Gaurav Modi, Author at Abyde

Is Fraud, Waste and Abuse Training Required For My Practice?

August 27, 2021 Gaurav Modi Comments Off

August 27, 2021 It’s understandable for healthcare organizations to sometimes feel drowned by responsibilities. In addition to the ongoing balance of patient care and running a business that you’re already tasked with, having to add compliance into the mix can make for some especially muddy waters to tread. However, the compliance struggle is more than just having yet another thing added to your list. It is all of the complexity and confusion that surrounds it. And since the word “compliance” consists of many different legal, ethical and professional standards – it’s not always easy to decipher which items are a must-have to keep your practice afloat. So when it comes to the responsibilities of your practice, though providing quality healthcare and protecting your patients is always a must, not all organizations have to follow the same requirements. Because of this, one question in particular that seems to leave practices scratching their head is, “Are we responsible for providing fraud, waste, and abuse training to employees?” What is fraud, waste and abuse training? If you are familiar with fraud, waste and abuse (FWA) you most likely understand the impact it has on the healthcare industry and why it’s so important to prevent. All employees within a healthcare organization should know what FWA is and how to avoid it, the same as they should know what HIPAA is and how to protect patient health information. However, while annual HIPAA training is a legal requirement with specific stipulations for compliance – the rules are a bit different when it comes to the education for FWA. Previously, the Centers for Medicare and Medicaid Services (CMS) required both Medicare Part C (Medicare Advantage) and Part D (Prescription Drug Coverage) plans along with all participating healthcare organizations to meet the annual fraud, waste and abuse training requirement. Training was to be provided to all employees within the first 90-days of onboarding and on an annual basis thereafter. The goal being to clearly identify what fraud, waste and abuse is and ensure all health plan providers and their “downstream, related entities” (a.k.a. healthcare organizations like you) have the know-how to properly detect, correct, report and ultimately prevent instances of FWA. Now if you’re already meeting HIPAA training requirements (fingers-crossed that you are) the stipulations for FWA training probably seem straightforward enough. However in typical government fashion, with legislation comes continual changes and as of January 1, 2019, the CMS officially updated the standard to only apply to Medicare service providers – not Medicaid – based on the feedback they received regarding the burden of the requirement. But before all the non-Medicare providers who are currently reading go to click the “x” at the top of this page, there are other specific insurance plans that may require their covered entity providers to complete some type of healthcare fraud training. One thing to keep in mind is even if your organization doesn’t fall into these parameters, providing FWA education for all employees is certainly beneficial. So in getting back to that commonly asked question – the requirements for offering fraud, waste and abuse training really just depend on the healthcare plan that your organization provides. Luckily, finding answers can be a simple process as most plans provide their specific standards for not only training but general FWA compliance online. Additionally, there is the CMS’s online resource that’s free to the public. In summary, including fraud, waste and abuse education as a part of your staff compliance training doesn’t have to be complicated. And with the costly impact that FWA and noncompliance can have on your organization, providing this training (even if you aren’t required) can make all the difference in keeping your practice’s head above water and avoiding a violation or fine that could otherwise put you under.

Virginia Dental Association Services Partnership

Partner News

Abyde partners with VDA Services to provide comprehensive HIPAA compliance solutions to Virginia dental practices

