There is certainly no problem with HIPAA-covered entities using OneDrive. Microsoft supports HIPAA-compliance and many of its cloud services, including OneDrive, can be used without violating HIPAA Rules.

That said, before OneDrive – or any cloud service – can be used to create, store, or send files containing the electronic protected health information of patients, HIPAA-covered entities must obtain and sign a HIPAA-compliant business associate agreement (BAA).

Microsoft was one of the first cloud service providers to agree to sign a BAA with HIPAA-covered entities, and offers a BAA through the Online Services Terms. The BAA includes OneDrive for Business, as well as Azure, Azure Government, Cloud App Security, Dynamics 365, Office 365, Microsoft Flow, Intune Online Services, PowerApps, Power BI, and Visual Studio Team Services.

Under the terms of its business associate agreement, Microsoft agrees to place limitations on use and disclosure of ePHI, implement safeguards to prevent inappropriate use, report to consumers and provide access to PHI, on request, per the HIPAA Privacy Rule. Microsoft will also ensure that if any subcontractors are used, they will comply with the same – or more stringent – restrictions and conditions with respect to PHI.

Provided the BAA is signed prior to the use of OneDrive for creating, storing, or sharing PHI, the service can be used without violating HIPAA Rules.

Microsoft explains that all appropriate security controls are included in OneDrive, and while HIPAA compliance certification has not been obtained, all of the services and software covered by the BAA have been independently audited for the Microsoft ISO/IEC 27001 certification.

Appropriate security controls are included to satisfy the requirements of the HIPAA Security Rule, including the encryption of data at rest and in transit to HIPAA standards. Microsoft uses 256-bit AES encryption and SSl/TLS connections are established using 2048-bit keys.

There is More to HIPAA Compliance Than Using ‘HIPAA-Compliant’ Services

However, just because Microsoft will sign a BAA, it does not mean OneDrive is HIPAA compliant. There is more to compliance than using a specific software or cloud service. Microsoft supports HIPAA compliance, but HIPAA compliance depends of the actions of users. As Microsoft explains, “Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with HIPAA and the HITECH Act.”

Prior to the use of any cloud service, a HIPAA-covered entity must conduct a risk analysis and assess the vendor’s provisions and policies. A risk management program must also be developed, using policies, procedures, and technologies to ensure risks are mitigated.

Access policies must be developed and security settings configured correctly. Strong passwords should be used, external file sharing should be disabled, access should be limited to trusted whitelisted networks, and PHI must only be shared with individuals authorized to view the information. When PHI is shared, the minimum necessary standard applies. Logging should be enabled to ensure organizations have visibility into what users are doing with respect to PHI, and when employees no longer require access to OneDrive, such as when they leave the organization, access should be terminated immediately.

So, Is OneDrive HIPAA compliant? Yes and No. OneDrive can be used without violating HIPAA Rules and Microsoft supports HIPAA compliance, but ultimately HIPAA compliance is down to the covered entity, how the service is configured and used.

The post Is OneDrive HIPAA Compliant? appeared first on HIPAA Journal.

Why Dental Offices Should be Worried About HIPAA Compliance

Posted by HIPAA Journal

In 2015, Dr. Joseph Beck became the first dentist to be fined for a HIPAA violation, which sent a warning to dental offices about HIPAA compliance.  Until that point, dental offices had avoided fines for noncompliance with HIPAA Rules.

The penalty was not issued by the Department of Health and Human Services’ Office for Civil Rights (OCR), but by the Office of the Indiana attorney general. The fine of $12,000 was for the alleged mishandling of the protected health information of 5,600 patients.

Since then, many settlements have been reached with covered entities for HIPAA violations. No further penalties have been issued to dental offices, although there is nothing to stop OCR or state attorneys general from fining dental offices for failing to comply with HIPAA Rules and settlements for alleged HIPAA violations are now being reached much more frequently than in 2015. Last year was a record year for settlements and 2017 has continued where 2016 left off.

The probability of HIPAA violations being discovered has also increased. OCR has already commenced the much-delayed second phase of its HIPAA compliance audit program and dental office may still be selected for an audit.

During the first phase of compliance audits in 2011/2012, at least one dental office was audited. That round of audits revealed multiple areas of noncompliance with HIPAA Rules, although OCR chose not to issue any financial penalties. Instead non-compliance was addressed by issuing technical guidance. Now, five years on, covered entities have had plenty of time to implement their compliance programs. Financial settlements can be expected if HIPAA violations are discovered by OCR auditors.

