HIPAA’s compliance expectations from Business Associate

 

The Health Information Portability and Accountability Act (HIPAA) regards the Business Associate as a major player. HIPAA defines the Business Associate (BA) as either an organization or a person who works with or provides service to a Covered Entity, who in turn is defined as one who handles or discloses Protected Health Information (PHI).

So, a Business Associate is any person or entity that is involved in creating, receiving, maintaining or transmitting PHI to a Covered Entity for a purpose or activity or function as mandated and regulated by the HIPAA Privacy Rule.

Getting compliance right is complicated

While there is no ambiguity about the definition of a Business Associate; what is vague and confusing is the set of roles, responsibilities and requirements expected from a BA. HIPAA has a lot of expectations from the Business Associate. It expects total and complete compliance with the requirements it has set out for Business Associates.

The HITECH Act has recently made changes and updates, raising the bar of expectations from Business Associates. The reasoning for these changes is that the role of the Business Associate is critical, and its functions need to keep changing from time to time to accommodate the changes in technology, best practices, etc. As a result, it has extremely stringent mandates regarding the way a Business Associate handles and uses health information, which is confidential and highly valuable.

Compliance is not negotiable

A Business Associate has to show compliance with a wide range of regulatory requirements. The core areas of HIPAA compliance, such as privacy obligations, security standards, and breach notification requirements, are all where the Business Associate’s work is heavily regulated. A small deviation is viewed very seriously by the OCR. Punitive actions from the OCR are damaging to the Business Associate. The only way of avoiding these penal actions is to be completely compliant with the HIPAA expectations.

All these do not mean that Business Associates should dread HIPAA compliance implementation. They can become successful at their business if they get a complete grasp of HIPAA’s compliance requirements. They need clarity on a number of areas. Once their problem areas are addressed, they are sure to become successful in their business.

Come and get complete understanding of HIPAA compliance for Business Associates

It is with the aim of imparting this understanding that GlobalCompliancePanel, a leading provider of professional trainings for all the areas of regulatory compliance, will be organizing a two-day seminar. Jay Hodes, who is a leading expert in HIPAA compliance and President of Colington Consulting, which provides HIPAA consulting services for healthcare providers and Business Associates, will be the Director of this seminar.

In order to get a complete grasp of the compliance requirements that HIPAA has for Business Associates, please register for this highly valuable seminar by logging on to HIPAA’s compliance expectations from Business Associate.

Total understanding of the requirements for Business Associates

The main aim of this course is to clear the confusions about the roles, requirements and responsibilities of the Business Associate, a role that is often shrouded in haziness. it is only when this is done that Business Associates will have the confidence to enter into contracts for providing services as a vendor or subcontractor. Jay will equip participants with complete understanding of what they must put in place to meet these requirements. In other words, he will help them get complete clarity on HIPAA compliance regulations for Business Associates.

The seminar will be very in-depth, as Jay will start with an understanding of the basics, such as why HIPAA was created, which will help participants get to the deeper aspects of HIPAA compliance requirements. Over the course of these two days, Jay Hodes will cover the following areas at this seminar:

  • Why was HIPAA created?
  • Who Must Comply with HIPAA Requirements?
  • What are the HIPAA Security and Privacy Rules?
  • What are the Consequences of being a Business Associate
  • What is a HIPAA Compliance Program for a Business Associate?
  • What is a HIPAA Risk Management Plan?
  • What is a HIPAA Risk Assessment?
  • What is the Role of the HIPAA Security Official?
  • What are HIPAA training requirements?
  • What is a HIPAA data breach and what happens if it occurs?
  • What are the penalties and fines for non-compliance and how to avoid them
  • Case Examples of HIPAA Data Breaches
  • Creating a Culture of Compliance
  • Q&A.

HIPAA survival is not difficult. It just requires good comprehension.

how-to-improve-patient-education-denteractive

You can take this bet: Try finding out from any healthcare industry professional what she considers the biggest professional challenge of hers, and HIPAA survival would surely not miss out from any healthcare professional’s list. Why? Simply because HIPAA audits are complex.  Period.

