HIPAA Compliance: What Medical Practices and Their Business Associates Need to Know
2 likes895 views
The document outlines HIPAA compliance requirements for medical practices and their business associates, emphasizing the importance of protecting patient health information. It details major provisions of HIPAA, such as the privacy and security rules, the role of business associates, and compliance enforcement mechanisms. Additionally, it highlights the need for comprehensive risk assessments and employee training to ensure adherence to HIPAA regulations.
HIPAA Compliance: What Medical Practices and Their Business Associates Need to Know
- 1. HIPAA Compliance: What Medical Practices & Their Business Associates Need to Know August 29, 2013
- 3. PRESENTER Brian Rosenfelt, CPA Skoda Minotti Risk Advisory Services • Former controller, CFO and operations executive in a variety of industries • Served as business process engineer with Kaiser Permanente • Leads Skoda Minotti’s HIPAA consulting practice • Deep understanding of accounting, technology and compliance
- 4. AGENDA • • • • • • • HIPAA History Definitions Major Provisions 2013 Omnibus Rules Compliance and Enforcement Risk Assessment Policies & Procedures
- 5. WHAT IS HIPAA? • HIPAA: Health Insurance Portability & Accountability Act • Signed into law in 1996 • Federal law protecting the privacy of Protected Health Information (PHI) • The overall purpose is to ensure the security and privacy of individual health information
- 6. HIPAA HITECH ACT OF 2009 Origins • Prior to 2009, HIPAA regulations were not being enforced consistently (if at all) • New act was meant to: Strengthen controls and oversight of PHI Improve breach notification requirements Expand the definition of covered entities and business associates • Built on the heels of providing incentives for doctors and hospitals to implement Electronic Medical Record (EMR) systems
- 7. DEFINITIONS • Protected Health Information (PHI) • Covered Entity • Business Associate
- 8. PROTECTED HEALTH INFORMATION (PHI) What is PHI? • Oral or written information created by a healthcare provider or other entity that relates to someone’s health or condition, healthcare received, or healthcare payment • Unsecured PHI is data that is not encrypted Examples of PHI • • • • Medical information and records Billing information and records Medical insurance forms Lab results
- 9. COVERED ENTITY VS. BUSINESS ASSOCIATE Covered Entities • Health Care Provider (dentist, doctor, nursing home, pharmacy) • Health Plan (HMO, company health plan, health insurance companies) • Health Care Clearinghouse
- 10. COVERED ENTITY VS. BUSINESS ASSOCIATE Business Associates • • • • Attorneys Accountants Consultants Third Party Administrator (claims processing, etc.) • Anyone who does, or could come into contact with PHI • Others Document shredding company Cleaning company Software company Business associates can be anyone with access to or potential access to health information.
- 11. MAJOR PROVISIONS • • • • • Privacy Rule Security Rule Breach Notification Rule Enforcement Rule Unique Identifiers Rule
- 12. PRIVACY RULE • Applies to use and disclosure of PHI • Reason for HIPAA language and forms you sign at your doctor’s office • Requires patient authorization for certain disclosures (release of medical information to employer, relative, etc.) • Disclosure permitted for treatment and/or payment purposes
- 13. SECURITY RULE • Applies to the securing of ePHI (electronic protected health information) • Requires implementation of three types of safeguards: Administrative (policies and procedures) Physical (access to server room, access to patient paper records) Technical (email encryption, password policies, technical auditing)
- 14. BREACH NOTIFICATION RULE • Risk of Harm evaluation (old rule) • Risk Assessment and “Low Probability” (new rule) • What should the Risk Assessment look for? Type of PHI compromised Who compromised the PHI Was the PHI actually viewed How was the breach/violation mitigated
- 15. A LONG TIME COMING … • Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted on February 17, 2009 • Proposed Regulations: July 14, 2010 • Final “Omnibus” HIPAA Regulations: January 25, 2013 Effective Date: March 26, 2013 Compliance Date: September 23, 2013 • Copy of final regulations: http://1.usa.gov/Wl60lE 138 pages
- 16. MAJOR CHANGES WITH THE NEW RULES Business Associate Liability Increased • Business Associates are now covered DIRECTLY under HIPAA (same rules and regulations as Covered Entities) • Security and privacy rules now apply to Business Associates • Information can only be used per contract language • Penalties now apply to Business Associates • Business Associates are now responsible for sub-Business Associates
- 18. KEY CHANGES DUE TO HIPAA HITECH Breach Notification Rules • Requires Covered Entities and Business Associates to provide notification following a breach of unsecured PHI • Similar breach notification rules for vendors of personal health records and their 3rd party service providers • Covered Entities must notify affected individuals within 60 calendar days of the discovery • If the breach effects more than 500 individuals, the media and Department of Health and Human Services must be notified • Business Associates are obligated to report breaches to Covered Entity
- 19. KEY CHANGES DUE TO HIPAA HITECH Business Associate Responsibilities • Must implement applicable privacy provisions • Must implement all of the HITECH security provisions • Now subject to the same civil and criminal penalties as Covered Entities • Contracts between Covered Entities and Business Associates must be amended to include new HITECH provisions
- 20. HIPAA COMPLIANCE & ENFORCEMENT Original Rule • U.S. Department of Health & Human Services regulates and enforces HIPAA through its Office of Civil Rights (OCR) • Civil penalties: Fines start at $100 and can increase up to $25,000 • Criminal penalties: Could include up to 10 years in prison and $250,000 HIPAA HITECH ACT of 2009 • State Attorneys General can also bring civil action in federal court if the interest of residents has been threatened or affected by a HIPAA violation
- 21. HIPAA COMPLIANCE & ENFORCEMENT Potential Civil Penalties Violation Category Section 1176(a)(1) Each Violation All such violations of an identical provision in a calendar year $100-$50,000 Up to $1,500,000 (B) Reasonable cause $1,000-$50,000 Up to $1,500,000 (C)(i) Willful neglect – Corrected $10,000-$50,000 Up to $1,500,000 (C)(ii) Willful neglect – Not Corrected $50,000 or more Up to $1,500,000 (A) Did not know SUMMARY: Fines are mandatory when failure to have training and reasonable procedures on proper disposal is discovered. HHS goes on to say that had they found proper training in the same case, the same incident would not have been deemed a case of willful neglect.