Last year, the threat of HIPAA compliance audits for dental offices prompted Dr. Andrew Brown, chair of the ADA Council on Dental Practice, to issue a stern warning to dental offices on HIPAA compliance, urging them to take HIPAA compliance seriously. Brown said, “There are steep consequences for health care providers that don’t comply with the law and we don’t want to see any dentists having to pay tens of thousands of dollars in a penalty.”

If your dental office has not been selected to demonstrate compliance with HIPAA Rules already, that does not mean an investigation will not be conducted. OCR has only conducted the first round of its phase 2 HIPAA audit program. The second round will involve on-site visits, which are expected to start in early 2018.

OCR also investigates all covered entities that experience a breach of more than 500 records. There has been an increase in cyberattacks on healthcare organizations in recent years, and dental offices can could all too easily come under attack.

Laptop computers containing ePHI can easily be lost or stolen, employees may snoop on records or steal sensitive information, errors can easily be made configuring software, and unaddressed vulnerabilities can easily be exploited. This year, the hacking group TheDarkOverlord exploited a vulnerability and gained access to the records of Aesthetic Dentistry of New York City and stole data – a reportable breach under HIPAA Rules.

If a data breach is experienced, OCR will need to be provided with evidence that HIPAA Rules have been followed. Complaints about privacy violations and other potential HIPAA failures can be submitted via the HHS website, and can easily lead to HIPAA investigations.

It would be a serious error to think that OCR will not investigate small practices. OCR has made it clear that all covered entities, regardless of their size, must comply with HIPAA Rules. It is not only large healthcare organizations that may have to pay a financial penalty for non-compliance with HIPAA Rules, as Dr. Beck could confirm.

The threat of data breaches is greater than ever before and OCR is taking a harder line on healthcare organizations that fail to comply with HIPAA Rules and keep electronic protected health information secure. Dental office should therefore take HIPAA compliance seriously and ensure HIPAA Rules are being followed.

The post Why Dental Offices Should be Worried About HIPAA Compliance appeared first on HIPAA Journal.

HIPAA Compliance and Cloud Computing Platforms

Posted by HIPAA Journal

Before cloud services can be used by healthcare organizations for storing or processing protected health information (PHI) or for creating web-based applications that collect, store, maintain, or transmit PHI, covered entities must ensure the services are secure.

Even when a cloud computing platform provider has HIPAA certification, or claims their service is HIPAA-compliant or supports HIPAA compliance, the platform cannot be used in conjunction with ePHI until a risk analysis – See 45 CFR §§ 164.308(a)(1)(ii)(A) – has been performed.

A risk analysis is an essential element of HIPAA compliance for cloud computing platforms. After performing a risk analysis, a covered entity must establish risk management policies in relation to the service – 45 CFR §§ 164.308(a)(1)(ii)(B). Any risks identified must be managed and reduced to a reasonable and appropriate level.

It would not be possible to perform a comprehensive, HIPAA-compliant risk analysis unless the covered entity fully understands the cloud computing environment and the service being offered by the platform provider.

Cloud Service Providers are HIPAA Business Associates

A HIPAA business associate is any person or entity who performs functions on behalf of a covered entity, or offers services to a covered entity that involve access being provided to protected health information (PHI).

The HIPAA definition of business associate was modified by the HIPAA Omnibus Rule to include any entity that “creates, receives, maintains, or transmits” PHI. The latter two clearly apply to providers of cloud computing platforms.

Consequently, a covered entity must obtain a signed business associate agreement (BAA) from the cloud platform provider. The BAA must be obtained from the cloud platform provider before any PHI is uploaded to the platform. A BAA must still be obtained even if the platform is only used to store encrypted ePHI, even if the key to unlock the encryption is not given to the platform provider. The only exception would be when the cloud platform is only used to store, process, maintain or transmit de-identified ePHI.

The BAA is a contract between a covered entity and a service provider. The BAA must establish the allowable uses and disclosures of PHI, state that appropriate safeguards must be implemented to prevent unauthorized use or disclosure of ePHI, and explain all elements of HIPAA Rules that apply to the platform provider. Details of the contents of a HIPAA-compliant BAA can be obtained from the HHS on this link.

Cloud computing platform providers and cloud data storage companies that have access to PHI can be fined for failing to comply with HIPAA Rules, even if the service provider does not view any data uploaded to the platform. Not all cloud service providers will therefore be willing to sign a BAA.

