HIPAA

Ransomware HIPAA Fines
Fines, HIPAA

The Price of Neglect: Ransomware Fines Hit Healthcare Practices

November 7, 2024 No comments yet

November 7, 2024 Healthcare practices felt quite a scare on Halloween, with over half a million dollars in fines levied on medical practices. These practices were fined for not taking the necessary precautions against ransomware breaches. The two practices impacted on this day of significant fines include Plastic Surgery Associates of South Dakota in Sioux Falls (PSASD), a multi-location organization, and the Bryan County Ambulance Authority (BCAA), an Oklahoma emergency medical services provider. PSASD was fined $500,000, and BCAA was fined $90,000. These significant fines are just the precipice of the future of healthcare breaches, with ransomware breaches increasing 264% since 2018. What Happened? Major ransomware attacks unfortunately impacted both of these healthcare providers. For PSASD, a breach was discovered that infected nine workstations and two servers in July 2017. This breach impacted over ten thousand patients, putting their data at risk. The malicious actors utilized trial and error to hack into the organization’s system. The data was unable to be restored. The investigation revealed significant gaps in their compliance program, including a missing Security Risk Analysis, inadequate policies and procedures for data handling and breach reporting, and insufficient training. This $500,000 penalty also includes two years of monitoring by the Office For Civil Rights (OCR). For the BCAA, its ransomware attack began in November 2021, but wasn’t reported until May of the following year. After a breach, depending on the severity, you must notify the OCR within 60 days. Since this breach impacted over 14,000 patients or over 500 people, it is considered a large breach. Similar requirements, such as a Security Risk Analysis, adequate policies, a risk management plan, and other safeguards, were missing as found in this investigation. It’s $90,000 fine includes a Corrective Action Plan as well. Protecting Your Practice from Ransomware Ransomware attacks will continue to affect our healthcare system. Although complete immunity is impossible, there are many precautions you can take to protect your practice. Implementing the right technical safeguards, such as firewalls, antivirus software, and a qualified IT team is crucial. Additionally, you can streamline your HIPAA compliance by using intelligent software solutions that help identify your compliance needs unique to your practice. In the event of an attack, these solutions can also guide you on how to respond effectively. To learn more about these smart solutions, meet with a compliance expert today.

Patient Record Access HIPAA Fine
Abyde News, Fines, HIPAA

Expensive Oversight: The Importance of Timely Patient Record Access

October 24, 2024 No comments yet

October 24, 2024 There has been a flurry of HIPAA fines in the past few weeks, with over half a million dollars levied in the last month.  Just one example is Gums Dental Care, LLC, a small dental practice in Maryland that was fined for a Right of Access violation. Right of Access violations, which involve failing to provide medical records in a timely manner, are a common HIPAA mistake. Another violation for this was issued in August.   What Happened?  A patient requested her medical records from Gums Dental on April 8, 2019. After not receiving them, she issued a complaint to the OCR in May 2019. The OCR contacted Gums Dental Care for technical assistance and believed the case was over.  This was just the beginning. This case spanned years, with a second complaint filed in August 2019 and the OCR sending several data requests through letters and calls to Gums Dental.  On October 1, 2020, the OCR sent Gums Dental a proposed resolution agreement and corrective action plan. At the end of the month, Dr. Gums wanted to present her case in front of a judge, believing the patient would commit Medicaid fraud with her records. She also said that the complainant didn’t pay a $25 administrative fee to release the medical records through mail. First, patients should always have access to their medical records, regardless of their reasons. Second, the fee would be waived if the patient requested it digitally, not through mail.   In December 2020, the OCR issued a Letter of Opportunity to Gums Dental. At the beginning of the next year, Dr. Gums once again justified her refusal to provide the records since she believed her patient would commit a crime with them. She also believed her website wasn’t secure enough to send them digitally. However, Gums Dental didn’t attempt to send the records at all.  By the time the Notice of Proposed Determination was sent in March 2022, roughly three years after the first medical record request, Gums Dental faced a Civil Monetary Penalty fine as high as $7,676,692. However, the OCR ultimately levied a $70,000 fine, recognizing the smaller size of the dental practice.    How to Protect Your Practice Common HIPAA fines often involve Right of Access violations. At the federal level, practices are required to provide patients with their medical records within 30 days, and some states have an even shorter timeline. Navigating these unique regulations can be challenging, so having an intelligent solution is crucial. Smart software can streamline compliance for your practice by generating policies and procedures tailored to your needs. These solutions also include access to a team of compliance experts who can help answer your questions and ensure that you are interacting with patients in a HIPAA-compliant manner.  To learn more about software solutions, with a compliance expert here.   

