Abyde News Archives

One Click Away from a Breach: Protecting your Practice from Phishing Emails

August 28, 2025 Penelope Schweitzer No comments yet

August 28, 2025 We’ve all received an email that’s a little too good to be true. Maybe it’s a “Congratulations, you’ve won a free vacation!” message, or a heartfelt request from an “international prince” who just needs your bank details. While these examples may sound obvious, phishing emails today are far more convincing, using logos, sender names, and even tone that mirror trusted organizations. However, healthcare staff have an even bigger target on their backs due to the sensitive nature of Protected Health Information (PHI). Healthcare staff, from the office manager to the doctor, are close to patients’ Social Security Numbers, billing information, and more, all of which are a goldmine for a malicious actor. In light of the most recent $170,000 phishing HIPAA fine, it’s essential to review the best tips for keeping your email and patient data secure. Email Safety 101 When hackers send 3.4 billion phishing emails daily, it’s essential to remain vigilant when reviewing emails. One mistaken click can jeopardize thousands of health records, so always carefully read your emails. While your spam filter might hide some risky emails, phishing has become more advanced, including spoofing staff members and, in general, looking legitimate upon first glance. First, when receiving an email, always think before you click. Does the email look suspicious? Is the grammar odd? Are there unnecessary attachments? Never download any attachments unless you are sure of the sender. A hacker could expose your entire practice to ransomware with one unsafe attachment. All it takes is one click. When receiving an email, always ensure the account looks authentic. A familiar name doesn’t always mean a safe email. Cybercriminals are betting on healthcare staff not knowing the difference between ‘yourboss@email.com’ and ‘y0urboss@email.com’. The internet also provides hackers access to public posts, so even if the profile photo might be of your boss, chances are it isn’t your boss sending you an email demanding personal information. Watch for common red flags. If an email feels unusual, pause before acting, especially with messages marked as “urgent.” Cybercriminals rely on panic to push quick clicks. For example, an email shouting “WARNING: Update your EHR immediately using this link” is likely a scam designed to trick you into handing over access. Delete spam emails or forward them to your phishing IT team (if applicable, likely for larger organizations), and ensure your team is aware of any threats and trained to identify and handle them appropriately. Keeping it Secure Phishing emails aren’t rare; they’re routine. That’s why it’s critical to give your staff the tools they need to safeguard PHI. A strong compliance program goes beyond policies by providing hands-on email safety training, encouraging protections like multi-factor authentication, and connecting your practice with trusted IT resources. Meet with an expert today to learn more about HIPAA compliance and email safety.

Abyde News, Business Associates, Fines, HIPAA

Phished and Fined: A $175,000 HIPAA Lesson for Business Associates

August 26, 2025 Penelope Schweitzer No comments yet

August 26, 2025 When scrolling through your inbox, letting your guard down is easy. Maybe you click on that email that looks like it’s from your bank without hesitation, or are swayed by the unsolicited message for a random all-expenses-paid trip. Unfortunately, phishing emails are everywhere, and they target the healthcare industry due to the sensitive nature of Protected Health Information (PHI). BST & Co., CPAs, LLP, known as BST, is a victim of phishing scams. The New York accounting and consulting firm, which works with practices, received the latest HIPAA enforcement, with a $175,000 fine and a two-year Corrective Action Plan or close monitoring by the Office for Civil Rights (OCR). The OCR discovered, after the fallout of a phishing email, that the Business Associate (BA) had failed to complete a Security Risk Analysis (SRA). This is the 10th enforcement of the Risk Analysis Initiative since its introduction last year. An SRA is a requirement for all HIPAA-regulated entities to assess all potential vulnerabilities of any physical, technical, or administrative safeguard in their organization. By identifying any concerns before a breach occurs, organizations are able to better safeguard PHI, keeping both their business and patients safe. This fine reminds us that BAs are just as responsible for upholding HIPAA as traditional medical practices and that completing the SRA is paramount. What Happened? On December 4, 2019, malware entered BST’s network after a successful phishing attempt. From December 4 to December 7, 170,000 patients’ PHI was exposed. The OCR began its investigation after BST reported the breach in February 2020. The OCR discovered that BST had not completed a thorough SRA. With a thorough SRA, BST could have seen the vulnerabilities regarding emails, or even how they secured Covered Entities’ PHI, and either prevented this breach or minimized its impact. Compliant Business Associates Keep Patients Safe Even though BST wasn’t treating patients directly, as an accounting and consulting firm they still had access to a Covered Entity’s PHI. That’s a clear reminder of just how important it is to make sure your Business Associates (BAs) are fully compliant. When your BA follows a comprehensive HIPAA compliance program, your practice gains peace of mind and a stronger, more secure partnership. The right solution helps you stay ahead of your BA responsibilities, whether that’s generating and maintaining Business Associate Agreements, providing staff training with practical tips like email safety, or completing a Security Risk Analysis (SRA) to uncover hidden risks. Connect with our team of compliance experts today to learn more.