August 18, 2021 Gaurav Modi Comments Off

August 18, 2021 August 18, 2021, Tampa, FL – Today, Abyde announced their latest partnership with VDA Services that will help deliver their user-friendly HIPAA compliance software solution to even more of Virginia’s dental professionals. This collaboration will provide VDA members with all of the tools and support necessary to achieve a complete HIPAA compliance program with little time and effort required. Abyde’s partnership with VDA Services showcases their continued mission to revolutionize HIPAA compliance by providing a simple and intuitive solution that fits perfectly with dental providers’ day-to-day operations. Abyde’s software solution is the easiest way for any sized dental practice to implement and sustain comprehensive HIPAA compliance programs. The revolutionary approach to HIPAA compliance guides providers through mandatory HIPAA requirements such as the Risk Analysis, HIPAA training for doctors and staff, managing Business Associate Agreements, customized policies and more. “Our partnership with VDA Services emphasizes our joint commitment in protecting dental practices from the continued rise in cyber threats and patient complaints seen within the healthcare industry over recent months,” said Matt DiBlasi, President of Abyde. “We are thrilled to be a part of the VDA’s proactive approach in helping their members avoid hefty HIPAA penalties as well as assist in safeguarding their patients’ sensitive information through a simplified compliance program.” “The Virginia Dental Association strives to empower the dental community through innovation and our collaboration with Abyde falls perfectly in line with that vision,” said VDA President Dr. Frank Iuorno, Jr. “We’re confident that our members will find Abyde’s solution and team to be the total-package in alleviating their HIPAA stress.” About Abyde Abyde (Tampa, FL) is a technology company dedicated to revolutionizing HIPAA compliance for medical professionals. Launched in January 2017, Abyde was formed with the idea that there could exist an easier, more cost-effective way for healthcare providers to comply with government-mandated HIPAA regulations. For more information on Abyde visit abyde.com. About VDA Services VDA Services (Richmond, VA) is a subsidiary of the Virginia Dental Association. The Virginia Dental Association is a professional membership organization with 4,000 members across the Commonwealth. The VDA’s mission is to represent and serve member dentists by fostering quality oral health care and education. The VDA provides continuing education, advocacy and practice support for its member dentists to further that mission. Read the full press release here.

Best Practices, HIPAA

The Security Risk Analysis and its Many Misconceptions

August 13, 2021 Gaurav Modi Comments Off

August 13, 2021 HIPAA is kind of like a puzzle – without having each and every individual requirement in place, your practice can’t consider itself fully compliant. But much like building a jigsaw blindfolded, it’s a lot harder to piece together the big picture of compliance with all of the misconceptions out there masking what HIPAA’s requirements actually entail. Now, the first piece in this so-called “HIPAA puzzle” is the Security Risk Analysis (SRA) which requires all covered entities to assess any potential risks and vulnerabilities to protected health information (PHI) based on the physical, technical, and administrative safeguards that their organization has in place. It’s essentially just a self-evaluation that helps lay the groundwork for a complete HIPAA program AND is the first thing a practice will be asked to provide in the case of an audit. But despite its importance, only 14% of entities actually fulfill the requirement – so what is causing this lack of compliance and why does the SRA seem like an unsolvable puzzle in itself? A large piece of the widespread noncompliance is all of the confusion that surrounds the ‘what, why, and how’ of the SRA. This is why in order to ensure all organizations know how to complete the first part of the big HIPAA puzzle, we need to break down the myths vs the facts. Myth #1: Small practices and independent providers don’t need to worry about the SRA. False: All providers, no matter the size or specialty, are covered entities under HIPAA and are therefore obligated to perform a risk analysis along with all other requirements under HIPAA law. Myth #2: My Electronic Health Record (EHR) takes care of privacy and security, so I don’t need to complete an SRA. False: Even with a certified EHR, the risk analysis isn’t completed for you. The EHR vendor may provide information and training on the privacy and security aspects of their product but they are not responsible for privacy and security compliance within your practice. Additionally, an SRA involves all PHI within your organization, including what isn’t housed in your EHR like paper records and files. Myth #3: My IT company handles a full SRA. False: Similar to the confusion around your organization’s EHR, IT companies might help to assess technical safeguards and identify technical risks – but do not provide a comprehensive analysis of all aspects of your organization to cover the administrative and physical requirements. Myth #4: I can use a templated checklist to complete my SRA. False: While the government does provide some tools that can be used as helpful guidance for conducting an SRA, in order for the analysis to meet the requirements it must assess specific elements of your organization and practice operations which may differ from the types of things assessed in a template or generic checklist. Myth #5: The SRA is a one-time thing and as long as I completed it once, I’m good to go! False: The HIPAA Security Rule specifically states, “the risk analysis should be an ongoing process, in which a covered entity regularly reviews its records to track access to e-PHI and detect security incidents, periodically evaluates the effectiveness of security measures put in place, and regularly reevaluates potential risks to e-PHI.” But although, your organization does need to be conducting an SRA on a continual basis – this doesn’t mean that each year you’ll need to start over from scratch. It’s important (and required) that you update your SRA annually at the very least as well as any time there are changes to your practice or systems to identify any changes in risks and maintain the necessary safeguards within your organization. While we hope our little game of “myth busters” helped clarify any confusion around what goes into completing this requirement and why it’s so important, we know that it might’ve also caused some concern for how a small, independent practice is supposed to tackle all of this alone. Completing a comprehensive analysis (on an ongoing basis) along with the proper documentation and risk mitigation that’s required involves time, resources, and expertise that might seem unfeasible to a small or medium-sized organization. But luckily there are outside resources available to help debunk the other misconception that completing an SRA HAS to be challenging. So while your practice can tackle this requirement DIY-style, a software solution like Abyde makes it so you don’t have to – providing all the tools and support to guide you through the misconceptions and help to put the pieces into place so that your practice can easily complete the puzzle of HIPAA compliance. Schedule a one-on-one consultation today to see where your practice currently stands and how Abyde makes meeting the SRA – and all other HIPAA requirements – a breeze!