HIPAA Guide for Dermatologists
Abyde News, Best Practices, HIPAA

The Dermatologist’s Ultimate Guide to HIPAA Compliance

October 22, 2024 No comments yet

October 22, 2024 Did you know that a dermatology center was fined over $300,000 for violating HIPAA?  HIPAA compliance is not always top of mind when managing your dermatology practice. Administrative tasks can easily take a back seat with a focus on diagnosing and treating skin conditions. Nevertheless, it’s crucial to prioritize HIPAA compliance.  Discover what steps you need to take to ensure the safety of your dermatology practice.   What’s Protected Health Information?  Protected Health Information (PHI) is sensitive data that can personally identify a patient. Examples of PHI include a social security number, birth date, medical records, and even images of skin ailments for dermatologists.  These images can contain personally identifiable information, such as tattoos and unique birthmarks.  When working with patients, it’s crucial to ensure all images and other forms of PHI are encrypted and protected behind essential safeguards to secure patient information.   Social Media 101s When sharing images of your patient’s treatment, such as before-and-after images of acne treatment, it’s important to do so compliantly. While you might think you’re sharing a feel-good story, patient images are considered Protected Health Information (PHI), and sharing them without consent could violate their privacy.  You need the patient’s signed media consent form to share these images and patient reviews on social media compliantly. This form ensures that the patient understands and agrees to use their image and treatment details being shared with the public.    Improper Disposal The largest dermatology HIPAA fines, totaling over $300,000, were imposed due to improper disposal. Some states have even stricter laws regarding discarding old patient files, which must be retained for at least six years on a federal level. These files also need to be encrypted throughout the creation to disposal process.  When getting rid of sensitive information, ensure it is shredded and properly disposed of. Partner with a disposal company specializing in medical paperwork and waste and have a Business Associate Agreement in place.   How Software Solutions Can Help Dermatology helps patients feel comfortable in their own skin, both literally and figuratively. Implementing the appropriate safeguards to protect patients’ data is just as important. By utilizing smart software, you can see where your dermatology practice stands and what you need to do to be compliant. To learn how you can protect your dermatology practice, schedule a consultation with an expert.   

$240K Ransomware HIPAA Fine
Abyde News, Fines, HIPAA

The Rise of Ransomware in Healthcare: How a Phishing Breach Led to a $240K HIPAA Fine