Abyde News, HIPAA

HIPAA Turns 29: The Law That Changed Healthcare Forever

August 21, 2025 Penelope Schweitzer No comments yet

August 21, 2025 Happy birthday, HIPAA! Since the Health Insurance Portability and Accountability Act’s inception on August 21, 1996, to say healthcare has changed is an understatement. As we journey through memory lane and maybe open a present or two, it’s essential to see how HIPAA has championed patient privacy rights and made healthcare better for all. Life Before HIPAA While 29 years ago might not feel that long ago, the way healthcare staff handle Protected Health Information (PHI) has completely changed. When HIPAA first arrived, its purpose was simple: improve healthcare portability and reduce fraud. What wasn’t as obvious at the time was that it would reshape how privacy, security, and patient rights were protected across the country. It was the 90s. The age of AOL dialup, grunge, and while not as memorable for most, the start of the digitization of health records. The government realized that healthcare’s move into the digital world would create risks instead of progress without rules for consistency, access, and security. As the law was put in place to set a foundation for the rise of the internet, there was another glaring concern: patient privacy. Before HIPAA, your health records could easily be shared with your employer, landlord, and more. This information could influence hiring decisions, deny loans, and even more reasons unrelated to a patient’s medical treatment or health care reimbursement. HIPAA’s Revolution As HIPAA was signed into effect, its core pillars continued to take shape. The final Privacy Rule was issued in 2003. Just two years later, the Security Rule in 2005 laid out the required technical, administrative, and physical safeguards for PHI. But technology didn’t stop evolving. As electronic health records became more widespread, so did the risks. This led to more legislation, including the HITECH Act of 2009, which strengthened HIPAA enforcement, increased penalties for noncompliance, and introduced the Breach Notification Rule, requiring organizations to notify patients when their data was exposed. The Office for Civil Rights (OCR) also issued a final rule in 2013, which clarified legislation and increased the role that Business Associates play when handling sensitive information, and made it possible for vendors to be audited. In the years since, HIPAA has continued to adapt to new challenges, like the rise of ransomware. Enforcement has also grown sharper, with multimillion-dollar settlements and corrective action plans reminding practices that compliance is not optional. HIPAA continues to grow and adapt to the future of technology, including new proposed updates likely to take effect next year. What’s Next for HIPAA? Over the past nearly thirty years, it’s clear that compliance isn’t just a regulation; it’s a responsibility. Healthcare providers and business associates all share the duty of keeping PHI safe. With new challenges like AI-driven threats, cyberattacks, and shifting regulations, HIPAA’s next chapter will be just as important as its first. As HIPAA continues to evolve, staying on top of HIPAA legislation can be overwhelming. With smart software, it doesn’t have to be. Intelligent software can stream the latest updates, documentation, and more to ensure your staff is compliant. Here’s to HIPAA and what’s next for healthcare compliance. Looking to learn more? Meet with a compliance expert today.