Best Practices

Fraud, Waste, and Abuse in Healthcare

August 6, 2021 Gaurav Modi Comments Off

August 6, 2021 Fraud, waste, and abuse are three little words that have impacted the rising cost of healthcare in a way that’s anything but little. Now, most are probably aware that U.S. health expenditures are growing at a rapid rate, and have been for many years. And while there are many reasons that resulted in the healthcare industry closing out 2020 with a whopping $3.8 trillion tab – ‘fraud’ is a five-letter word that can account for about $60 billion of it. So with an issue this common and costly, how can patients and providers help to stop it? What is it? Now, you’ve probably heard of fraud, waste, and abuse before and can associate each of them with nothing but bad news but what exactly do they mean to healthcare specifically? Who can commit fraud? The answer to this question is pretty much anyone. This includes doctors, patients, billing services…you name it. That being said, as a healthcare provider – it’s your job to not only ensure that you aren’t partaking in any fraudulent activities but are also on the lookout for your staff, patients, and billing providers. How do I prevent it? As a provider, it’s important to develop appropriate prevention policies for your organization that outline best practices for avoiding and detecting healthcare fraud, waste, and abuse. According to the HHS Office of the Inspector General, this program should “establish a culture within an organization that promotes prevention, detection, and resolution of instances of conduct that do not conform to Federal and State law, and Federal, State and private payer healthcare program requirements, as well as the organizations’ ethical and business policies,” and include some of the following components: In helping to reduce and ultimately prevent fraud and abuse, it’s important for your organization to not only have the proper compliance programs in place but also take additional measures such as: With billions of dollars lost each year to health care fraud in the U.S., and the costly impact an investigation could have on your organization’s reputation and revenue – it’s important to have the processes in place to detect and prevent fraud and abuse. Ensuring that your practice is meeting all areas of healthcare compliance, including a complete HIPAA program, is essential to keeping up with government standards and best protecting your patients. So while the rising cost of healthcare might not be totally avoidable, having the right compliance programs in place mean that the expense of a HIPAA or fraud violation can be. And with the penalties ranging from fines of hundreds of thousands of dollars and some even resulting in jail time – proactively preventing incidents before they happen and ensuring complete compliance is priceless.

Cybersecurity, HIPAA

How Are You Controlling Access to Your ePHI?