October 14, 2024 No comments yet

October 14, 2024 Unfortunately, the future of data breaches is ransomware, accounting for nearly two-thirds of data breaches.  As ransomware remains a significant threat in the healthcare sector, another HIPAA fine has been issued concerning a ransomware incident. Recently, a healthcare organization was fined $240,000 following ransomware attacks, including phishing, that compromised the Protected Health Information of over 85,000 patients.   What happened?  The Center of Orthopaedic Specialists merged with Providence Medical Institute, a healthcare system in southern California. In February 2018, during the transition, an employee clicked on a malicious link from a phishing attempt, which encrypted over 85,000 files with ransomware. Subsequently, two more successful ransomware attacks were launched on the already vulnerable IT system. Between these attacks, PMI restored data using backup tapes. In the final ransomware attack, the malicious actors used stolen credentials from previous attempts to remotely access PMI’s systems. What could they have done?  After the breach, several cybersecurity mistakes that affected almost 100,000 patients were brought to light. Before merging with PMI, the Center of Orthopaedic Specialists partnered with another IT company, Creative Solutions in Computers. However, PMI failed to sign a Business Associate Agreement with the IT company during the transition, a crucial HIPAA requirement.  This agreement ensures that both parties understand and take the necessary precautions to protect PHI. Furthermore, PMI made numerous IT and cybersecurity mistakes, such as sharing logins, not properly separating private networks from public networks, failing to monitor access controls, and not encrypting ePHI, which allowed anyone with access to view it.  The lack of proper IT infrastructure, which could have been easily avoided, significantly impacted numerous patients. What’s next?  After the recent HIPAA fine, it’s crucial for your practice to take the necessary precautions and implement cybersecurity measures to safeguard your patients’ data. When establishing a culture of compliance for your practice, using smart software solutions can help you assess your practice’s status and offer efficient solutions to meet requirements, such as electronically managed Business Associate Agreements. To find out more about how intelligent software solutions can protect your practice from cyber attacks, schedule a consultation with a compliance consultant.

American Medical Response HIPAA Fine
Abyde News, Fines, HIPAA

Your Medical Records, Your Right: AMR Learns Costly Lesson

August 6, 2024 Comments Off on Your Medical Records, Your Right: AMR Learns Costly Lesson

August 6, 2024 Did you know the Office for Civil Rights (OCR) has launched a new initiative to ensure proper compliance with patients’ Rights of Access? American Medical Response (AMR), a private ambulance company, has now felt the impact of these efforts, becoming the 49th entity to face a HIPAA Right of Access Enforcement Action. AMR was recently fined $115,200 for failing to provide a patient with their medical records in a timely fashion.  AMR’s mistake was brought to the attention of the OCR through a patient complaint. On October 31, 2018, the patient requested a copy of her medical records. Instead of receiving them within the allotted 30 days, this sparked the beginning of a long battle for her records.  In January 2019, the patient sent follow-up requests to both AMR and its Business Associate, Centrex. AMR responded to the request in March 2019, sending the patient an invoice and requiring payment before the records were provided.  During the ongoing battle for her medical records, she warned AMR she would report the organization to the OCR if her records were not provided. The patient filed a complaint in July 2019. Finally, the records were provided on November 5, 2019, over a year after the initial request.  What is Right of Access?  HIPAA’s Right of Access rule, which falls under the HIPAA Privacy Rule, allows patients to receive access to their medical records within 30 days with minimal or no charges. These charges can only include the costs of copying and mailing medical records. In some states, this 30-day requirement is shorter, like in California, which requires access to copies within 15 days.  This right empowers patients to make informed healthcare decisions, such as sharing their medical history with new providers. What should my practice do?  First, proper training is essential to ensure that staff understand the importance of providing patients with their records on time. Additionally, staff must understand and follow the procedures for securely sharing medical information with the patient. Ensuring staff is properly trained and aware of the resources available to them is vital to staying compliant.  You could be adding more stress to your plate if you still use a dusty binder to track and manage HIPAA compliance. Keeping track of training, documentation, and the constantly evolving regulations is a complex task that demands a modern approach. Intelligent software solutions can offer staff a centralized compliance hub with everything they need to know when navigating patient requests. To learn more about how smart compliance software solutions can protect your practice, schedule a consultation with an expert today. 

