June 2025

OSHA Healthcare Fine
Abyde News, Fines, OSHA

OSHA’s Rapid Response: Why Every Practice Needs a Safety Culture

June 19, 2025 No comments yet

June 19, 2025 The success of your practice hinges on the safety of your staff. When staff feel unsafe, OSHA quickly demonstrates its commitment to staff protection.  A recent healthcare OSHA fine highlights how efficiently OSHA complaints are handled.  Opulent Pediatrics faced expedited penalties following a staff complaint, just months after the initial complaint.  From the case opening in March to its resolution in June, OSHA underscored the severity and importance it places on staff complaints. Complaints are also the most common way HIPAA investigations are initiated.  This rapid response showcases the need for practices to provide a safe work environment and foster a culture of compliance, empowering staff members to communicate needs and concerns.    What Happened? In March 2025, a staff member of Opulent Pediatrics sent a formal complaint to OSHA due to unsafe working conditions. The Roanoke regional office investigated the pediatric practice unannounced, not providing time for the practice to address any concerns.  Following their investigation, it was discovered that the practice violated several safety requirements, such as bloodborne pathogen safety, improper medical services, or missing first aid unavailable to staff, improper handling of wiring and equipment, and insufficient hazard communication documentation. After the investigation, by April, OSHA noted seven citations and issued an initial penalty of over $14,000. It’s inferred that the practice was willing and cooperative, with the final fine totalling over $2,000 by the abatement date in May.    Protecting Staff in Healthcare While Opulent Pediatrics dodged a more significant fine, this enforcement action demonstrates OSHA’s swift investigative response to complaints. From the initial investigation to its conclusion, the case only took three months. OSHA can and will investigate without notice, so ensure your OSHA program documentation is readily available.  With the right tools, ensuring staff safety can be simplified. In this case, training and proper documentation could have avoided these fines. Consider how an intelligent OSHA software solution centralizes training, such as for bloodborne pathogens, hazard communication, and all other OSHA documentation, making it easily accessible to every staff member within a compliance hub. Moreover, by prioritizing safety in your practice, staff can feel empowered to communicate concerns.  To learn more about streamlining OSHA compliance in your healthcare practice, schedule a consultation with an expert today. 

OSHA in Dermatology
Abyde News, Best Practices, OSHA

OSHA in Dermatology: Best Practices to Achieve Compliance

June 12, 2025 No comments yet

June 12, 2025   While working in a dermatology office might have you focused on taking care of your patients’ skin, your health should be the first priority.  It’s easy to incorrectly assume a dermatology office is a relatively “safe” healthcare environment. After all, we’re not typically dealing with the same acute emergencies as an ER. Dermatology presents many challenges when working with patients, such as lasers, sharp instruments, chemicals, potential exposure to bloodborne pathogens, and more.  With these unique challenges, your practice must be aware of the safeguards the Occupational Safety and Health Administration (OSHA) requires.   More than Skin Deep: Facility Risk Assessment An annual Facility Risk Assessment (FRA) is the foundation of your OSHA compliance program. The FRA is a thorough assessment of the healthcare hazards your practice might face. This assessment spans from your staff is trained, to unique equipment you might use, how situations are prevented, and even how management handles workplace safety. Since this is an annual requirement, this assessment must be kept current. If your practice introduces anything new that might heighten risk, this needs to be documented. For instance, if your practice begins offering laser treatments, this must be mentioned in the FRA and also staff must be trained on how to use it safely.  By reviewing and addressing potential vulnerabilities in your practice, you can mitigate risks and ultimately keep patients safe.    Personal Protective Equipment (PPE) in Dermatology: Your First Line of Defense While you advise patients on sun protection, remember that your staff’s skin needs protection, too. Always ensure that it remains covered with Personal Protective Equipment (PPE). PPE, like gloves and masks, are essential barriers that keep your team safe. Your practice must supply this PPE and provide comprehensive training on how to use it correctly.  For instance, when a staff member is with a patient, a new set of gloves is always required. From putting them on to how they must be disposed of, these are all critical ways to keep staff members safe.  Depending on the treatment, your staff may also need eye protection. As a result, it’s essential to review all available forms of PPE with staff before they start working with patients.    Dermatology Laser Safety When it comes to lasers in your dermatology practice, preparation is paramount.  It’s not enough to just have the equipment; you need to ensure every team member is properly trained and fully aware of the risks associated with these powerful devices. Once again, proper PPE is vital, such as eyewear and gloves. Additionally, the room where the laser is being used must adhere to safety guidelines, including not having any reflective surfaces for the laser to shine off.  Your practice should designate a Laser Safety Officer to oversee and enforce compliance. This staff member is likely already your OSHA Safety Officer, or OSO. This Laser Safety Officer needs to ensure staff is routinely trained on lasers, especially if new equipment is being used.  For staff safety, the laser device must be off when not in use.  While laser treatments offer dermatologists innovative possibilities, proper staff training always remains crucial.    Keeping Your Dermatology Practice Safe Ensuring the safety of your dermatology practice is not just about compliance; it’s about fostering a secure environment for both your dedicated staff and your valued patients.  Your practice can proactively address potential hazards by diligently conducting annual facility risk assessments, consistently utilizing appropriate personal protective equipment, and prioritizing comprehensive training.  With the right solution, your practice can streamline these requirements. Smart software can utilize the answers from your FRA and provide thorough policies and procedures and recommended training. A safe practice is a successful practice.  To see how you can streamline compliance for your practice, schedule a meeting with a compliance expert today.