So, is the toughness and complexity of HIPAA audits such that one should run away from it? Healthcare professionals are not given this option. They have to mandatorily carry out HIPAA audits in such a way that it satisfies the regulatory authorities. This needs a thorough understanding of the exact meaning and import of words contained in HIPAA. In addition, carrying out successful HIPAA audits, which is what HIPAA survival essentially is all about, requires the healthcare professional in the organization in which HIPAA audits take place, to get a grasp of the purpose and intent conveyed in HIPAA’s language.

This thorough understanding of the meaning and intent of what is contained in HIPAA is absolutely essential for both the Covered Entity and the Business Associate to ensure HIPAA survival.

One challenge upon another

And, in addition to the already existing complexity in HIPAA, which many healthcare professionals consider as an obstacle to HIPAA survival; an additional step has been hemmed into HIPAA audits. It is this: For 2017, the federal government is set to increase the Office of Civil Rights (OCR)’s budget by a good 10 percent. This is being done with one simple intention: To increase the OCR’s resources for carrying out HIPAA audits and to also reinforce the OCR’s efforts towards HIPAA audits.

This is not all. HIPAA survival has been made even more difficult, as the OCR now requires Business Associates and Covered Entities to show compliance with around 180 areas as part of Phase 2 of HIPAA. The time given for response: A mere 10 days.

Any Business Associate or Covered Entity which thinks that these are all to the additional aspects of HIPAA survival are mistaken. Yet another issue compounds the misery of the whole task of HIPAA survival: The OCR’s audit protocol is no longer going to be satisfied with general and vague references to policy documents when they are required to furnish documents to corroborate their work. They have to furnish the specific and exact documents that the OCR asks for during a HIPAA audit. Isn’t HIPAA survival a really tough ask for Covered Entity or a Business Associate?

No room for relaxation

The OCR expects complete and total adherence to its requirements, no matter how tough they may seem. Just a little slackening of effort anywhere down the line can severely impede the preparation for Phase 2 HIPAA audits. This is bound to result in serious issues for the Covered Entity and Business Associate, who simply cannot drop guard even for a second.

If there was any feeling that anyone who is subject to a HIPAA audit can relax a trice, all that has been destroyed by the OCR’s decisions on HIPAA audits for 2017. Its additional measures mean that HIPAA survival is real and serious. To ensure HIPAA survival, Covered Entities and Business Associates need to put a process in place and make sure they control and implement it with the maximum assiduousness and thoroughness. This is to be ensured all the time, every time.

An opportunity to learn what it takes for HIPAA survival

Given the severity of HIPAA survival, it is necessary for those who are subject to HIPAA audits, especially Covered Entities and Business Associates, at whom the new regulations are primarily aimed, to understand the art of HIPAA survival.

This expert guidance is what a two-day seminar from GlobalCompliancePanel, a highly popular provider of professional trainings for the areas of regulatory compliance, will be offering. Please visit HIPAA survival is not difficult. It just requires good comprehension to register for this seminar.

The Director of this two-day seminar is Brian L Tuttle, a senior Compliance Consultant & IT Manager at InGauge Healthcare Solutions. The aim of this seminar is to arm regulatory compliance professionals with total guidance to about how practice managers need to prepare for HIPAA audits. Since many changes have been suggested for 2017 for HIPAA; Brian will throw light on what changes can be expected under the Omnibus Rule and any other applicable updates for 2017.

The Director will explode the various misconceptions and myths about HIPAA, which are a major obstacle to ensuring HIPAA survival. He will explain real life audits conducted by the Federal government to explain HIPAA survival.  He will also illustrate which the highest risk factors for being sued for wrongful disclosures of PHI are, and the manner in which patients are now using state laws to sue for wrongful disclosures.

