Help Me With HIPAA

How do I get rid of my printers properly? Find out in HIPAA Answers Episode A1.

Thanks for our listener questions that are coming in! It took us a bit to work out the best way to get back to you, so sorry for the delay.

Today we introduce, HIPAA Answers episodes. These short "answer episodes" will be released weekly on Tuesday mornings.

Send us your questions and we will get them answered. Lots of ways to contact us below!

Website form or Speakpipe voicemail

Twitter

LinkedIn

Facebook

Google+

Send us an email

A discussion of the findings in the recently released study concerning healthcare breaches in 2014.

A managed service provider (MSP) is a third-party contractor that is under contract (usually a monthly fee) to provide on-going technology support to other organizations.

Fourth Annual Benchmark Study on Patient Privacy and Data Security

Criminal Attacks: The New Leading Cause of Data Breach in Healthcare

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Represented in this study are 90 CE and 88 BAs.

This year is the first time BAs were added to the study data. Previous fours years only CEs were included.

A security incident is defined as a violation of an organization’s security or privacy policies involving protected information such as social security numbers or confidential medical information.

A data breach is an incident that meets specific legal definitions per applicable breach law(s). Data breaches require notification to the victims and may result in regulatory investigation, corrective actions, and fines.

Points to note:

• There has been a 125% increase in breaches due to criminal attacks on healthcare data over last 5 years.
• Only 40% of healthcare organizations and 35% of BAs are concerned about cyber attackers even though it is now the number one reason for breaches and increasing rapidly.
• Security incidents that aren’t breaches are also primarily criminal attacks: 78 percent of healthcare organizations and 82 percent for BAs security incidents.
  • 87% of BAs had multiple security incidents in the past 2 years involving the exposure, theft or misuse of electronic information.
    • 70% say they have had between 11 and 30 electronic information-based security incidents.
  • Most involved the exposure of less than 100 PHI records.
• Medical identity theft has nearly doubled in five years, from 1.4 million adult victims to over 2.3 million in 2014.
• Employee negligence remains a top concern when it comes to exposing patient data inappropriately.
• Many victims of medical identity theft report they spent an average of $13,500 to:
  • Restore their credit,
  • Reimburse their healthcare provider for fraudulent claims and
  • Correct inaccuracies in their health records.
• According to the findings of this research, the average cost of a data breach for healthcare organizations is estimated to be more than $2.1 million.
• No healthcare organization, regardless of size, is immune from data breach.
• The average cost of a data breach to BAs represented in this research is more than $1 million.
• Even though organizations are slowly increasing their budgets and resources to protect healthcare data, they continue to believe not enough investment is being made to meet the changing threat landscape.

Interesting question details:

ONC recently published an updated guide for Privacy and Security of Electronic Health Information. This episode David and Donna discuss what that guide calls the Seven-Step Approach for Implementing a Security Management Process.

Links

Guide to Privacy and Security of Electronic Health Information

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Notes

The 7 Steps

Step 1: Lead Your Culture, Select Your Team, and Learn

Assign your officers, make sure they are trained, show compliance is a top down commitment

Step 2: Document Your Process, Findings, and Actions

If you can't prove it then it didn't happen. Document your decisions, plans and activity

Step 3: Review Existing Security of ePHI (Perform Security Risk Analysis)

Review or perform your Security Risk Analysis and current security assessment

Step 4: Develop an Action Plan

The plan needs to address all the things you identified in your assessments, policies, and procedures

Step 5: Manage and Mitigate Risks

This is where your project management skills come into play making sure you have addressed all the risks in your Analysis and new ones aren't showing up

Step 6: Attest for Meaningful Use Security­Related Objective

If you are attesting make sure you have done the previous steps

Step 7: Monitor, Audit, and Update Security on an Ongoing Basis

Remember it isn't a project that has a beginning and ending date

We finish up our discussion about some common myths (or points of confusion) surrounding HIPAA compliance requirements.