Abyde News, Best Practices, OSHA

Safe + Sound Week: Preventing Workplace Violence in Healthcare

August 14, 2025 Penelope Schweitzer No comments yet

August 14, 2025 While OSHA Safe + Sound Week celebrates workplace safety precautions in your practice, it’s also a time to reflect on shortcomings in the field and how to prevent them. Unfortunately, workplace violence is a prevalent risk in healthcare. Healthcare workers are five times more likely to take time off from work due to workplace violence than those in other fields, so this issue requires attention. While workplace violence currently falls under the General Duty Clause, state-level legislation across the country challenges this. Protecting healthcare workers from violence is possible. By providing your team with the right tools and resources, you can help them mitigate risks and keep everyone safe. What is Workplace Violence? Workplace violence in healthcare is any act or threat intended to harm at the worksite. Several parties can be involved in workplace violence at your practice, including workers, patients/clients, and visitors. In healthcare, workplace violence most frequently occurs when a patient or their family becomes aggressive toward a staff member. Due to the high-pressure environment healthcare can sometimes present, patients can lash out. Even threats are still considered workplace violence. This stress can lead to high levels of staff burnout. How Can I Protect My Staff? The first step to protecting your staff against workplace injuries is cultivating a culture of compliance. This culture ensures that your staff knows the resources provided and feels empowered when navigating difficult situations. Consequently, implementing a zero-tolerance policy on workplace violence is key to protecting your staff. A zero-tolerance policy creates an environment where staff feel supported. Ensure that staff can report workplace violence situations and communicate openly with management. Additionally, your practice must train staff to handle workplace violence situations. Workplace violence prevention training must include the steps for diffusing a problem and how to alert fellow staff. What’s Currently in Place? As mentioned above, workplace violence prevention falls under the General Duty Clause, which requires that all workplaces provide a safe work environment. However, state-level legislation is laying the groundwork for federal legislation. Nearly every state has heightened penalties for assaulting a healthcare worker, making it a felony rather than a misdemeanor. More states continue implementing workplace violence legislation, including comprehensive training requirements. Some states, such as California, require thorough reporting and logs for all workplace violence incidents. Being aware of your state’s specific legislation regarding workplace violence is crucial. Protect Your Staff with Smart Solutions Everyone deserves to feel safe at work. Unfortunately, healthcare workers often experience workplace violence, but this does not have to be their reality. With the right smart solutions, empower your staff this Safe + Sound Week by streamlining OSHA compliance. Intelligent solutions provide thorough, but engaging training for all staff to complete at their own time. Meet with a compliance consultant today to learn more about OSHA compliance in your practice.

Abyde News, Best Practices, OSHA

Safe & Sound Week: A Back-to-Basics Guide to OSHA in Healthcare

August 12, 2025 Penelope Schweitzer No comments yet

August 12, 2025 Safe + Sound Week celebrates the measures that ensure the safety of your practice staff. But But before you pop the champagne, it’s essential to return to basics. While hard hats, construction sites, and factories often come to mind when thinking of OSHA, healthcare environments are actually among the riskiest workplaces. Ironically, a healing environment can be among the most challenging and hazardous workplaces. Healthcare can present many risks, including exposure to bloodborne pathogens and sharps, respiratory illnesses, upset patients, and more. In a critical field like healthcare, the risks are significant, but so are the rewards. With the right tools, you can protect your staff and maintain high-quality care while avoiding common mistakes that lead to OSHA violations. Sharps Safety We’re sorry if you’re squeamish. Anyone working in healthcare understands the risk of exposure to bloodborne pathogens. From routine dental checkups to the dreaded annual flu shot, healthcare workers encounter many potential OSHA hazards. Fortunately, modern healthcare technology mitigates many of these risks with proper procedures. Most sharps, like needles, are now equipped with self-sheathing technology, minimizing the possibility of injuries. While there are safeguards, needle stick injuries are still prevalent. The World Health Organization states that 3 million healthcare workers worldwide are exposed to bloodborne pathogens annually. Looking to avoid this pitfall? Train your staff and provide the appropriate sharps. Ensure staff know how to use sharps safely, from use to disposal. Your practice should also provide a secure trash can to dispose of sharps and partner with an OSHA-compliant healthcare waste organization to remove and dispose of used sharps. If a healthcare staff member is pricked by a sharp? Provide immediate first aid and have them undergo blood tests to ensure their safety. When it comes to bloodborne pathogens, time is of the essence; quick action can prevent further issues. Personal Protective Equipment (PPE): Not just a Fashion Trend Healthcare professionals are three times more likely to contract respiratory illnesses than those in other industries. While it seems like an unavoidable part of the job, proper use of PPE minimizes these risks. The most effective way to ensure staff are protected is by providing comprehensive training on the correct use of PPE. This training should cover when and how to wear various equipment, from masks and gloves to gowns and face shields. To eliminate any barriers to use, your practice must provide all necessary PPE to staff at no charge. Wearing the correct PPE provides critical protection for your staff, safeguarding them from infectious respiratory pathogens. PPE protects your employees’ health and helps prevent the spread of illness to other patients and colleagues, creating a safer environment for everyone. Navigating Conflict, Ensuring Security Another common OSHA violation in healthcare is, unfortunately, workplace violence. Healthcare workers are five times more likely to experience workplace violence than other workers. The good news is that this issue is finally getting serious attention. This issue has received attention at the state level, with most states increasing penalties for attacks against healthcare workers and implementing additional logs, training, and safety measures. Although this still falls under OSHA’s General Duty Clause, a federal law addressing this issue has been in development for years and is likely to be announced by the end of this year. To keep staff safe, train your team and empower them to report workplace violence. Ensure staff know the procedures for handling an unruly patient or visitor, and follow up after any incident. It is unfortunate that this occurs, but by supporting your staff, you can minimize risks and create a safer workplace. Keep Your Staff Safe and Sound Remember, a strong culture of compliance, rooted in empowerment and education, is the foundation for any successful practice. You can significantly reduce risks and avoid costly violations by proactively training your team, providing the right tools, and empowering them to speak up. Smart solutions can streamline training, policies, procedures, and more, ensuring all staff know the safeguards to protect them at work. A safe practice is a strong one, and it will thrive, allowing your team to continue providing your patients the highest quality of care. Meet with a compliance expert today to learn more about OSHA in your practice.