July 22, 2021 Gaurav Modi Comments Off

July 22, 2021 While there might not be such a thing as a real-life fairy godmother, technology has granted us the power to access a whole world of information with just a click of a mouse. Anything from research, shopping, to chatting with friends is now so simple it almost seems like magic, but this “instant-access” ability is a double-edged sword when it comes to the privacy and security risks that follow in its reign. Now if there’s one industry that truly feels the weight of technologies twofold, it’s healthcare. While sharing, receiving, and storing electronic protected health information (ePHI) is now easier than it ever was before, the heightened number of healthcare data breaches and cyber attacks seen over recent years have identified the ‘Achilles’ heel’ of technology’s power of accessibility. This ongoing battle between ease of access and security risks has been the topic of several Office for Civil Rights (OCR) alerts shared over the past year, and most recently, the main focus of their Summer 2021 Cybersecurity Newsletter. The newsletter titled “Controlling Access to ePHI: For Whose Eyes Only?” highlights a recent report that found that “61% of analyzed data breaches in the healthcare sector were perpetrated by external threat actors.” So while most healthcare organizations know not to go and give the keys of the castle away to just anyone, technology has made access a possibility for really anyone who has a decent internet connection. But the even more striking statistic featured in the newsletter? It’s not just hackers that you have to worry about, the security incident report also uncovered that 39% of those data breaches were actually committed by insiders. Though most fairy-tales feature an evil villain, these insider breaches aren’t always the result of a malicious act. In addition to the multi-million dollar hacking schemes that we see all too often, are stories of staff impermissibly accessing ePHI or leaving sensitive data unattended. So if you’re wondering how you can best protect your practice, the answer is to have the proper authorization policies, procedures, and controls in place. When it comes to those necessary policies and controls, the HIPAA Security Rule identifies certain standards and specifications that healthcare organizations are required to implement. The two standards, Information Access Management and Access Control, are administrative and technical safeguards that work in tandem to protect and secure ePHI – but what exactly do they entail? Information Access Management This standard essentially defines how access to ePHI is authorized and requires HIPAA-covered entities and business associates to implement policies and procedures regarding information access. So, what do some of these specific policies include? Access Control In addition to the administrative requirement for access management, Access Control is a technical safeguard that actually limits the availability of that ePHI based on the organizations’ Information Access Management policy. The OCR’s newsletter describes the necessary controls to coincide with the “flexible, scalable, and technology-neutral nature of the Security Rule” and provides a wide range of control mechanisms for organizations to consider and implement where they see fit. They also provide four implementation specifications which include: So as complementary requirements of the HIPAA Security Rule, your organization is expected to have these standards in place to best prevent both outsider and insider threats. And while it would be nice if you could just have a knight in shining armor there to guard your practice from cyber threats and impermissible ePHI access – implementing the safeguards provided above, and ensuring all staff members are trained on proper access, is the next best thing.

HIPAA, Legislation

What the Proposed 2022 HHS Budget Says About the Future of HIPAA & Cybersecurity

July 15, 2021 Gaurav Modi Comments Off

July 15, 2021 HIPAA compliance has seemed to be on the government’s radar more than ever before. In just the past year, we’ve seen record-breaking Office for Civil Rights (OCR) enforcement, proposed Privacy Rule updates and the implementation of the HIPAA Safe Harbor Law and the 21st Century Cures Act – two new sets of legislation centered around healthcare, technology, and patient rights. So with the spotlight set on protecting the privacy and security of health data during a time where reliance on technology is especially prevalent – it should come as no surprise that the government’s newly proposed budget features a heavy focus and increase in funding for this area specifically. What’s in the proposed budget? The Biden Administration recently released their proposed 2022 budget for the Department of Health and Human Services (HHS) in early June. The proposal calls for additional spending to better protect the healthcare industry from evolving cyber threats and support government efforts in enforcing compliance among covered entities. So exactly how much of a budget increase are they requesting and what does that tell us about the future of HIPAA compliance? While those dollar figures are already a good indicator of where we can expect the government to continue its focus – ensuring that patients’ health data is properly protected goes beyond those hefty price tags. Fiscal 2022 proposed budget also seeks to add 39 staff members to the OCR, bringing the employment total to 229, and acknowledges that the “OCR will engage in rulemaking to further strengthen individuals’ rights to access their own health information, improve information sharing for care coordination and case management and reduce administrative burdens.” So just as recent enforcement numbers have proven the governments’ awareness of noncompliance and influx of cyberthreats has shed light on a lack of proper security protections amongst healthcare providers – this proposed budget provides a ‘crystal-ball’ prediction of what we can expect to see moving forward. Adding in millions of dollars to the budget and expanding the task force in these relevant government agencies will produce even more resources available to ensure all covered entities are best protecting health data privacy and security. And although the new budget is not finalized as of yet, the upcoming changes to the Privacy Rule and commitment outlined within the proposal to improve upon government rulemaking is a clear sign that their emphasis on HIPAA and other health IT-related laws is not going away anytime soon. What does this mean for you? First off, meeting HIPAA and cybersecurity requirements is essential to protecting your practice and your patients from a data breach or HIPAA violation. While these are certainly things that should be prioritized regardless of the government’s spending plans, the proposal creates even more urgency in ensuring that you have these necessary safeguards in place. So as the government continues to hone in their focus on health data privacy and security, your practice should too – and having a complete compliance AND security program is the perfect place to start.