HIPAA for Dermatology
Abyde News, HIPAA

Dermatology’s Hidden Layer: Unpacking HIPAA Compliance

June 5, 2025 No comments yet

June 5, 2025   When ensuring your patients have clear, healthy skin, you might not realize the thorough administrative requirements your practice needs to follow.  HIPAA, or the Health Insurance Portability and Accountability Act, must be upheld by all Healthcare providers and their Business Associates (BAs) who handle and transmit Protected Health Information (PHI). PHI is sensitive information about a patient, such as their Social Security Number, birthdate, medical records, and more. If PHI ends up in the wrong hands, the information could easily be misused, making healthcare a prime target for hackers.  For dermatologists, every piece of information related to a patient’s skin condition – from their name and date of birth to their diagnosis, treatment plan, and even before-and-after photos – falls under HIPAA’s umbrella. Following HIPAA laws doesn’t just protect your practice from fines – it also keeps your patients safe and builds trust.  What is Required for Dermatologists? There’s a lot more required than just yearly training.  Dermatologists must follow the three HIPAA rules: the Privacy Rule, the Security Rule, and the Breach Notification Rule to be HIPAA compliant.  The Privacy Rule dictates how PHI can be shared, specifically the minimum amount of information necessary to handle transactions. Information should only be shared with staff who actually need access to it. Staff access to PHI must be monitored and removed when staff leave the practice. The Privacy Rule also details patients’ Right of Access, requiring practices to provide health records to a patient within 30 days.  The Security Rule focuses on the technical, physical, and administrative safeguards that must be in place in your dermatology practice and includes the required Security Risk Analysis (SRA).  The SRA is an extensive annual review of your practice’s protective barriers in case a situation were to occur. SRA questions include information about physical alarms and locks your practice might have, and how email is handled in your practice. By addressing any vulnerabilities before a breach occurs, your practice can more easily mitigate risk.  Leaving this document incomplete can have severe consequences. For instance, a dermatology organization without a compliant SRA was fined $250,000 following a breach. The Office for Civil Rights (OCR), which enforces HIPAA, also enacted the Risk Analysis Initiative. This new initiative focuses on and fines practices missing an SRA after being alerted of a breach.  In addition to the SRA, dermatologists must complete Disaster Recovery Plans for their practices. The Disaster Recovery Plan builds a contingency plan in case a natural or man-made disaster, such as flooding or a cyber-attack, occurs.  These documents lead to the policies and procedures your practice must have that are easily accessible to staff. With policies and procedures, everyone in your practice will know what is expected and unacceptable in your organization, mitigating risk and providing a guide for every situation. In addition to this, training is also required under the rule for all new employees and yearly.  Expect an update to the Security Rule soon, and you can find the new details here.  The last rule of HIPAA is the Breach Notification Rule. This rule is observed after a breach, ensuring that all involved parties are properly informed following a breach of PHI.  After a breach of any size, affected individuals must be notified within 60 days of the breach’s discovery. If it is a small breach, the OCR must also be informed by the end of the year.  However, the breach is considered large if more than 500 patients are affected. For large breaches, while patients must be notified within 60 days, the OCR also does. The media must also be notified, with a press release going out. Depending on the state, the Attorney General must be made aware of this, too, so it is vital to review state law as well when facing a breach.  Streamlining Compliance in Your Dermatology Practice Given the ever-changing nature of the HIPAA landscape, the brief overview of requirements provided here is just a starting point. While it might feel overwhelming, it’s critical to maintain a compliant dermatology practice.  There are options to simplify HIPAA compliance. Smart software can efficiently assist in compliance management. The pillars of HIPAA compliance, such as the SRA, Disaster Recovery Plan, training, documentation, and more, can all be resolved with the right software platform. By using a smart solution, you can proactively pinpoint gaps and stay on top of your compliance management, freeing you up to focus on caring for patients’ skin.  To see how your dermatology practice can streamline HIPAA for your practice, meet with a compliance expert today.

