All Posts in Category: HIPAA Blogs

Prepare for 2016 HIPAA Audits

7 Ways to Prepare for 2016 HIPAA Audits

Phase two of audits for the Health Insurance Portability and Accountability Act (HIPAA) are coming this year as the Office of Civil Rights looks to crack down on violations.

HIPAA was signed into law in August of 1996, and the Privacy and Security Rules were both implemented over a decade ago. Moreover, the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which made significant changes to a variety of facets of HIPAA, passed in 2009. Section 13411 of the HITECH Act requires the Office of Civil Rights (OCR)–which is part of the U.S. Department of Health and Human Services (HHS)–to conduct periodic HIPAA audits.

Why is there so much emphasis on meeting standards that have been required for two decades in some instances? It’s due mainly to the increased use of technology in healthcare and accompanying cybersecurity risks. The purpose of this article is to provide an overview of the OCR audit program (phase 2), identify key areas of risk and provide suggestions on how to mitigate adverse findings.

Prepare for 2016 HIPAA Audits

OCR Audit Program

In 2011, OCR launched the requisite OCR Pilot Privacy, Security, and Breach Notification Audit Program. For the first phase, only covered entities were audited. This second phase includes business associates of covered entities.

Regardless of the type of entity, the time frames for the audit are the same. From the time the audit notification letter is sent from OCR, organizations should plan on a 30 day to 90 day process. Analogous to a Recovery Audit Contractor (RAC) audit, an entity has a certain period of time to produce the requested information. The information may be requested either on-site or as a desk audit, which is described below.

Next, OCR reviews the information provided and drafts a report. The entity then has the opportunity to review and respond to the draft report, after which OCR finalizes the report.
The scope of the phase 1 audits was limited to the federal Privacy, Security and Breach Notification Rules. This does not mean that a state law or international law provision may have been violated-it just was not addressed in the phase I audits.

Phase 2 audits will be more robust, in part due to a $4 million increase in OCR’s 2016 budget. Another area of difference will be the number of on site versus desk audits. During the phase 1 audits, covered entities were evaluated by a third party, who visited them on-site. Phase two audits will include a greater number of desk audits – entities responding to the audits from their desks by providing policies and documentation of privacy policies and procedures to HHS.

This serves as a signal —a key administrative area that will be looked at during the audits are the adequacy of policies and procedures. Therefore, the number of administrative and security violations could increase significantly.

Key Areas of Risk

A good place for practices to start is to look at the findings from phase 1, as well as recent penalties that were assessed by HHS for HIPAA violations. Violations occurred in the administrative, technical and physical realms. Primarily, policies and procedures were found to be inadequate; encryption of USB drives, laptops and email was found to be lacking; and inadequate employee security awareness and training were some of the major areas of vulnerability.

Suggestions to Mitigate Adverse Findings

The most prudent approach is to be prepared ahead of time, much like an IRS or Joint Commission audit. Whatever aspect of HIPAA compliance an organization is addressing, a good vantage point from which to start is the patient information. Every action should take into account the confidentiality, integrity and availability of the information. The way to make employees and contractors aware is through training. While the required way to hold business associates and subcontractors accountable is through the contractual obligations in a business associate agreement (BAA). Moreover, an annual risk assessment is a must. And, the HHS website is the ideal place to find explanations of what is set out in the laws and regulations.

Here are some tips to make sure that the practice is HIPAA compliant and avoid an adverse audit outcome:

  1. Begin compliance efforts from the vantage point of the government, who may “review pertinent policies, procedures, or practices of the covered entity or business associate and of the circumstances regarding any alleged violation”;
  2. Read Section 164.316 for what is required in relation to policies and procedures from an administrative, technical and physical aspect;
  3. Curtail policies and procedures to your individual practice;
  4. Know where the external and internal sources of protected health information are located;
  5. Encrypt everything both at rest and in transit and make sure that the level of encryption utilized is adequate;
  6. Train employees– Trustwave is a reputable vendor that has online training or various organizations offer live courses; and
  7. Perform due diligence on various third party risk assessors for expertise, price and quality.

OCR audits and HIPAA compliance should not be taken lightly. RAC audits also started with a pilot program more than a decade ago and now generate a substantial amount of revenue for the government, as well as serving as a check on providers’ claims submissions. Those submission, by the way, are also required to be HIPAA-compliant.