Abyde News, Best Practices, HIPAA

Patient Privacy 101: The Minimum Necessary Standard Explained

August 7, 2025 Penelope Schweitzer No comments yet

August 7, 2025 Under HIPAA, healthcare practice staff must keep a secret. This means everyone with access to patient data, from doctors to receptionists, can’t share any information about a patient. While it might feel enticing for a nurse to tell their friends about an old high school bully coming into their practice with a rash, and revenge might feel sweet, it’s a total HIPAA no-no. One of the pillars of HIPAA is the Privacy Rule, which dictates when and if Protected Health Information (PHI) can be shared. The Privacy Rule keeps patient data secure and allows the best care, with patients knowing their information will remain confidential. However, sometimes information needs to be shared. This is where the Minimum Necessary Standard comes in. With this rule, healthcare providers and their Business Associates can share PHI if it’s vital to complete work tasks. Safeguarding confidential information upholds the integrity of your practice and allows patients to feel comfortable when addressing health concerns. Your practice must follow HIPAA to keep patient data safe and secure. What is the Minimum Necessary Standard? All in the name, the Minimum Necessary Standard defines how HIPAA-regulated entities can share information. Depending on the situation, more information might be warranted to be shared compared to others. The easiest way to explain the HIPAA Minimum Necessary Standard is to compare it to ordering pizza. When you order a pizza for delivery, you only provide the minimum necessary information: your name, what you want to eat, and your address. You wouldn’t share details like what you ate for breakfast or the names of everyone in your house because that information isn’t needed for the delivery. In a healthcare setting, while not as cheesy, the same principle applies. A front-desk receptionist, for example, needs access to a patient’s basic information to confirm an appointment. They don’t need access to the patient’s full medical history. The minimum information required for their job is scheduling and patient identification, not the patient’s back surgery details. The HIPAA Minimum Necessary Standard ensures that everyone, from the front desk to doctors, to even your vendors, can only access the PHI they absolutely need to do their job. In some situations, more information can be shared more easily. These exceptions include disclosures for treatment purposes, such as when a doctor needs a patient’s complete medical history to provide proper care. Your practice can share PHI with the patient directly, or someone with explicit authorization from the patient, or in a public emergency. Finally, disclosures may also be required by law. Simplifying the Minimum Necessary Standard Your staff must uphold the security of PHI. By following the HIPAA Privacy Rule, you stay compliant and build a successful practice. When patients feel confident that their records are safe, they’ll trust you and feel empowered to choose your practice. It’s a serious responsibility. With the right solution, staff can be appropriately trained to handle health records. Smart software can streamline training for your practice and provide dynamically generated policies and procedures for all staff to access and review whenever they have a question regarding the use of PHI. Meet with a compliance expert today to learn more about protecting your practice and patients.