Simplifying HIPAA with Technology
Abyde News, Cybersecurity, HIPAA

Peace of Mind for the HCO: Simplifying HIPAA with Technology

July 25, 2024 Comments Off on Peace of Mind for the HCO: Simplifying HIPAA with Technology

July 25, 2024 Running a small medical practice is a juggling act. Staff wear many hats, and HIPAA compliance often gets squeezed in amongst other tasks. Did you know that physicians spend an average of 10 to 19 hours per week on administrative duties such as HIPAA tasks? HIPAA legislation outlines how Covered Entities and Business Associates must handle and secure patient PHI (Protected Health Information).  Specifically, a HIPAA Compliance Officer (HCO) must be designated to ensure compliance maintenance. This is a significant yet essential role, and one that staff in a busy, small office have little time to attend to.  Here’s the good news: There are better ways to manage HIPAA compliance efficiently if you’re the HCO. Let’s explore the key duties of an HCO and how you can handle the numerous obligations that come with the role.  What is an HCO?  The HCO must ensure the practice follows HIPAA requirements and sufficiently follows all physical, administrative, and technical safeguards to protect sensitive patient data. Being an HCO is a significant role and crucial for patient data security. Many HCOs wear multiple hats within an organization, such as serving as the office manager or a doctor. This can sometimes feel overwhelming, but it’s important to remember that HIPAA compliance is a shared commitment. Just like a conductor leads an orchestra, the HCO sets the tone. However, like every musician, from the violinist to the triangle player, needs to play their part flawlessly, everyone in the organization must follow HIPAA rules to create a harmony of patient privacy. What is an HCO Responsible for?  The HCO role oversees everything related to a HIPAA program. This includes managing documentation, training, reviewing updated legislation, conducting the Security Risk Analysis, and much more.  As the HCO, you must ensure proper compliance with HIPAA regulations within your practice and serve as the primary resource for your staff regarding HIPAA concerns. You also need to uphold patient access rights and ensure patients receive their medical records promptly. In case of a HIPAA violation or breach, the HCO will investigate and report the situation to the Office for Civil Rights (OCR) accordingly. The HCO acts as the main point of contact for the OCR and serves as the liaison if further investigation is required. Sounds like a lot of work, right? The Cure for HCO Stress By now, you know the role of an HCO is complex and can be time-consuming, especially when the individual manages numerous roles in a practice.  The time spent on HIPAA tasks reduces the time available for patient care and other tasks. Inaccurate documentation due to human error can also lead to non-compliance with federal standards, adding stress and complexity to an HCO’s role. Many HCOs have their trusty HIPAA binder bursting with disorganized documentation. While this physical documentation might be an easy band-aid for an organization, as HIPAA continues to evolve, your binder should too. We can all agree there are much more enjoyable activities than handling HIPAA documentation. That’s where smart software solutions can streamline compliance for a practice. Instead of taking hours each week, this process can be reduced to minutes with intelligent software that can identify vulnerabilities and provide insights for improvement. That sounds a lot better, right?  To learn more about how to streamline your compliance program, saving time and cost and providing peace of mind for the HCO, schedule an educational consultation today with an Abyde expert. 

Heritage Valley Health System HIPAA Fine
Abyde News, Fines, HIPAA

A Nearly Million Dollar Mistake: Heritage Valley Health System

July 3, 2024 Comments Off on A Nearly Million Dollar Mistake: Heritage Valley Health System