HIPAA, Legislation

Privacy Rule Proposed Modifications | Public Comments Released

July 8, 2021 Gaurav Modi Comments Off

July 8, 2021 Remember those Privacy Rule modifications that the Department of Health and Human Services (HHS) proposed late last year? Well, after adding a 45-day extension on the public comment period back in March, the responses submitted have finally been made available – giving us some additional insight on what we can expect to see when the updates are officially finalized. For anyone looking for a light-read while they drink their morning coffee – diving into the official HHS document might not be for you. The proposal included a lengthy list of changes centered around increasing permissible disclosures of protected health information (PHI) and enhancing care coordination and case management. As the healthcare industry has evolved, so have the necessary requirements for protecting data privacy and security – and these modifications address several issues that have become the source of widespread non-compliance over recent years. One of the major areas of focus should come as no surprise considering the initiative that was declared in 2019 to enhance enforcement for patient right of access violations – and the 19 different settlements that have resulted from it so far. So in looking at how the Privacy Rule changes plan to improve this issue, some of the major proposed provisions include: In addition to addressing patients’ right of access, the proposed modifications also clarify certain definitions and phrasing that oftentimes leads to confusion and misunderstanding by providers and patients. Some of these updates include: While the examples provided are only a snapshot of the full list of proposed modifications, each update follows suit with the evolving environment in the healthcare industry and covers relevant concerns felt by both providers and patients. So much so, that the comment period extension was made due to such a “high degree of public interest” and amounted to a total of 1,391 comments submitted in response to the HHS’s proposal. So what can we expect? These proposed modifications take into consideration the public comments received on the OCR’s 2018 RFI that requested public input on how HIPAA rules could improve to better “support care coordination and case management and promote value-based care while preserving the privacy and security of PHI.” Each provision is a direct reflection of the key themes identified in the public opinion received back in 2018 and addresses issues like administrative burdens and the need for improving upon patient rights. So although we don’t have a time machine to jump ahead and see what exactly the final rule will entail, we can pretty confidently say that these concerns addressed in the HHS document will continue to be a focus in regulatory amendments and government enforcement. And the high volume of public interest clearly depicts the impact and value that enacting these changes will have on patients and providers. When will you need to comply As far as knowing the what and when of the final ruling – we don’t quite have a definitive answer. But it’s important for all covered entities to be aware and prepared for the expectations of complying with the modified Privacy Rule provisions when they are made official. According to the HHS, “The effective date of a final rule would be 60 days after publication.” Additionally, entities will still have 180 days from that effective date to update or implement policies and procedures to achieve compliance with these new standards. So when it comes to the timeframe for when the government will actually start enforcing the new compliance standards, you have 240 days of breathing room once the final rule is published. BUT based on the HHS’s acknowledgment that the impact of adhering to these new guidelines will involve “covered entities actions to re-train their employees on, and adopt policies and procedures to implement, the legal requirements of this proposed rule” we highly recommend taking an ‘early bird gets the worm’ approach for compliance. Having a complete HIPAA program in place along with a full understanding of the potential changes that could be coming your way is the best way to ensure that your patients’ data is best protected and your practice is best prepared for avoiding a HIPAA violation and fine.