A BAA Will Not Make a Covered Entity HIPAA Compliant

Simply obtaining a BAA for a cloud computing platform will not ensure a covered entity is compliant with HIPAA Rules. HIPAA Rules can still be violated, even with a BAA in place. This is because no cloud service can be truly HIPAA compliant by itself. HIPAA compliance will depend on how the platform is used.

For example, Microsoft will sign a BAA for its Azure platform; but it is the responsibility of the covered entity to use the platform in a HIPAA-compliant manner. If a covered entity misconfigures or fails to apply appropriate access controls, it would be the covered entity that is in violation of HIPAA Rules, not Microsoft. As Microsoft explains, “By offering a BAA, Microsoft helps support your HIPAA compliance, but using Microsoft services does not on its own achieve it. Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with HIPAA and the HITECH Act.”

Penalties for Cloud-Related HIPAA Violations

The Department of Health and Human Services’ Office for Civil Rights has already settled cases with HIPAA-covered entities that have failed to obtain business associate agreements before uploading PHI to the cloud, as well as for risk analysis and risk management failures.

St. Elizabeth’s Medical Center in Brighton, Mass agreed to settle its case with OCR in 2015 for $218,400 for potential violations of the HIPAA Security Rule after PHI was uploaded to a document sharing service, without first assessing the risks of using that service.

Phoenix Cardiac Surgery also agreed to settle a case with OCR for failing to obtain a business associate agreement from a vendor of an Internet-based calendar and email service prior to using the service in conjunction with PHI. The case was settled for $100,000.

In 2016, OCR settled a case with Oregon Health & Science University for $2.7 million after it was discovered ePHI was being stored in the cloud without first obtaining a HIPAA-compliant business associate agreement.

HIPAA Compliant Cloud Computing Platforms

Both Amazon’s AWS and Microsoft’s Azure platforms can be used by HIPAA-covered entities. Both have all the necessary privacy and security protections in place to satisfy HIPAA requirements, and Amazon and Microsoft will sign BAAs with healthcare providers and agree to comply with HIPAA Rules.

AWS has long been the leading cloud service provider, although Microsoft appears to be catching up. If you are unsure of the best cloud computing platform provider to use, you can find out more information in this comparison of Azure and AWS.

Cloud storage companies that support HIPAA-compliance and can be used by HIPAA-covered entities for storing ePHI (after a BAA has been obtained) include Box, Carbonite, Dropbox, Google Drive, and Microsoft OneDrive.

The post HIPAA Compliance and Cloud Computing Platforms appeared first on HIPAA Journal.

HITRUST/AMA Launch Initiative to Help Small Healthcare Providers with HIPAA Compliance

Posted by HIPAA Journal

HITRUST has announced it has partnered with the American Medical Association (AMA) for a new initiative that will help small healthcare providers with HIPAA compliance, cybersecurity, and cyber risk management.

Small healthcare providers can be particularly vulnerable to cyberattacks, as they typically lack the resources to devote to cybersecurity and do not tend to have the budgets available to hire skilled cybersecurity staff. This week has underscored the need for small practices to improve their cybersecurity defenses, with the announcement of two cyberattacks on small healthcare providers by the hacking group TheDarkOverlord.

Recent ransomware attacks have also shown that healthcare organizations of all sizes are likely to be attacked. Organizations of all sizes must practice good cyber hygiene and have the right defenses in place to improve resilience against ever changing cyber threats.

HITRUST and AMA will be hosting 2-hour workshops where physicians and other healthcare staff will be educated on key areas of risk management, HIPAA compliance, and cybersecurity, with the workshops specifically focused on small healthcare providers.

The initiative runs alongside HITRUST’s Community Extension Program that was launched earlier this year, with the workshops taking place in the two hours prior to the HITRUST Community Extension Program events, which are taking place in 50 cities across the United States.

HITRUST explained, “Many clinics, physician offices, and other small providers are looking for local, community-based resources to help guide them through the journey of establishing governance and risk management programs to avoid a cyber-related breach or event that would disrupt their organization and expose the confidential information of their patients or members.” One of the aims of the workshops is to make good cyber hygiene manageable for small healthcare providers.

These workshops will provide the information small healthcare providers need to make significant improvements to their cybersecurity posture and help them meet the requirements of the HIPAA Security Rule.

While many topics will be covered in the workshops, they will be primarily focused on teaching the fundamentals of good cyber hygiene, explaining the need for cyber and HIPAA risk assessments, and will cover cost-effective technologies that can be implemented to improve cyber security.

