Help Me With HIPAA

So far in 2016 there have been 10 resolution agreements announced. One more and this year will equal the number of agreements in all of 2015 & 2014!

The latest two also include the largest one announced yet - $5.5m with Advocate Health.

Before that though was The University of Mississippi Medical Center - Ole Missto those of us in the SEC world. It wasn't something to "shake a stick at" with a$2.75m resolution amount.

The total amount for those 10 announcements so far in 2016 = $20,314,800

Of course the details are what we usually pay more attention to since it tells us exactly what OCR has a problem with in each case. It makes it clear what OCR wants all of us to learn from these folks mistakes.

For more visit HelpMeWithHIPAA.com/69

The OCR audits have begun. On Wednesday, July 13, audit selected CEs where invited to a webinar. OCR staff walked through the processes they can expect for the audit and expectations for their participation. The OCR published information from the webinar so we had to check it out and share what we learned with you guys.

For more details visit HelpMeWithHIPAA.com/68

Say it ain't so! Pokemon and a HIPAA breach really? REALLY!

Creatures are showing up in offices and hospitals just like everywhere else. The concept of keeping people active and engaged with their surroundings while playing a video game seems like a great idea from a healthcare standpoint. And then you actually do a risk assessment of it - this is where the wheels fall off that good idea train.

Get more details as HelpMeWithHIPAA.com/67

We first talked about this in Ep 62. Darknet sale of healthcare records. Now, more information is coming out and it gets more unfortunate for patients every time we read more.

Deep Dot Web broke the news: https://www.deepdotweb.com/2016/06/26/655000-healthcare-records-patients-being-sold/

We picked it up on Data Breaches.net because they were trying to figure out who the entities actually were in each case: https://www.databreaches.net/damn-anyone-know-what-facilities-these-are/

Get more info at https://HelpMeWithHIPAA.com/66

• March 23, 2013 Oregon Health & Science University notified HHS of a breach due to a stolen unencrypted laptop.
• May 1, 2013 OCR notifies them they are investigating the incident
• July 28, 2013 Oregon Health & Science University notified HHS of another breach resulting from storing ePHI at an internet-based service provider without a business associate agreement
• November 8, 2013 OCR notifies them they are investigating the new incident
• July 18, 2016 settlement announced for $2.7 million and a 3 year CAP

What can we learn from this? Go to Help Me WithHIPAA.com/65

OCR recently sent out a message on their listserv asking if your CE or BA was ready for an incident. We have been discussing security incidents a lot lately so it is nice that OCR has brought it up. Because we have seen various Incident response reports recently, so we were working on an episode anyway. So this episode is a review of Security Incident Response Plan development.

Let's first be clear, this isn't just about HIPAA. We also have been reviewing the Economist Intelligence Unit 2013 (EIU) report: Cyber incident response: Are business leaders ready?, which is asking the very same question.

For more information go to HelpMeWithHIPAA.com/64

There has been a lot of news and industry discussions about Medical Device security. Medical Devices are just like a computer, so they also need security to protect the information on them.

For more go to HelpMeWithHIPAA.com/63

A business associate is getting this OCR resolution, $650,000 and a two-year settlement. CHCS in Philadelphia is a BA to 6 skilled nursing clinics in the Philadelphia area. Entities like this do the business part of healthcare and the other clinics don't have to worry about it. An unencrypted iPhone that wasn't password protected had PHI on it.

Patterson Dental Supply Inc. helps manage dental practice information for various providers. One of the clinics they help service is Massachusetts General Hospital, and 4,300 patients had their PHI hacked and compromised.

For more info: HelpMeWithHIPAA.com/62

Since 2010, ID Experts has sponsored this Ponemon Institute study which has been tracking data breach trends of patient data at healthcare organizations. The annual economic impact of a data breach has risen over the past six years, as has the frequency of data breaches. Criminal attacks and internal threats are the leading cause of healthcare breaches. Evolving cyber attack threats such as ransomware and malware are of primary concern for 2016. At the same time, internal issues such as employee negligence, third-party snafus, and stolen computing devices continue to put patient data at risk.

For more info on this episode go to helpmewithhipaa.com/61

28w47ezq

As always, during times of crisis and chaos things do become confused and incorrect statements are made. It is a normal occurrence in troubling situations. But, we need to address it specifically to clear up a few points.

1. There was no "special waiver from the White House". There was no need for one at all.
2. People, even in a crisis, should not be invoking HIPAA over caring for the patient properly.
3. The hospitals talked about implementing their crisis plan - why wasn't HIPAA addressed in the plan. It should be!

For more details go to HelpMeWithHIPAA.com/60