July 3, 2024 Did you know that ransomware attacks are becoming increasingly common in healthcare?  Since 2018, there has been a whopping 264% increase in large ransomware breaches. The devastating impact of a ransomware breach on an organization is wide-reaching, regardless of its size, as seen with the Change Healthcare breach. It’s imperative to take the proper precautions to ensure that Protected Health Information (PHI) is secure against hacking attempts.  At the center of the latest fine, Heritage Valley Health System (HVHS), which operates in Pennsylvania, Ohio, and West Virginia, fell victim to ransomware attacks. These attacks infected HVHS systems, affecting sensitive patient information.  As the Office for Civil Rights (OCR) reviewed the major data breach, several pieces of required documentation, such as a Security Risk Analysis (SRA) and an emergency plan, were absent.  This missing documentation has led to a $950,000 fine and three years of corrective monitoring.  Let’s explore what you can do to prevent this nearly million-dollar mistake. Importance of an SRA  The purpose of the SRA is to review your risks and vulnerabilities regarding the management of ePHI (electronic Protected Health Information). This comprehensive analysis notes the physical, technical, and administrative controls to protect your patient’s PHI.  Your SRA is documented proof that your organization understands its weaknesses and is making strides to address them and better protect patient data.  While the SRA is a very important document, it is frequently missed. From the last round of random HIPAA audits, which have resumed recently, only 83% of practices and Business Associates could produce a sufficient SRA.  SRAs are vital for practice compliance, showcasing growth, and best practices in safeguarding patient data. Check out our recent blog post here to learn more about the SRA. Why do I need plans in place?  When running a medical practice, it’s important to be prepared for any situation that could arise. That’s why policies and procedures are so important. If your practice faces a scenario that may compromise PHI, your team needs easy access to a plan for handling the situation calmly. By addressing potential challenges well in advance, your team will feel empowered and confident in their ability to respond. Moreover, as part of your preventive measures, it’s beneficial to designate specific roles and responsibilities for your staff. This ensures that everyone is aware of their duties in any given situation.  Cybersecurity Measures  Unfortunately, healthcare practices have become very common victims of ransomware attacks. To prepare your organization for this, follow best cybersecurity practices, such as encryption, reviewing access controls, and creating unique sign-ons for all employees.  Healthcare organizations should prioritize technical safeguards like encryption, access controls, and multi-factor authentication. However, security goes beyond technology.  Implement security awareness training for staff, establish a data breach response plan, and maintain regular backups. Regularly conduct risk assessments and evaluate the security practices of third-party vendors. It’s important to consider partnering with an IT company offering valuable expertise. They can recommend the right tools, update you on evolving threats, and monitor your systems for suspicious activity. This layered approach will strengthen your systems and prepare you for potential attacks. How Smart Software Can Help Fines for HIPAA non-compliance can be staggering, but there are alternatives to the manual tracking and paper binders you may be used to. Intelligent software systems are designed to save you time and headaches and ultimately protect your practice to avoid audits and fines. Software empowers your team to manage your program easily and enables a culture of compliance in the office. It streamlines commonly overlooked requirements such as the SRA with dynamically created documentation and develops comprehensive plans, policies, and procedures so you stay current with the latest requirements. Better yet, when using cloud-based software solutions, you get 24/7 secure access and real-time updates when compliance regulations change. Schedule an educational consultation today to learn more about how software solutions can protect your practice.     

Most Common Dental HIPAA Fines
Fines, HIPAA

HIPAA for Dental Practices: Avoid the Most Common Fines

June 26, 2024 Comments Off on HIPAA for Dental Practices: Avoid the Most Common Fines