Conclusion

The overall goal of the phase 2 audits is to raise awareness and provide the opportunity for entities to correct their practices surrounding the creation, receipt, transmission and maintenance of protected health information.

The flip side, however, is that OCR may assess a penalty. Given that there are going to be more on site and business associate audits, the findings may translate into increased scrutiny by OCR on other fronts. Therefore, organizations of all types should look at the OCR audit like an IRS audit: a practice should be prepared for an audit. Failure to do so could be costly.

Original content by Modern Medicine Network

Read More
alj upholds hipaa violations

ALJ Upholds HIPAA Violations: $239,800 In Civil Monetary Penalties

Home health care provider Lincare, Inc. must pay $239,800 in civil monetary penalties for violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule, according to a February 3, 2016 press release from the U.S. Department of Health and Human Services (“HHS”). The announcement follows a January 13, 2016 administrative ruling granting summary judgment in favor of the HHS’s Office for Civil Rights (“OCR”). This is only the second time that OCR has sought civil monetary penalties for a HIPAA violation; OCR typically resolves violations through undertakings for voluntary compliance.

Lincare, a nationwide provider of respiratory care, infusion therapy, and medical equipment to in-home patients, came under investigation in 2008 after OCR received a complaint from the estranged husband of an Arkansas-based Lincare employee. Based on a subsequent investigation by OCR, OCR alleged that the employee routinely left documents containing 278 patients’ protected health information (“PHI”) in unsecure locations, such as the couple’s shared car and home. It was undisputed that the employee’s husband was not authorized to view the PHI. Moreover, according to OCR, the employee abandoned the documents altogether after moving residences.

In January 2014, after concluding the lengthy investigation, OCR cited Lincare for three violations of HIPAA’s Privacy Rule, which sets standards for the use and disclosure of protected health information. OCR issued corresponding civil monetary penalties for each alleged violation: (1) $25,000 for impermissible disclosure of PHI; (2) $25,000 for failure to safeguard PHI; and (3) $189,800 for insufficient policies and procedures related to the removal of PHI from business premises. In calculating penalties, OCR took into account that Lincare neglected to review and revise its HIPAA policies after learning about the complaint.

On appeal, Administrative Law Judge (“ALJ”) Carolyn Cozad Hughes granted summary judgment in favor of OCR after concluding that, based on the “undisputed evidence,” Lincare violated HIPAA’s Privacy Rule. Specifically, the ALJ found that Lincare failed to safeguard the PHI of patients; a Lincare employee disclosed patient PHI to an unauthorized individual; and Lincare lacked policies and procedures designed to ensure compliance with the Privacy Rule. Lincare waived any challenge to the penalty amount, and the ALJ sustained OCR’s proposed civil monetary penalties of $239,800. Lincare has 30 days to file a notice of appeal with the Appellate Division of the HHS Departmental Appeals Board.

Original content by JDSupra Business Advisor

Read More
911 dispatcher fired

911 Dispatcher Fired For Sharing Caller’s PHI on Facebook

A Catoosa County 911 dispatcher was fired Friday morning for sharing on Facebook the private information of at least one person who called 911.

Holly Dowis was terminated Friday following an internal investigation into her conduct while on the job.

A Channel 3 investigation found Dowis sent a screenshot to Facebook friends in a private chat of one man’s call to 911 requesting emergency assistance.

Sixty-year-old Ringgold resident Ron Darnell called Catoosa County dispatch on December 23rd when he had a blood clot which resulted in an “embarrassing” medical problem.

“I had a blood clot break loose and come out of my body,” he said. “I called to get emergency help and I almost died that day.”

911 Dispatcher FiredThe 911 dispatch screen detailing his call included his name, phone number, address and exact medical complaint. Dowis then took a photo of all that personal information and posted it to a Facebook group chat with some friends.

“A call I just took,” Dowis wrote.

Darnell fears he’s not the only victim. “If they put out mine, how many others have they put out of other people that don’t know it and just making fun of people?”

Dowis has worked with the county since 2007 and was named communications officer of the year in 2013.