Abyde News, HIPAA

Introducing SRA Contributor: Master Your HIPAA Risk Analysis

June 3, 2025 No comments yet

June 3, 2025 Have you ever been stumped by a HIPAA Security Risk Analysis (SRA) question because you didn’t know the answer? Even the most seasoned HIPAA Compliance Officers encounter administrative and technical security questions outside their area of expertise, and that’s completely normal. Remember, you’re not expected to have all the answers. So, how are you supposed to get the right answers for the questions you don’t know from those who do? Abyde’s latest update, SRA Contributor, helps you get the necessary answers. This feature allows you to send questions internally to other Abyde users (at your practice) or externally to trusted contacts of your Business Associates (BAs), allowing you to complete your SRA confidently.  The Users section has now been updated to include both Users and Contributors. Once in this section, click the SRA Contributor tab to add external individuals, such as your IT partner, who can assist in answering SRA questions.   Then, complete the SRA. We encourage users to mark uncertain questions with ‘Don’t Know’. Once the SRA is complete, Abyde users can access the SRA Contributor feature from their Scorecard module and securely send any questions as needed. Hit the Abyde Flag icon to the right of any question on your Scorecard to activate the SRA Contributor pop-up and select your Contributors. As a reminder, you can add a note to any question for your Contributors.   Once flagged, the question(s) are batched and ready to be sent. Abyde recommends reviewing any and all questions for Contributors and sending them in one batch to reduce the number of emails. After all questions are flagged, send them together by hitting the send icon on the Contributor line below the question or from the global SEND button at the top of the Scorecard module.  Once sent, your SRA Contributors (and other Abyde users) will receive an email to the secure SRA Contributor Portal. The Contributor Portal includes all flagged questions. Your Contributors can answer your questions, add notes, and send their responses to you once they complete the portal.  From there, you will receive an email notification that your question has been answered and is ready for review. Then, you can either reject or approve an SRA Contributor’s answers. If approved, their answer and note (if present) replace your initial response on the SRA. If rejected, you can send the question again to other contributors or manually change the answer yourself. SRA Contributors’ answers and Contributor Portal links (if they never answered the question) can also be deleted from the Scorecard by clicking the Trash Can icon.  Why This Matters A thorough and accurate Security Risk Analysis (SRA) is paramount for safeguarding patient data and ensuring compliance. It is the foundation of a compliant practice.  The SRA Contributor enables you to complete the SRA more efficiently and confidently, enhancing collaboration with your business associates and other Contributors who manage the more technical aspects of your practice.  This ensures that the required SRA is completed accurately and thoroughly, giving you confidence in the integrity and completeness of your answers.  To learn more, contact our support team at support@abyde.com, or call 1.877.816.1620. 

Business Associate Ransomware Fine
Abyde News, Fines, HIPAA

Ransomware Reality Check: Business Associate Pays Big HIPAA Fine

June 2, 2025 No comments yet

6/2/2025   Did you know Business Associates (BAs) are at risk for ransomware attacks just as much as Covered Entities?  Ransomware attacks disproportionately affect healthcare organizations, with malicious actors looking to exploit Protected Health Information (PHI). When PHI includes sensitive information such as Social Security Numbers, addresses, phone numbers, and more, it provides someone with a lot of information to use for the wrong reasons.  A medical billing BA in Massachusetts, Comstar, LLC, recently experienced the fallout of a ransomware attack. Trusted with the PHI of over 70 practices, the organization did not have the proper safeguards to mitigate risk after a cybercrime. Part of this was a missing Security Risk Analysis (SRA), or a thorough assessment of an organization’s potential vulnerabilities.   This latest enforcement represents the responsibility of BAs to uphold their commitments and for all HIPAA-regulated entities to complete and maintain an SRA.    What Happened? In May 2022, a malicious actor intruded Comstar’s network servers. Comstar was unaware of this intrusion for several days. In the meantime, the hacker encrypted nearly 600,000 patient records with ransomware. Even though these patients weren’t directly Comstar’s, they assumed the responsibility of protecting their data.  While it is not public what steps Comstar took to mitigate risks after the initial ransomware breach, it was discovered that the organization did not complete an SRA. This assessment is at the foundation of a compliant practice and is a requirement of HIPAA.  After this discovery, the organization was fined $75,000 and put under a Corrective Action Plan (CAP), or government monitoring, for two years.  This assessment is at the foundation of a compliant practice and is a requirement of HIPAA.  Recently, the Office for Civil Rights (OCR) has sharpened its focus on this commonly missed requirement with the latest Risk Analysis Initiative. This fine is the 9th enforcement of this initiative.    Streamlining the SRA with Software When less than 20% of BAs could showcase a compliant SRA when being audited, completing the SRA is unfortunately a common oversight by regulated entities. Additionally, this is a responsibility of both Covered Entities and BAs, and both parties must carefully handle PHI.  With smart software, BAs can easily streamline the SRA and complete the assessment that pinpoints common vulnerabilities organizations face. By simplifying the SRA, intelligent solutions can empower an organization to cultivate a culture of compliance for its staff, securely meet requirements, and handle PHI.  To learn more about how your organization can easily complete the SRA, meet with a compliance expert today. 

What's coming next in HIPAA? Join our June webinar to stay up to date.

REGISTER NOW
X