June 26, 2024 Did you know that as of 2023, less than half of dental offices in the United States are fully HIPAA compliant?  Dentists play a crucial role in maintaining oral health and ensuring the safety of their patients’ Protected Health Information (PHI). Although HIPAA regulations can be complex, it’s essential to understand and comply with them to protect your dental practice and patients. This article explores the most common HIPAA fines for dentists and how you can manage them. Right of Access Under HIPAA, patients can access their medical records within 30 days of the first request and should not be charged unreasonable costs. Dentists have been fined several times for violating this right. A practice in Georgia took over a year to provide a patient with her medical records after she refused to pay a $170 copying fee. This incident violated the 30-day timeline, and the fee was also deemed unreasonable, resulting in a fine of $80,000.  To uphold a patient’s right to access their medical records, it’s vital to manage record requests promptly and organize them. It’s also essential to avoid charging excessive fees for accessing these records. If you’re unsure about what would be considered a reasonable fee, the OCR has issued guidance suggesting a flat fee of a maximum of $6.50 for accessing records. Social Media Usage On top of managing your practice’s reputation in person, you have to manage it online. Online reviews are a shared resource patients use while selecting a new dentist. 94% of patients use online reviews while choosing a new medical provider. However, while managing your online presence, you must be HIPAA compliant. This means not sharing any of your patient’s PHI in reviews. A dental practice in North Carolina was fined $50,000 for improperly sharing a patient’s PHI online in response to a negative review. The practice shared significant PHI about the patient, which discredited the original review. No matter how inaccurate or false a review may be, sharing a patient’s PHI online is never justifiable. Keeping responses short and sweet is essential to avoid making a social media mistake. Even if someone has shared information in their review, you can’t mention that they are a patient at your practice. It’s essential to use a brief and general response while navigating HIPAA. If you receive a negative review, it’s crucial to stay calm. Getting upset for a few seconds isn’t worth facing thousands of dollars in fines. Next, take the conversation to a private channel. Respond to the comment with HIPAA-compliant communication, such as providing a phone number or encrypted email to further discuss the patient’s experience. Cybersecurity Access  In our technology-driven world, most, if not all, dental practices utilize technology to create and store patient data. In recent years, cybersecurity concerns and hacks have infiltrated the healthcare system, with hacking causing 77% of large breaches.  Controlling and training staff on technology use is vital for protecting your practice. In a rare case, a HIPAA violation resulted in jail time for an employee at a dental practice. This employee, a receptionist, abused her access to PHI, stealing patients’ identities and making significant purchases with them. She was sentenced to two to six years in prison for her crime.  Encrypt and secure information properly to avoid cybersecurity-related fines. Additionally, assign roles and access to employees individually, with every employee having their own login. Periodically review employee access and activity to ensure technology is being used correctly.  How Software Can Help There’s a better way to simplify the compliance process for your dental practice. Software offers the ability to streamline your administrative tasks, saving you time and letting you focus on taking care of your patients. Automated and dynamic software helps you be proactive in avoiding these common mistakes, pinpointing your vulnerabilities, and resolving them effectively. Schedule a consultation here to learn more about how Abyde’s intelligent solutions can help create a culture of compliance and protect your practice.     

HIPAA Paperwork Solutions
Best Practices, HIPAA

Drowning in Paperwork? 70% of Healthcare Workers Are Too. Here’s the Fix.

June 13, 2024 Comments Off on Drowning in Paperwork? 70% of Healthcare Workers Are Too. Here’s the Fix.

June 13, 2024 Did you know that more than 70% of healthcare workers spend over 10 hours a week on paperwork?  When working in healthcare, the last thing you might expect is to spend most of your time on paperwork, but it’s a reality for many. Paperwork might seem monotonous and time-consuming, but it’s a crucial requirement for HIPAA. Your compliance program must be documented to prove you’re protecting your patients.  Why can’t I use templates?  It’s essential to avoid cutting corners with compliance paperwork. Personalized documentation is key, so using templates isn’t compliant. Templates are generic, whereas documentation represents the specific policies and procedures for your location that must be followed to protect your patients’ PHI (Protected Health Information).  Many policies and procedures are required to ensure staff safety and PHI. Some examples include the Disaster Recovery Plan, the Breach Notification Policy, and the Electronic Data Disposal Policy. They must be personalized for your practice, such as including local emergency phone numbers in the Disaster Recovery Plan or defining specific roles and responsibilities in policies. Additionally, if responsibilities change, policies and procedures must be updated, ensuring the latest info is documented.  By drafting personalized documentation, your practice ensures its staff knows their responsibilities regarding protecting PHI and the procedures that must be followed.  What else is required documentation?  Drafting documentation is the first step, but organizing the content is just as important. Policies and procedures should be easily accessible so staff can review them effortlessly. In any situation, your team should be able to access the plan quickly, stay calm, and review the documentation. The documentation should also be clear and understandable for the staff. Staff should have easy access to policies and procedures, which should be reviewed during onboarding to provide new employees with the necessary resources.  How Software Solutions Can Help In the past, documentation was often seen as an overwhelming, overflowing binder, but that doesn’t have to be the case. As technology advances, your compliance program needs to keep up as well. Nowadays, healthcare workers can use software solutions to create personalized documentation quickly.  Software solutions can help eliminate the possibility of human error and utilize cutting-edge technology to dynamically generate policies that meet the latest requirements in the healthcare industry. Almost all healthcare employees spend numerous hours every week on paperwork.  So why not significantly reduce the time spent on these activities and achieve compliance in minutes? Software rapidly creates personalized documentation, including staff names and responsibilities, and provides organizational structure. Instead of disorganized physical binders, you can have an intuitive solution with policies and procedures hosted in the cloud that are easily accessible with an internet connection.  To learn more about how Abyde can save your practice countless hours on documentation, schedule a software demo. 