GlossaryMyth is a widely held but false belief or idea.

Links

HealthIT.gov Top 10 Myths of Security Risk AnalysisHealthIT.gov Guide to Privacy and Security of Electronic Health Information Analysis

Notes 1 - 7 of 10 Covered in two previous episodes.

1. HIPAA covers all PHI no matter who possesses the information. False. HIPAA law applies to entities that are health plans, healthcare clearinghouses, and most healthcare providers and the businesses that create, receive, maintain, or transmit PHI on their behalf. Not every person or organization that possesses PHI falls under the CE or BA categories of HIPAA.

2. A one hour video course is all that a compliance officer needs to implement HIPAA in any organization. Mostly false. The law requires you have an educated person in charge of privacy and security compliance. It does not define what that education should contain. I can't imagine how anyone could do it with such little training. Nor do any others who do the job themselves. Training is essential to understanding the requirements enough to perform them.

3. HIPAA training requirements are met with an annual training for all employees. Mostly false. It could be argued that all is required is a quick reminder/refresher course. However, the amount of training provided for privacy and security awareness is directly related to the results you will get from your workforce. If you don't worry about it more than once a year, neither will they.

We continue our discussion about some common myths (or points of confusion) surrounding HIPAA compliance requirements.

GlossaryMyth is a widely held but false belief or idea.

Links

HealthIT.gov Top 10 Myths of Security Risk AnalysisHealthIT.gov Guide to Privacy and Security of Electronic Health Information Analysis

Notes 1-3 In previous episode

1. Communicating with patients via email, fax, or telephone violates HIPAA. Actually, not true. But.... reasonable and appropriate safeguards must be in place.

2. HIPAA compliance is just like all the other compliance rules for other industries. You learn the requirements and you do what they say. Not at all true. HIPAA rules were designed to allow for every size and type of healthcare entity and business associate to use one set of regulations. That means there are phrases like "reasonable and appropriate" thrown all over them. Every single organization can determine what is reasonable and appropriate for their environment as long as they document how they are addressing the standards. Not even a risk analysis has one method to be performed across all organization.

3. A website is HIPAA compliant if it uses HTTPS. False. There are two parts of electronic compliance security. You must secure data in motion (like when it is transmitted to a web page via HTTPS). You must also secure the data at reset (what happens to the data once it gets to the server on the other end). Just letting a web designer throw up a registration form or appointment request form will not meet the compliance standards for HIPAA by simply adding HTTPS.

4. If a vendor signs a Business Associate Agreement there is nothing else for me to worry about concerning them. False. If you have knowledge that a vendor is not compliant and you continue to use their services simply because they signed a BAA you aren't much better off than if you never signed one. Your liability is still tied to the fact that you don't have a compliant BA. By working with them while knowing (or doubting) their compliance understanding and commitment makes you complicit in any failures they may have with PHI. Perform a due diligence of some sort to get assurances they actually have a compliance program in place.

8-10 In next episode

we discuss some common myths (or points of confusion) surrounding HIPAA compliance requirements.

Glossary Myth is a widely held but false belief or idea.

Links

HealthIT.gov Top 10 Myths of Security Risk AnalysisHealthIT.gov Guide to Privacy and Security of Electronic Health Information Analysis

Notes

1. Providers are not allowed to share information about a patient with others unless authorized by the patient to do so. False. Providers can share:

   With anyone the patient identifies as a caregiver

   When the information is directly relevant to the involvement of spouse, family member, friends, or caregivers. (Ebola for example)

   When necessary to notify a caregiver about a change in condition or location of a patient (as long as the patient doesn't object)

   When in the best interest of the patient regardless of their ability to object or not

2. The security risk analysis is optional for small providers and business associates. False. Everyone is required to abide by the Security Rule which specifically requires a security risk analysis.