Partner News

Abyde and Smile Source partner to deliver leading HIPAA compliance solutions to private practice dental professionals

July 7, 2021 Gaurav Modi Comments Off

July 7, 2021 July 7, 2021, Tampa, FL – Abyde, the industry leading HIPAA compliance software solution for dental practices, announced a new partnership with Smile Source to deliver a complete and quality HIPAA compliance program to their network of over 700 independently-owned dental practices. Abyde’s collaboration with Smile Source as a preferred partner showcases mutual efforts to provide Smile Source members with essential HIPAA compliance programs. The partnership will help dental practices meet government-mandated HIPAA needs and better protect their practice and patient’s health information by identifying and correcting key security safeguards. Abyde’s software solution is the easiest way for any sized dental practice to implement and sustain comprehensive HIPAA compliance programs. The revolutionary approach to HIPAA compliance guides providers through mandatory HIPAA requirements such as the Security Risk Analysis, HIPAA training for doctors and staff, managing Business Associate Agreements, customized policies, and more. “Together with Smile Source, we are excited to show the value and simplicity providers have found with Abyde,” said Matt DiBlasi, President of Abyde. “With the ever-changing legislative environment coupled with increased government enforcement, HIPAA compliance is essential for a dental practice’s success and we are honored to be a part of Smile Sources’ platform.” “Smile Source is focused on not only ensuring the quality of dental care but the importance of maintaining a relationship between the patient and provider – and having a solution in place to protect the privacy and security of patient health information does just that,” said Dan Walker, COO of Smile Source. “We’re thrilled to partner with Abyde and know that our members will find great value in the peace of mind and simplicity their revolutionary software solution offers. About Abyde Abyde (Tampa, FL) is a technology company dedicated to revolutionizing HIPAA compliance for medical professionals. Launched in January 2017, Abyde was formed with the idea that there could exist an easier, more cost-effective way for healthcare providers to comply with government-mandated HIPAA regulations. For more information on Abyde visit abyde.com. About Smile Source Smile Source is a family of over 1,000 dentists & 600 private dental practices working together to provide world-class patient care. When a Dentist joins Smile Source, they are not just getting direct access to the top technology, training, and mentors in the industry. They’re also gaining a network of like-minded colleagues who are thrilled to welcome you into our family. For more information on Smile Source visit smilesource.com. Read the full press release here.

Cybersecurity

Latest OCR Cybersecurity Updates

July 1, 2021 Gaurav Modi Comments Off

July 1, 2021 With Cyber Security Awareness Month right around the corner, the multiple cyber alerts issued by the Office for Civil Rights (OCR) in the month of June serve as a perfect preamble for the importance of prioritizing data protection all year round. These government-issued Cyber Alerts have become all too familiar in the healthcare industry, with the past year seemingly filled with emergency directives and scam tactics to be aware of. So with healthcare data breaches on the rise and the most recent warnings of a heightened risk of ransomware and IT system vulnerabilities – ensuring your organization has the necessary programs in place is essential to avoid falling victim. What did the most recent Cyber Alerts cover? In early June, the White House and Cybersecurity and Infrastructure Agency (CISA) released a memo titled “What We Urge You to Do to Protect Against the Threat of Ransomware.” This alert urged healthcare organizations to take appropriate action in protecting against ransomware threats and covered several best practices that providers can take to enhance cybersecurity including: While keeping up with the above steps should be done on a regular basis, the more recent OCR notice covers additional vulnerabilities organizations should be aware of. According to the memo shared on June 25, 2021 – Eclypsium Security Researchers have discovered a vulnerability in the Dell BIOSConnect feature available on over 180 models of consumer and business devices. Dell urges all customers to ensure that their devices are updated to the latest version and provided a full list of impacted devices and steps to address the vulnerability that can be found here. Additionally, this memo also included an advisory from CISA due to the multiple vulnerabilities found in the ZOLL Defibrillator Dashboard. The agency warns that these vulnerabilities may allow a remote user to take control of an affected system and emphasizes that all organizations should review the ICS Medical Advisory and apply the recommended mitigations. So now what? Well, for any healthcare organization of any size – data breaches and cyberattacks are becoming more and more of a concern. Implementing the necessary technical safeguards, following guidance on ransomware prevention, and keeping all devices and IT systems up to date with the latest version is key to steering clear of heightened vulnerabilities like the ones outlined in recent government memos. Unfortunately, as technology and threat actor tactics continue to evolve, these new and increasing threats don’t seem to be going away anytime soon. So keeping your practice and your patients’ data protected in the long run starts with having both a security AND compliance program in place now.