Abyde News, Best Practices, Business Associates, HIPAA

Under the Microscope: Your Business Associates Are Now the OCR’s Top Priority

August 4, 2025 Penelope Schweitzer No comments yet

August 4, 2025 Let’s talk paperwork. While that might not seem like the most interesting or important thing to focus on when running your practice, having the right documentation is key to its success. A Business Associate Agreement (BAA) is one of the many documents you need to be HIPAA compliant when running a practice. When working with Business Associates (BAs), or the third-party vendors who can access your practice’s Protected Health Information (PHI), you must have a signed agreement in place. These BAs can include anyone from your IT company to the company that handles your shredding. In short, if a business has any access to PHI, it’s required. The Office for Civil Rights (OCR) has put Business Associates (BAs) in the hot seat, with proposed new legislation strengthening their requirements and millions of dollars in fines imposed this year alone. It’s time to take a fresh look at your partnerships, and the best place to start is by having a solid BAA. What does a BAA do? First things first, what does a BAA even do for your practice? What does it include? Well, this required agreement outlines all responsibilities your practice and business partner must follow when handling PHI. The document includes the definition of PHI, when the BA can use the data, and how each party must secure data. This legally binding agreement ensures each party understands the serious nature of handling PHI. Overall, it’s another layer of protection to clearly define your relationship with a BA. A BAA is essential, especially when a Business Associate experiences a data breach. Business Associates are frequent targets for malicious actors. One of the first fines in 2025 was a $90,000 penalty for a ransomware breach that targeted a data hosting company. This breach exposed the PHI of patients from 12 different healthcare practices. These 12 healthcare practices would also need a BAA with the hacked party. If not, the Covered Entity could also be liable for the BA’s missteps. The OCR has also fined Covered Entities for missing a BAA. Here’s a prime example: A healthcare provider was in a nasty dispute with their BA. They even reported the BA to the OCR, claiming the BA was holding PHI hostage for a $50,000 payment. But here’s where it took a turn: The OCR didn’t just investigate the BA; they also focused on the healthcare provider. The result? The OCR slapped the provider with a $100,000 fine for missing crucial documentation, including, you guessed it, a BAA. Keeping BA Partnerships Secure While ensuring documentation is in order is no one’s idea of fun, protecting your practice and keeping patients’ data safe is imperative. With the right solution, your practice can make documentation a piece of cake. While a BAA may not be as appealing as chocolate fudge, software can streamline the process, creating a legally sound and complete document that is just as satisfying. Meet with an expert today to learn more about ensuring compliant vendor relationships.

Abyde News, Fines, HIPAA

Ransomware Strikes Again: What the Latest HIPAA Fine Teaches Us

July 28, 2025 Penelope Schweitzer No comments yet

July 28, 2025 Healthcare’s cybercrime nightmare just got more expensive. With over half a million dollars in fines and the second HIPAA ransomware fine issued this month alone, it’s time to acknowledge the serious threat cybercrimes pose to healthcare. The Office for Civil Rights (OCR) just announced its latest HIPAA fine, following a ransomware attack affecting a surgery center in New York, totalling $250,000 and placing the practice under a two-year Corrective Action Plan (CAP). The two-year period includes constant government monitoring, ensuring the healthcare provider has taken action to mitigate risks and secure Protected Health Information (PHI). Here’s where things get interesting. Upon further inspection, the exact ransomware variant, PYSA, explicitly targets the healthcare industry. Think about it: cybercriminals know the absolute treasure trove of sensitive patient data a healthcare organization holds. As malicious actors know the importance of patient health records, your practice must be extra vigilant when handling PHI. What Happened? In March 2021, an unauthorized actor gained access to the networks of Specialty Surgery Center of Central New York (also known as Syracuse ASC, LLC). The hacker deployed ransomware in the organization’s networks for over two weeks. This ransomware exposed nearly 25,000 patient records, with access to Social Security numbers, addresses, health histories, and more. Syracuse ASC, LLC, notified the OCR of this breach in October 2021, over six months after the initial intrusion. This wait violated the HIPAA Breach Notification Rule. Given the massive breach, the healthcare provider had to notify the OCR, patients, media, and potentially the State Attorney General within 60 days of discovery. Notifying these parties allows patients to take control and explore options for protecting and monitoring their data post-breach. Additionally, it could have expedited the OCR and State officials’ investigations into the extent of the ransomware attack. During the investigation process, the OCR made another startling discovery: no Security Risk Analysis (SRA) was in place. A thorough SRA is required to maintain your practice’s security. By examining existing safeguards, you can identify and address vulnerabilities proactively before they cause problems. This practice learned the hard way about a common HIPAA pitfall: missing an SRA. Due to this, a hacker infiltrated and exploited the vulnerability of an insecure network, leading to a quarter-million-dollar fine. Protecting Your Practice Against Ransomware Hackers have discovered a gold mine with medical records costing upwards of $1000 on the dark web, compared to the average credit card number fetching 25¢. When hackers directly target healthcare practices, your compliance program and safeguards must be in order. Proactive compliance is key to the security of PHI. Your practice can mitigate and minimize ransomware threats by using the right compliance solutions and robust IT assistance. With the right software, it’s easy to streamline pillars of HIPAA compliance, like the SRA, identifying issues early to avoid risking your patients. Meet with our team of experts to learn more about how you can simplify HIPAA compliance for your practice.