“Trying to determine the best way to secure my practice from cyber threats was a significant – and at times, overwhelming – undertaking,” said Dr. J. Stefan Walker, a practicing physician in a small practice in Corpus Christi, TX. “Many existing cybersecurity resources and education programs are geared toward larger health care organizations and are not practical for a practice with only a handful of employees.” These workshops will help small healthcare organizations by providing relevant, useful, and practical advice specific to practices of their size.

The first workshop is being hosted by Children’s Health in Dallas, TX and will take place on October 9. Details of further events will be posted on the HITRUST website.

The post HITRUST/AMA Launch Initiative to Help Small Healthcare Providers with HIPAA Compliance appeared first on HIPAA Journal.

HHS Issues Partial HIPAA Privacy Rule Waiver in Hurricane Maria Disaster Zone

Posted by HIPAA Journal

The U.S. Department of Health and Human Services has already issued two partial waivers of HIPAA sanctions and penalties in areas affected by hurricanes this year. Now a third HIPAA waiver has been issued, this time in the Hurricane Maria disaster area in Puerto Rico and the U.S. Virgin Islands.

As was the case with the waivers issued in relation to Hurricane Harvey and Hurricane Irma, the waiver only applies to covered entities in areas where a public health emergency has been declared, only for 72 hours following the implementation of the hospital’s disaster protocol, and only for specific provisions of the HIPAA Privacy Rule:

  • The requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).
  • The requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).
  • The requirement to distribute a notice of privacy practices. See 45 CFR 164.520.
  • The patient’s right to request privacy restrictions. See 45 CFR 164.522(a).
  • The patient’s right to request confidential communications. See 45 CFR 164.522(b)

As soon as the 72-hour period has elapsed, or as soon as the Presidential or Secretarial declaration terminates, the waiver ceases to apply and covered entities must comply with the above provisions of the Privacy Rule for all patients still under their care.

Further information on the HIPAA waiver in relation to Hurricane Maria can be viewed here.

In an emergency situation, a waiver of sanctions and penalties for violations of limited provisions of the HIPAA Privacy Rule is not strictly necessary, although such a waiver does offer some reassurance to covered entities that are operating in a disaster area.

The HHS has pointed out in its recent communication that in emergency situations, covered entities are permitted to share limited protected health information of patients even if a waiver has not been issued, when it is in the best interests of patients to do so, to help identify patients, to help locate family members, and for public health activities. In the case of the latter, it is permissible to share PHI with public health authorities such as a state or local health department or the CDC for the purpose of preventing or controlling disease, injury or disability.

PHI can also be shared for the purposes of treatment, either the treatment of the patient or another person who may be affected by the same situation, as well as to help with the coordination or management of healthcare, such as sharing PHI with other healthcare providers or when referring patients for treatment – 45 CFR §§ 164.502(a)(1)(ii), 164.506(c)

PHI can be shared with anyone, as necessary, to prevent or lessen a serious or imminent threat to the health and safety of a person or the public., if that person is in a position to lessen or prevent the threatened harm. Such disclosures can be made without the patient’s permission. It is left to the discretion of the covered entity to make a determination about the nature and severity of the threat to health – 45 CFR 164.512(j).

Disclosures can be made to family, friends, and other individuals involved in a patient’s care, and information can be shared to help identify, locate, and notify family members, guardians, or others responsible for a patient’s care – 45 CFR 164.510(b).

When others not involved in the treatment of a patient, including the media, request information about a specific patient by name, a HIPAA-covered entity is permitted to disclose “limited facility directory information” and provide general information about the patient such as whether they are in critical or stable condition, are deceased, or have been treated and have left the facility, provided the patient has not requested the information be kept private.

In all cases, any disclosures must be limited to the minimum necessary information to achieve the purpose for which the information is disclosed. At all times, even in emergency situations, the HIPAA Security Rule requirements apply and covered entities must continue to ensure administrative, physical, and technical safeguards are in place to preserve the confidentiality, integrity, and availability of PHI.

The post HHS Issues Partial HIPAA Privacy Rule Waiver in Hurricane Maria Disaster Zone appeared first on HIPAA Journal.

The Compliancy Group Helps Imperial Valley Family Care Medical Group Pass HIPAA Audit

Posted by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights commenced the second round of HIPAA compliance audits late last year. The audit program consists of desk-based audits of HIPAA-covered entities and business associates, followed by a round of in-depth audits involving site visits. The desk audits have been completed, with the site audits put on hold and expected to commence in early 2018.