During the course of this seminar, Brian will cover the following areas:

  • History of HIPAA
  • HITECH
  • HIPAA Omnibus Rule
  • How to perform a HIPAA Security Risk Assessment
  • What is involved in a Federal audit and how is it conducted
  • Risk factors for a federal audit
  • EHR and HIPAA
  • Business Continuity/Disaster Recovery Planning
  • Business Associates and HIPAA
  • In depth discussions on IT down to the nuts and bolts
  • BYOD
  • Risk factors that can cause an audit (low hanging fruit)
  • New rules which grant states ability to sue citing HIPAA on behalf of a patient
  • New funding measures

 

All about HIPAA compliance

all-in-one-HIPAA-Compliance

HIPAA compliance is a must for Covered Entities and their Business Associates. It is a sine qua non requirement from the Department of Health and Human Services (HHS), a US federal department that is charged with the responsibility of enhancing and protecting the wellbeing and health of all Americans. It provides the means for bringing about effective health, as well as human services. Its mission is to engender improvements and developments in the fields of public health, medicine and social services.

The HHS requires complete compliance with its laws by a Covered Entity and its Business Associate. The HHS’ Office for Civil Rights (OCR) considers Covered Entity as one that is involved in generating, storing, receiving or transmitting electronic Protected Health Information (PHI). A Business Associate is one that does all these on behalf of its affiliated CE. HIPAA compliance is mandatory because the nature of information that Business Associates carry with them –Protected Health Information –is of a highly confidential and sensitive nature. Not only that; when there is a breach of data on the part of the Business Associate or the Covered Entity, it results in huge costs by way of damages. Data breaches also carry a bigger penalty: They dent the reputation of the business, something no money can compensate.

Locating the source of data breach

Most of the patient information breaches take place at the Business Associate’s end. This makes compliance with HIPAA compliance rules by BA’s all the more important. The basic reason for which most such breaches take place is the many misconceptions that abound among healthcare organizations about the nature of the HIPAA privacy and security regulations. What these regulations are, what they mean to healthcare organizations, and the steps that the healthcare organizations, Covered Entities and their Business Associates need to do –all these are areas of considerable confusion.

It is to equip professionals from the healthcare industry with the complete knowledge needed to understand and implement HIPAA compliance that GlobalCompliancePanel, a highly popular provider of professional trainings for all the areas of regulatory compliance, will be organizing a two-day seminar.

A complete roundup of HIPAA compliance

Senior healthcare professional Jim Wener, who brings four decades of experience in the industry and has been assisting providers and payers in identifying their automation requirements and helping them select and successfully implement the ideal automation for their needs, will the Director of this seminar. To gain the benefit of the vast experience that Jim brings and to ensure total HIPAA compliance for your organization; please register for this seminar by logging on to http://www.globalcompliancepanel.com/control/globalseminars/~product_id=900874?wordpress-SEO.

Questions, questions, questions

At this seminar, Jim will take the participants through HIPAA compliance from start to compliance. He will provide answers to all the questions that Business Associates and Covered Entities face during the process of ensuring HIPAA compliance. He will show what healthcare organizations need to do to secure their healthcare information.

Some of the questions that he will seek to answer include:

Do the HIPAA regulations apply to the organization? What risks does the organization face, and how does it mitigate these risks? What is it that the organization is required to do, and how is this done? Is there a role assigned for and expected of the organization’s computer resources in assessing and managing HIPAA compliance risks? What is the level of safety that the healthcare organization’s computer and paper patient information carry? Is there a way by which the organization determines if its computer resources provide the needed features and functions for the organization to become compliant?

Diligence can lessen the severity of penalties

These are just some of the questions for which Jim will seek to provide answers. Framing these questions and answering them is a watertight means to developing and executing a compliant plan. This in turn is critical to ensure that the organization takes the right path in ensuring HIPAA compliance. A breach is a very bad thing to happen for an organization, but diligence that the organization has showed in protecting patient information will go a long way in mitigating penalties. This is one of the prime reasons for which attendance at this seminar is necessary.