Abyde News, Best Practices, HIPAA

Strong Passwords, Secure Patients: Protecting PHI in Healthcare

July 23, 2025 Penelope Schweitzer No comments yet

July 23, 2025 While Password123 might be easy to remember, it might not be the best password. In our current healthcare landscape, intertwined with technology, from EHR systems to patient communication, it’s time to upgrade password security. A strong password and other layers of protection are key to keeping your practice’s logins secure and, ultimately, patient Protected Health Information (PHI). Thorough password management might be the deciding factor in stopping a major breach. Just look at the Change Healthcare debacle. Billions of dollars lost, systems crashed, insurance claims in limbo, and over 100 million patients exposed. At the root of this? Missing multi-factor authentication (MFA). After major breaches caused by poor password management, it’s time to prioritize your passwords and adhere to best practices. Ditch the Default Password Let’s face it. It’s tempting to use passwords everywhere. However, it’s a password security red flag. When it comes to passwords, we recommend at least eight characters with several unique characters, including a number, an uppercase letter, a lowercase letter, and a symbol. This enhanced security makes unauthorized account access more challenging. Also, if one account is compromised, the breach can be more easily contained than if all logins shared the same password. On that note, ensure all staff have their own logins. This isn’t just about stopping password sharing; it’s about giving your practice the power to keep a close eye on who’s accessing Protected Health Information (PHI) and quickly spotting anything out of the ordinary. When in Doubt, Change it Out We also recommend changing passwords at least three times a year, keeping account access current, and making unauthorized users’ access more difficult. Regular password changes help mitigate risk if an older password is exposed in a data breach, and make it harder for hackers to brute-force guess your password. They also ensure that anyone who has lost access to your accounts, such as offboarded staff, cannot continue to access systems. By consistently making password changes a part of your security routine, you create a dynamic defense that significantly reduces the risk of unauthorized access. Your Password’s Best Friend: Multi-factor Authentication On top of having a secure and current password, having MFA enabled on all your accounts is key to keeping PHI safe. Just like peanut butter and jelly, passwords and MFA are a perfect pair. MFA is that crucial next step, providing an extra layer of security that makes a major difference in keeping your information safe. Common MFA examples include a text, a random code generated, or even through an automated call. That extra protection ensures that the person logging in is authorized and authenticated. This extra level of protection ensures that when someone tries to log into your accounts, it’s truly you. It’s all about verifying and authenticating that the person accessing the account is authorized. With MFA enabled, a hacker won’t be able to log in without that unique code sent to your phone, an app, or even your email. This significantly increases the difficulty for unauthorized access, giving you peace of mind that your PHI remains secure. Securing your Compliance Program The sheer volume of tasks can make managing compliance feel like a full-time job, from multi-factor authentication to complex password policies and regular access reviews. While it’s easy to feel overwhelmed, your practice can streamline this with the right solution. Smart software simplifies compliance for your practice by sending out compliance reminders, such as when it’s time to change your password, providing best tips and practices, and automating policies and procedures for your practice. Meet with an expert today to see how you can streamline compliance for your practice.