Best Practices, HIPAA

Your Organizations’ HIPAA Rulebook: Policies & Procedures

June 21, 2021 Gaurav Modi Comments Off

June 21, 2021 Imagine if each sport didn’t have its own set of rules – we’d have baseball players tackling each other in the outfield and hockey players kicking the puck down the ice in front of a stadium full of confused fans with not a clue as to what they’re supposed to be cheering for. These unique sets of guidelines tailored specifically to each sport enable athletes to excel and spectators to appreciate what they’re watching. Without them, the games wouldn’t make much sense. So while the excitement of HIPAA is nowhere near anything you might find in a sports arena, having a rulebook specific to your organization is essential to ensuring patients’ sensitive information is being handled properly and HIPAA requirements are being upheld. HIPAA law came into play back in 1996 to set a national standard for how protected health information (PHI) should be handled and protected. Part of its requirements include the implementation of reasonable and appropriate policies to comply with these standards, but what exactly does reasonable and appropriate mean? Essentially, your organization is required to have policies and procedures in place to set expectations for how PHI should be handled as well as guide daily work operations and ensure consistency in patient care. But just as the specific rules differ for a game of football versus tennis, a small eye care facility has different expectations and work operations than a large hospital would – and therefore requires its own unique HIPAA rulebook. What Do These Documents Include? For any HIPAA fanatics out there, you might already be familiar with the Security Rule’s provisions around the administrative, technical and physical safeguards necessary for protecting PHI which cover a wide range of requirements like completing a Security Risk Analysis (SRA), implementing facility access controls and maintaining up to date asset logs. So in looking at the documentation requirements, your policies should outline these required safeguards as well as the standard procedures for your organization to implement these protections. While the full list of documents and their included content will vary based on your organization’s size and specialty – there are some must-have elements that each rulebook should contain, including: How Should These Policies & Procedures be Implemented? While the list provided above is definitely extensive and probably brings along an image of an overflowing HIPAA manual, it’s only a sample size of all the policies and procedures that your organization could potentially need to implement. And while yes, you can find templates for the majority of these policies online and even some directly on the HHS website, they lack an especially important element to the HIPAA requirement – customization. The latest HIPAA Industry Audit Report uncovered widespread non-compliance for the policy and procedure requirement – a major red flag being the common usage of “template policy manuals that contain no evidence of entity-specific review or revision and no evidence of implementation” (their words not ours). This lack of entity-specific evidence came as a result of organizations not including details like their practice name and HIPAA Compliance Officer (HCO) contact information within each policy document – which are important elements of actually fulfilling this requirement. In addition to providing specific details about your organization itself, another piece to the “customization” requirement is taking into consideration certain state laws that might take precedence over HIPAA. It’s important to ensure that policies including things like breach reporting and responding to record requests meet the most stringent timeframes and requirements that apply to where your facility is located. So in order to meet this important HIPAA standard, the ball is truly in your court. As new opponents like legislative changes, technology advancements, and evolving patient needs require adjustments in your organizations’ operations – your policies and procedures must reflect these updates accordingly. But having the proper documentation and specific content included isn’t all that’s needed to make the cut. Providing employee training on a continual basis is essential to getting staff members up to speed on how they should be running the plays and ensuring that PHI is being handled correctly within your practice. So when it comes to developing a winning HIPAA strategy, having a comprehensive set of properly documented policies and procedures that are understood and followed by everyone within the organization is the best way to stay in the HIPAA compliance game.