  • What is HIPAA, who is covered and what is HIPAA Compliance
  • Why the healthcare organization should be concerned about HIPAA compliance
  • How to perform a HIPAA Risk Assessment
  • How to prepare HIPAA Policies and Procedures
  • How to perform HIPAA Training
  • What is IT’s role in the healthcare organization’s HIPAA Compliance
  • How to prepare a Business Continuation/Disaster Recovery Plan
  • How to handle a potential HIPAA Breach.

https://www.hhs.gov/about/index.html

 

Today’s Article on Understanding the HIPAA Privacy Rule, Security Rule and Breach Notification Rules and their compliance

The Health Insurance Portability and Accountability Act (HIPAA)’s Privacy, Security, and Breach Notification Rules are aimed at protecting the privacy, as well as the security aspects of health information. This set of rules has the intention of providing individuals with some rights on information relating to their health.

This is how the three rules need to be understood:

The Privacy Rule: Sets out standards about the conditions to be met for using and disclosing Protected Health Information (PHI). This Rule applies nationally.

The Security Rule: Specifies the kinds of safeguards that Covered Entities and Business Associates have to put in place and implement for protecting electronic Protected Health Information (ePHI) and ensure that they remain confidential and are made available when required, and have integrity.

The Breach Notification Rule: Covered Entities have to report breach of unsecured PHI to the affected individuals and the HHS. In some situations, this has to be reported to the media, as well. The Breach Notification Rule has details on how this is to be done. Generally, a window period of 60 days is given from the date of detection of the breach. Small breaches, meaning breaches that affect lesser than 500 individuals, may be directly reported to the HHS annually.

Purview of the HIPAA Privacy Rule and Security Rule

Privacy Rule: HIPAA Privacy Rule has standards on how to protect PHI held by the following: Health plans, healthcare clearinghouses, healthcare providers; part of whose healthcare transactions are carried out electronically, and Business Associates

Security Rule: HIPAA Security Rule sets out standards and guidelines on the steps that Covered Entities and Business Associates have to take to ensure that Protected Health Information is confidential, has integrity and is made available when needed. The Security Rule describes how these qualities in the ePHI created, maintained or transmitted by them.

Knowledge of all these aspects is very necessary if the Covered Entity or Business Associate has to ensure HIPAA compliance. The task of HIPAA compliance does not become possible with just a reading of the rules and the procedures. Expert advice on how to actually implement the requirements is needed.

This is what a two-day seminar from GlobalCompliancePanel, a leading provider of professional trainings for the regulatory compliance areas, will offer. At this seminar, Jim Sheldon Dean, Director of Compliance Services, Lewis Creek Systems, LLC, will be the Director.

In order to gain complete understanding of the HIPAA Privacy Rule, Security Rule and the Breach Notification Rules, and to understand ways by which to ensure compliance with them in a way that satisfies the regulatory authorities, please register for this seminar by logging on to http://www.globalcompliancepanel.com/control/globalseminars/~product_id=900754?linkedin-SEO .

Jim Sheldon Dean will explain the requirements of HIPAA, how to prevent incidents, and how to survive audits, so that penalties can be avoided. He will offer an explanation of the background to HIPAA, and detail what a manager of healthcare information privacy and security has to know about the most important privacy and security issues. He will also show how to ensure HIPAA compliance, and explain the consequences of inadequate HIPAA compliance.

This seminar will provide in-depth understanding on the major aspects of HIPAA compliance, such as:

o  The new features of the regulations

o  The recent changes

o  The aspects that Covered Entities and Business Associates need to address if they have to remain compliant.

Learning on all aspects of HIPAA Privacy Rule, Security Rule and Breach Notification Rules

Jim will also explain audits and enforcements. He will also describe privacy and security breaches and explain how to avoid them. He will enrich the learning by providing sample documents and references.