Only a small number of covered entities have been selected to be audited as part of the second phase of compliance audits; however, covered entities that have escaped an audit may still be required to demonstrate they are in compliance with HIPAA Rules.

In addition to the audit program, any HIPAA-covered entities that experiences a breach of more than 500 records will be investigated by OCR to determine whether the breach was the result of violations of HIPAA Rules. OCR also investigates complaints submitted through the HHS website.

The first round of HIPAA compliance audits in 2011/2012 did not result in any financial penalties being issued, but that may not be the case for the second round of audits. Also, the past two years as seen an increase in financial penalties for noncompliance with HIPAA Rules that was discovered during investigations of complaints and data breaches.

There is now an elevated risk of an audit or investigation and OCR is issuing more fines for noncompliance. Consequently, covered entities cannot afford to take chances. Many healthcare organizations are turning to HIPAA compliance software and are seeking assistance from compliance experts to ensure their compliance programs are comprehensive and financial penalties are avoided.

Imperial Valley Family Care Medical Group Calls in HIPAA Compliance Experts

Imperial Valley Family Care Medical Group is a multi-specialty physician’s group with 16 facilities spread throughout California. IVFCMG was not selected for a desk audit, although following the theft of a laptop computer, OCR investigated the breach. IVFCMG was required to demonstrate compliance with HIPAA Rules and provide documentation to show the breach was not caused by the failure to follow HIPAA Rules.

Covered entities may fear a comprehensive HIPAA audit, but investigations into data breaches are also comprehensive. OCR often requires considerable documentation to be provided to assess compliance following any breach of protected health information. In the case of IVFCMG, OCR’s investigation was comprehensive.

Responding to OCR’s comprehensive questions in a timely manner was essential. IVFCMG, like many covered entities that are investigated or selected for an audit must be careful how they respond and all questions must be answered promptly and backed up with appropriate documentation.

As we have already seen this year, if HIPAA Rules are not followed to the letter after a data breach is experienced, fines can follow. Presense Health was fined $475,000 by OCR for potential violations of the HIPAA Breach Notification Rule following a breach of PHI.

Following the breach, IVFCMG turned to a third-party firm for assistance and contacted the Compliancy Group. By using the firm’s Breach Response Program, IVFCMG was able to ensure all of the required actions were completed, in the right time frame, and all of those processes were accurately documented.

The Breach Response Program is part of the Compliancy Group’s “The Guard” HIPAA compliance software platform. Compliancy Group simplifies HIPAA compliance, allowing healthcare professionals to confidently run their practice while meeting all the requirements of the HIPAA Privacy, Security and Breach Notification Rules. The Guard uses the “Achieve, Illustrate, and Maintain” methodology to ensure continued compliance, with covered entities guided by HIPAA compliance experts all the way.

IVFCMG’s Chief Strategic Officer, Don Caudill, said “Their experts provided us with a full report and documentation proving that our HIPAA compliance program satisfied the law – which ultimately helped us avoid hundreds of thousands of dollars in fines.” When OCR responded to the initial breach report asking questions about another aspect of HIPAA Rules, IVFCMG was able to respond in a timely fashion and provide the evidence to prove it was in compliance.

HIPAA compliance software helps covered entities pass a HIPAA audit, respond appropriately when OCR investigates data breaches and complaints, and avoid fines for non-compliance. OCR has increased its enforcement activity over the past two years and healthcare data breaches are on the rise. Non-compliance with HIPAA Rules is therefore much more likely to be discovered and result in financial penalties.

Small to medium sized HIPAA-covered entities with limited resources to dedicate to HIPAA compliance can benefit the most from using HIPAA compliance software and receiving external assistance from HIPAA compliance experts.

“Responding to a HIPAA audit requires sensitivity and expertise,” Bob Grant, Chief Compliance Officer of Compliancy Group, told HIPAA Journal. “As a former auditor, I’ve developed The Guard and our Audit Response Program to satisfy the full extent of the HIPAA regulatory requirements. Giving federal auditors everything they need to assess the compliance of your organization is our number one goal. Our Audit Response Program is the only program in the industry to give health care professionals the power to illustrate their compliance so they can get back to running their business in the aftermath of a HIPAA audit.”

The post The Compliancy Group Helps Imperial Valley Family Care Medical Group Pass HIPAA Audit appeared first on HIPAA Journal.