3. A checklist will suffice for the risk analysis requirement. False.Checklists are tools for doing the analysis and gathering your data but they aren't enough to meet the risk analysis requirement. A Security Risk Analysis must include three main elements (according to OCR guidance):

A. Identification of all PHI sourcesB. Human, electronic and environmental threats to the PHIC. Review of current security measures to protect the PHI from those

In this episode we discuss technology support requirements under HIPAA and why professional, HIPAA compliant IT services are an important part of managing your security compliance.

The Security Rule has so many specific technical things to consider it really requires professional technology services to handle it properly. We discuss why that is needed and what to expect from a HIPAA Compliant IT company.

A managed service provider (MSP) is a third-party contractor that is under contract (usually a monthly fee) to provide on-going technology support to other organizations.

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

In this episode we discuss the importance of documentation for your HIPAA compliance program. You can be doing everything right but without documentation there is now way for you to show anyone else that is the case. If you can't prove it then you aren't doing it as far as OCR is concerned.

A managed service provider (MSP) is a third-party contractor that is under contract (usually a monthly fee) to provide on-going technology support to other organizations.

FindHealthcareIT

HIPAAforMSPS.com

KardonCompliance.com

ComplyAssistant.com

• OCR says "don't just tell me you are compliant, show me you are"
• What do you need to document
  • Policies and Procedures, including archive history
  • Risk Analysis and Risk Assessment
  • Training for workforce (who, what, where, when)
  • Risk Mitigation project plans
  • Issue/Incident details
  • BAAs and BA Due Diligence
  • Activity monitoring reports and logs
  • Audit plans and results
  • Assessment plans and results
  • Inventories of software, hardware, etc
  • Breach response plans and documentation
• Spreadsheets and documents in folders or document management tools
• Compliance Management tools

In this episode we discuss how to take the first steps to building a "culture of compliance" in your organization. Every project has to start somewhere but where do you start with something as big and complicated as HIPAA? Well.... Just like the joke goes "How do you eat an elephant?" "One bite at a time."

How do you break HIPAA Compliance into bite sized pieces and get your project moving? We have some tips for you.

Glossary

A culture of compliance is when an organization establishes standards, rules, and policies that aren't simply distributed to the workforce. The organization as a whole takes their compliance serious at a personal level. Each person agrees to abide by the standards, rules, and policies set forth and holds themselves accountable to each other for doing so. This culture can only be accomplished if it is done from the CEO all the way down the organization to the volunteers and/or temporary employees.

Links

Posts From Donna's Blog SmallProviderHIPAA.com

How do you create a culture of HIPAA compliance?

HIPAA Documentation AKA Telling Your Compliance Story

How long will it take to get HIPAA compliant?

Simple HIPAA Checklist – Well Sort of

5 Tips to Just Get Your Risk Analysis Done

Please, Just Do My HIPAA For Me!

Notes

• What is a culture of compliance?
• What are the parts I need to build a culture of compliance?
  • Established and supported by Senior Mgmt
  • Integrated into all training and education done for the workforce
  • Programs are designed to reward compliance
  • Sanctions are applied equally to all levels for failure to comply
  • All technology is reviewed and managed with compliance in mind
  • Every decision, project, addition, and subtraction to the business includes considerations for compliance
• How can you really break HIPAA into small bites?
  • Documentation management plan
  • Business Associates
  • Privacy
  • Security
  • Breach
• How to motivate myself to take the first bite of the elephant?
  • Every single week start with one task that must be completed
    • Policy or procedure reviewed
    • BA evaluated and audited
    • Procedure audited
    • Training class attended
  • Allocate time to complete a task each week
    • It isn't something you do last, it should be something that is as important as completing you accounting reports, payroll, accounts receivable management, etc.
    • Build the habit or assign it to someone who has the time to apply to getting it done.
  • Build on what you started
    • HIPAA compliance is never "done"

HIPAA requires encryption in transit and lists encryption at rest as addressable. What does all that mean?