Jim will cover the following areas at this two-day session:

o  Overview of HIPAA Regulations

o  HIPAA Privacy Rule Principles, Policies and Procedures

o  Recent and Proposed Changes to the HIPAA Rules

o  HIPAA Security Rule Principles

o  HIPAA Security Policies and Procedures and Audits

o  Risk Analysis for Security and Meaningful Use

o  Risk Mitigation and Compliance Remediation

o  Documentation, Training, Drills and Self-Audits.

https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/HIPAAPrivacyandSecurityTextOnly.pdf

Breaking down the rules into steps makes HIPAA compliance less complicated

HIPAA compliance is a legal requirement for Business Associates and Covered Entities. The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 with two main intentions:

o  To enable employees to keep their insurance intact when they switched jobs or their insurance provider

o  To facilitate the payment and information process by putting in place a uniform code for these.

From its start, up to 2013, HIPAA has undergone a few changes, such as:

o  The privacy regulation additions of 2003;

o  The insertion of the HIPAA Security Rule in 2005;

o  The passage of the HITECH Act in 2009, and

o  The addition of the Omnibus Rule in 2013, with the intention of extending liability to Business Associates

With the insertion of these additions, HIPAA compliance has become more and more demanding and complex, or at least that is what most entities who are required to comply with it feel. Most Business Associates and Covered Entities have issues with the following areas of HIPAA compliance:

–       The 18 identifiers that Protected Health Information (PHI) consists of; with the name, full face photos, e-mail address, and date of birth of the patients being some of their constituents

–       The requirement of designation, by every organization or practice, of a privacy officer, who has to carry out a risk analysis

–       The requirement, as part of HIPAA compliance, of covered health care providers and health plans, of developing and distributing a notice, in which the privacy rights and practices relating to patients’ personal health information have to be clearly explained.

Despite these requirements, HIPAA compliance is not as difficult as it seems

The reality, however, is different. HIPAA compliance is not as complicated and difficult as it is thought to be. At first glance, these requirements may appear to be intimidating. Yet, when it comes to practical application, HIPAA compliance is not really all that cumbersome or difficult. All that is needed is a clear-cut understanding and explanation of the major sections on compliance.

This clear-cut understanding of the major sections on which many Covered Entities and their Business Associates face difficulties is the intention of a seminar that is being organized by GlobalCompliancePanel, a leading provider of professional trainings for the areas of regulatory compliance.

At this detailed two-day seminar, Paul Hales, an attorney at law in St. Louis, Missouri who specializes in HIPAA Privacy and Security Rules, will be the Director. All that is needed to gain a thorough understanding of the perspectives Paul will offer on HIPAA compliance is to register for this seminar by visiting http://www.globalcompliancepanel.com/control/globalseminars/~product_id=900798?linkedin-SEO .

What makes this seminar a valuable learning session is that Paul will explain, in simple and plain language, the contents of HIPAA compliance. He will demystify the tricky areas of HIPAA compliance and offer clarity of understanding of these, and will crystallize them into six easy steps.

Paul will drive home the point that HIPAA compliance becomes easier when its seemingly difficult requirements are broken down into steps. He will suggest six steps that organizations can take to make HIPAA compliance easier.

He will pack the seminar with visual presentations, interactive discussions and stimulating questions and answer sessions. He will also show how to find the right rule with the six step-by-step procedures he will lay down.

Takeaways at this important seminar on HIPAA compliance

Paul will offer these following key takeaways at this highly valuable seminar:

·        Thorough Understanding of HIPAA Rules

  • What they are
  • How they work together
  • Why and How they were made
  • How they are changing and what to expect next

·        HIPAA Risk Analysis – Risk Management for Your Organization

  • A Practical Guided Exercise done in class on your computer to take home

·        Privacy and Security Rules – Permitted and Required Uses and Disclosures

  • What information must be protected
  • Administrative, Technical and Physical Safeguards
  • Social Media, Texting and Emailing Patients

·        The inter-connected, inter-dependent relationship of Covered Entities and Business Associates

·        What is, and what is not a Reportable Breach of Unsecured PHI

http://www.fertilitybridge.com/blog/hipaaandsocialmediawithpaulhales

HIPAA Security Rule Principles

Though short in length,HIPAA Security Rule principles are well defined in some areas, but vague in some others, making implementation of these areas difficult.