Change Healthcare Breach: Next Steps
Cybersecurity, HIPAA

Change Healthcare Breach: What You Need to Do

May 31, 2024 Comments Off on Change Healthcare Breach: What You Need to Do

May 31, 2024 Since February, the Change Healthcare ransomware attack has dominated headlines in the medical industry, cited as likely the most significant breach ever in the U.S. health system.  To quickly recap, a group of malicious hackers infiltrated Change Healthcare’s systems in February. The hackers had access to the system for nine days before infecting systems with ransomware on the 21st. When it was realized Change Healthcare’s systems were compromised, its systems were immediately disconnected to mitigate risks.  This attack not only jeopardized patients’ Protected Health Information (PHI) but also caused detrimental impact on the healthcare industry at large. Change Healthcare processes 15 billion healthcare transactions annually. With these systems down, healthcare providers continue to struggle with basic processes, like filling prescriptions and getting paid through insurance claims.  The latest update on the Change Healthcare breach has reached Capitol Hill. Andrew Witty, CEO of UnitedHealth Group, the parent company of Change Healthcare, testified at two congressional hearings on May 1st. At these hearings, the cause of the breach was acknowledged: a lack of multi-factor authentication prompts when logging into internal systems.  Additionally, while Witty confirmed that the exact scope of impacted patients is unknown, it is expected to be very severe. One-third of Americans could be affected by this cyberattack.  Although Change Healthcare’s lack of security protocols caused the catastrophic breach, it is still your practice’s responsibility to notify impacted patients. What You Need to Do The Office for Civil Rights (OCR) is still investigating the magnitude of this cyberattack, but guidance has been released.  First, Change Healthcare is notifying stakeholders impacted by the breach. This includes Covered Entities and Business Associates. Business Associates must notify Covered Entities if their business is affected, and the responsibility to inform patients ultimately falls on Covered Entities.  The Breach Notification Rule under HIPAA details what information needs to be shared with patients, including suspected dates the data was breached, what PHI was involved, and the next steps.  Once it’s known that this breach impacted your patients, it’s vital to notify affected individuals without unreasonable delay and to inform the HHS. The media must also be notified if five hundred or more patients were affected.  After this significant cyber attack, reviewing your risks and vulnerabilities is crucial. If a vast organization processing up to $2 trillion in medical claims annually can be hacked, so can your practice.  Ensure standard security protocols, like multi-factor authentication, are in place to mitigate the risk of breaches. When it comes to your HIPAA compliance programs, securing your data is critical. For example, Abyde’s cloud-based software features an intuitive Security Risk Analysis (SRA) and ongoing compliance review to quickly identify and address risks to keep your practice’s sensitive data safe.  As this breach is still under investigation, Abyde will keep Covered Entities and Business Associates up-to-date on the latest developments.  Visit the HHS FAQ page on the Change Healthcare breach here. To learn more about software solutions to ensure protected compliance for your practice, schedule an educational consultation here with a compliance expert.

Are you prepared for OSHA's Workplace Violence Prevention requirements? Learn what you need to do to be compliant.

DOWNLOAD CHECKLIST
X