- 22. HIPAA COMPLIANCE & ENFORCEMENT Potential Criminal Penalties Type of Violation Potential Jail Sentence Unknowingly, or with reasonable cause Up to one year Under false pretenses Up to five years For personal gain or malicious reasons Up to ten years
- 23. HIPAA COMPLIANCE & ENFORCEMENT Consequences • October 26, 2009: (Little Rock, Arkansas) sentencing of three healthcare workers who pled guilty to misdemeanor HIPAA violations based on accessing patient records without any reason • April 27, 2010: (California) press release entitled “Ex-UCLA Healthcare Employee Sentenced to Federal Prison for Illegally Peeking at Patient Records” – first person to be convicted and imprisoned for HIPAA offenses based only on unauthorized access of PHI
- 24. HIPAA COMPLIANCE & ENFORCEMENT Consequences • January 9, 2012: Minnesota Attorney General brought action against Accretive Health, Inc. (a business associate, NOT a covered entity), in the wake of the theft of a company laptop computer that contained over 23,500 patient records • April 17, 2012: Phoenix Cardiac Surgery, P.C. agreed to pay $100,000 and take corrective action after they were found to have posted a patient appointment calendar online
- 25. HOW TO GET COMPLIANT Begin with a thorough RISK ASSESSMENT • Essential component of HIPAA compliance • Can help your organization identify its most critical areas of vulnerability • The Risk Assessment will form the basis of determining how risks should be managed and/or minimized • This is a necessary strategy to identify potential gaps in your security environment (physical and electronic) • Required by HIPAA
- 26. HOW TO GET COMPLIANT • Risk exposure decreases significantly when an organization knows where its PHI is stored and what procedures are in place to access it • A complete risk assessment examines four critical areas: Process Governance People Technology
- 27. UPDATING POLICIES & PROCEDURES • Assess the current policies and procedures (if they exist) Breach notification requirements Incident management procedures Training requirements and procedures • Prior to HITECH, Business Associates did not need to produce documentation
- 28. UPDATING POLICIES & PROCEDURES • Update documentation – address high risk areas first • A strong disciplinary policy is a necessity Training without enforcement is of little value Establish consequences for violation of HIPAA security policies Take strong action against employees who violate policies and procedures (especially those that relate to security policies)
- 29. UPDATING POLICIES & PROCEDURES • Training on policies and procedures is critical Train based on the highest risk area according to your assessment Regular, ongoing training for the entire workforce (no exceptions) is a must Training focus on remote access and removable media is important (movement of ePHI)
- 30. UPDATING POLICIES & PROCEDURES • Require all those with remote access or who use portable media of any type, to sign an attestation stating they: Received the education Agree to abide by the policies of the organization Understand the risk to ePHI inherent in electronic use Know the degree of discipline they face for violating the policies
- 31. UPDATING POLICIES & PROCEDURES • HIPAA requires documentation to be retained for six years • The organization must be able to show that the documentation was available to the persons responsible for implementing the procedure • A procedure is required for reviewing documentation and ensuring it remains up-todate • Evidence of employee training and an acknowledgement of policies and procedures are also required
- 32. INVOLVE EVERYONE • Interview department directors to understand their risk concerns and controls in place • Including them in the HIPAA security processes helps to ensure they will be educated and “on-board” with the controls you recommend • People are the most important component of an effective security program
- 33. QUESTIONS? For additional information about Skoda Minotti’s HIPAA consulting and compliance services, contact us at: Brian Rosenfelt, CPA Skoda Minotti Technology Partners [email protected] (440) 449-6800 Website: www.skodaminotti.com Other Services: • Audit • Tax • IT Consulting • Phone Systems • Marketing • Investments • Security