“911 is an organization that we must rely on to keep information confidential and to communicate that information to law enforcement officials only and she has violated the public trust,” said Chattanooga Attorney Stuart James.

County Manager Jim Walker said Dowis was fired for misconduct and violating federal and county rules. The county learned of the allegations Tuesday, placed Dowis on administrative leave Wednesday, concluded its investigation Thursday and officially terminated her Friday morning at 11 a.m.

Walker said Dowis had committed similar offenses in the past, though not to this severity, and had been issued warnings.

Darnell told Channel 3 that her losing her job is not enough. He wants to see criminal charges filed against Dowis, which Chattanooga attorney Stuart James said is not far-fetched.

“There’s this thing called HIPAA that guarantees our medical records remain private and that they are private from other people seeing those records,” Stuart James said. “What I see here is not only did she discuss the medical condition the man was suffering from but also named his name, put his address of the Internet and it was a huge privacy concern for him, a huge HIPAA violation, and a huge problem for the 911 center down in Georgia.”

James said criminal charges would be up to a district attorney. But he said in terms of a civil lawsuit, there are issues of a man’s right to privacy, HIPAA violations, and possible libel and slander.

Channel 3 reached out to Dowis and left her a voicemail asking for her side of the story. She has not returned that call as of early Friday afternoon.

Original content by WRCBtv

Read More
Feds Wont Punish URMC

Feds Wont Punish URMC for Last Year’s HIPAA Violation

The University of Rochester Medical Center will not face any action by the federal government after a breach of patient privacy last year involving a nurse practitioner who was leaving for a new job.

URMC was fined $15,000 by the office of New York state Attorney General Eric Schneiderman and required to take other action to ensure compliance with the Health Insurance Portability and Accountability Act after the practitioner shared protected patient information with her new employer, Greater Rochester Neurology.

URMC had to report the breach to the federal Department of Health and Human Services, whose Office for Civil Rights investigates HIPAA breaches. Violations fall into four categories with corresponding penalties. The maximum fine is $1.5 million.

HHS neither confirms nor denies investigations, but URMC officials acknowledged in December that the agency was looking into the violation.

Feds Wont Punish URMC

Asked to provide an update, associate vice president for communications Christopher DiFrancesco wrote in an email, “HHS is aware of the resolution reached with the New York State Attorney General, and they informed us last month that they do not plan to take any further action regarding this matter.”

The attorney general’s office declined comment on whether it was investigating Greater Rochester Neurology. A call to the practice about any action taken against it was not immediately returned.

Last May, URMC officials announced a breach involving a nurse practitioner in the department of neurology.

An investigation by the attorney general found that on March 27, the nurse practitioner asked URMC for list of patients she had treated and received a spreadsheet of patient names, addresses and diagnoses.

The nurse practitioner, whom URMC eventually confirmed as Martha Smith-Lightfoot, shared the information with her new employer, Greater Rochester Neurology.

URMC said it learned of the breach on April 24 by patients who said they received letters from Greater Rochester Neurology.

URMC said Smith-Lightfoot requested the list to help ensure the continuity of care for patients she was leaving. URMC received assurance from Greater Rochester Neurology that the information had been returned or deleted.

In addition to paying the fine, URMC had to train staff on HIPAA policies, including how patient information is handled when employees leave or join the system, and for three years has to report breaches to the attorney general.

Original content by Democrat & Chronicle

Read More
secure texting in healthcare

Before Tackling Secure Texting in Healthcare, Change Culture

While data breaches in the retail and government sectors grabbed the lion’s share of headlines last year, hospitals and healthcare systems remain a favorite target of cyberattacks. The reason is simple: the combination of vast amounts of personally identifiable information, along with electronic health records.

Read More
interoperability hurdles restrain acos

Interoperability Hurdles Restrain ACOs

For accountable care organizations, a lack of interoperability between their health information technology systems and those of providers outside their ACO is the No. 1 challenge they face, cited by 79% of respondents to a survey of 68 ACOs by group purchaser and performance-improvement company Premier and health IT collaborative eHealth Initiative.

Read More
Fear Itself Speech 修改 文章 英文 click through the following web site | Advanced Trading Tools · Learn How to Trade opciones binarias demo click here now
Loan Canada go credit visit their website