Abyde News, Fines, HIPAA

The Bite of HIPAA: True Stories of Dental HIPAA Fines

July 15, 2025 Penelope Schweitzer No comments yet

July 15, 2025 Running your dental practice comes with its unique set of challenges. You’re wearing multiple hats, and it’s a stressful fashion statement. While OSHA is always on your radar, just from the nature of dentistry, forgetting about HIPAA can be costly. While you think your practice would never be in the hot seat, small dental practices, you’d be mistaken. See how to avoid these common pitfalls in your dental practice, allowing you to continue running it effectively. Time is of the Essence: Right of Access Under the HIPAA Privacy Rule, HIPAA not only defines how Protected Health Information (PHI) needs to be secured but also how it needs to be shared with authorized parties. Right of Access is a part of this rule. This rule requires healthcare providers to deliver requested patient records within 30 days of the patient’s request. Gums Dental Care, a small Maryland dental practice, was fined for violating this HIPAA requirement. The patient initially requested their records in April 2019. The practice did not provide records until May 2022. The patient alerted the Office for Civil Rights, which started a long, overwhelming journey for Gums Dental. The OCR intervened countless times, requiring the practice to provide the patient with their records. The dental practice continued to refuse to provide the patient with records, leading to more legal battles, money, and time wasted. The grand finale? Over three years from the date of the first request, and countless interventions from the OCR, the practice was fined $70,000. Less is More As the saying goes, “If you can’t say anything nice, don’t say anything at all.” This rule applies to all forms of communication and also works to avoid HIPAA violations. While social media brings people together, you must tread a fine line when handling PHI and posting online. One part of this is responding to patient reviews. You cannot confirm or deny that a patient attended your practice, even if the patient is talking positively about their experience there. If you’d like to use someone’s story for marketing materials, like a before-and-after photo of their smile, ensure they sign a consent form. If someone leaves a negative review, you cannot defend your practice by sharing information about the patient. For example, if a patient consistently posts bad reviews but fails to mention that they are always late, you should not call them out publicly online. Instead, address the issue privately and communicate with them securely. Dentists have been fined for social media violations. Dr. U. Phillip Igbinadolor, a dentist in North Carolina, lost his temper after a patient left a negative review on the practice’s Google page. After the dentist posted PHI in response, ridiculing the patient, the patient reported him to the OCR. As a result, the OCR fined the practice $50,000, showing that the price of failing to simply “keep your words to yourself” can be extraordinarily steep. Coming Clean is Key With cybercrimes in healthcare skyrocketing and large data breaches due to ransomware attacks increasing by 264%, having the proper safeguards in place is crucial. While no practice can be completely immune from a breach, the right barriers in place can mitigate risk and minimize impact. However, if your practice is breached, you must notify the OCR and patients quickly. Under the HIPAA Breach Notification Rule, patients must always be notified within 60 days, regardless of the size of the breach. If the breach affects fewer than 500, your practice must inform the OCR within 60 days after the calendar year in which the event occurred. If a breach affects more than 500, the OCR, and depending on the state, the Attorney General, must be notified within 60 days as well. The Indiana Attorney General recently fined Westend Dental, a multi-location dental practice in Indiana, for its response to a ransomware attack. While the breach occurred in October 2020, the practice did not alert the required parties until October 2022, two years after the initial attack. The Attorney General began investigating this attack after a patient complaint, and it was then discovered that the practice attempted to cover up a ransomware attack. The investigation discovered that, in addition to violating the HIPAA Breach Notification Rule, Westend Dental had improper training, unprotected servers, no Security Risk Analysis (SRA), missing policies, and more. The outcome? A $350,000 fine from the Attorney General, highlighting the importance of proactive compliance and properly notifying affected parties after a healthcare breach. How to Protect Your Dental Practice While compliance for your dental practice might feel overwhelming, the right solutions can streamline your compliance program. Smart software solutions can pinpoint vulnerabilities and provide actionable insights to avoid common pitfalls dental practices face. The right compliance software can also provide a comprehensive hub for everything HIPAA-related for your practice, including right of Access training, social media guidelines, and the SRA. Meet with a compliance expert today to learn more about streamlining compliance for your dental practice.