HIPAA Security Rules are an offshoot of the Privacy Rule. While Privacy Rule concerns itself with Protected Health Information (PHI) in general, the HIPAA Security Rule (SR) concerns itself specifically with electronic Protected Health Information (ePHI). Since it particularly focuses on an element of the Privacy Rule; it is considered a subset of the HIPAA Privacy Rule.

The HIPAA Security Rule seeks to fortify individually identifiable health information with reasonably high levels of technical, administrative and physical safeguards so that these attributes are protected and unauthorized or inappropriate access, use, or disclosure prevented:

  • Confidentiality
  • Integrity, and
  • Availability.

To enable this, the HIPAA Security Rule codifies a few standards and best practices in information technology. In a general sense, the HIPAA Security Rule requires computer systems containing patient health implementation to implement these three safeguards:

  • Administrative,
  • Physical, and
  • Technical.

It has clear definitions of each component relating to its specifications. Some of the terms on which the HIPAA Security Rule is unambiguously clear are:

Challenges associated with implementing HIPAA Security Rule

Despite the clarity of definitions of a few terms as stated above; the HIPAA security rule is considered complicated by practitioners and participants in the Rule. Although not a very painfully long document in that it runs into only eight pages; because of the high technical nature of its text, it is considered quite complex.

A major requirement that the HIPAA Security Rule imposes is a set of additional organizational requirements, apart from documenting processes that are in tune with the HIPAA Privacy Rule. This is easier said than done, especially for small time providers that have limited technical bandwidth and capabilities, for whom implementing the Privacy Rule itself can be challenging. The solution is to make Health information technology (HIT) resources available for this kind of providers.

Further, this Rule has some ambiguities. For instance, its fundamental requirement is implementation of “necessary safeguards”. There is no unanimity about what this means.

Want to know more : http://www.globalcompliancepanel.com/control/globalseminars/~product_id=900739SEMINAR?wordpress-SEO

HIPAA Security Rule

Though short in length,HIPAA Security Rule principles are well defined in some areas, but vague in some others, making implementation of these areas difficult.

HIPAA Security Rules are an offshoot of the Privacy Rule. While Privacy Rule concerns itself with Protected Health Information (PHI) in general, the HIPAA Security Rule (SR) concerns itself specifically with electronic Protected Health Information (ePHI). Since it particularly focuses on an element of the Privacy Rule; it is considered a subset of the HIPAA Privacy Rule.

The HIPAA Security Rule seeks to fortify individually identifiable health information with reasonably high levels of technical, administrative and physical safeguards so that these attributes are protected and unauthorized or inappropriate access, use, or disclosure prevented:

  • Confidentiality
  • Integrity, and
  • Availability.

To enable this, the HIPAA Security Rule codifies a few standards and best practices in information technology. In a general sense, the HIPAA Security Rule requires computer systems containing patient health implementation to implement these three safeguards:

  • Administrative,
  • Physical, and
  • Technical.

It has clear definitions of each component relating to its specifications. Some of the terms on which the HIPAA Security Rule is unambiguously clear are:

Challenges associated with implementing HIPAA Security Rule:

Despite the clarity of definitions of a few terms as stated above; the HIPAA security rule is considered complicated by practitioners and participants in the Rule. Although not a very painfully long document in that it runs into only eight pages; because of the high technical nature of its text, it is considered quite complex.

A major requirement that the HIPAA Security Rule imposes is a set of additional organizational requirements, apart from documenting processes that are in tune with the HIPAA Privacy Rule. This is easier said than done, especially for small time providers that have limited technical bandwidth and capabilities, for whom implementing the Privacy Rule itself can be challenging. The solution is to make Health information technology (HIT) resources available for this kind of providers.

Further, this Rule has some ambiguities. For instance, its fundamental requirement is implementation of “necessary safeguards”. There is no unanimity about what this means.

Read More Information