HIPAA

HIPAA Right of Access
Abyde News, Best Practices, HIPAA

What is Right of Access?: Understanding the HIPAA Privacy Rule

March 20, 2025 No comments yet

March 20, 2025   HIPAA is often misunderstood as only addressing the security of medical information. However, it encompasses more than that. The Health Insurance Portability & Accountability Act also defines how medical information must be shared with patients through the Privacy Rule. This highlights another key responsibility healthcare providers must be accountable for.  Alongside the Security Rule and the Breach Notification Rule, the Privacy Rule provides patients additional rights regarding how their medical records are handled.  The Privacy Rule created the Right of Access, requiring practices to provide patients with their medical records in a timely manner.  With the latest fine for HIPAA being a Right of Access violation, it’s vital for practices to be aware of this requirement and how it pertains to the care they provide.    What is Right of Access? Right of Access gives practices 30 days to fulfill a patient’s request for their records. In some situations, these thirty days can be extended to an additional 30 days, but that is the longest period of time allowed to provide a patient with their records.  This is a federal requirement, but the timeline could be even shorter depending on where the practice is located. For instance, if the practice is in California, staff must provide patients with medical records within 15 days.  Your practice can charge for medical records, but it needs to be reasonable. The Office for Civil Rights (OCR) defines this as the average cost of supplies, limited labor, and postage when providing medical records to a patient.  However, instead of calculating this cost, the OCR also suggested a flat fee not to exceed $6.50 when handling electronic records. Once again, other guidance can be levied on the state level, like California’s cap on the cost of medical records at 25¢ a page plus a reasonable clerical fee.  From the moment a practice receives a request, it must be addressed quickly. Staying on top of these requests is crucial for staying compliant and maintaining patient satisfaction.    How to Stay Compliant While this might seem simple, many practices have been fined in the past for violating this right of patients. In 2024 alone, Right of Access fines accounted for nearly $500,000. The OCR introduced a Right of Access Initiative to ensure that these patient requests are taken seriously. Many of these investigations and fines stem from patient complaints, showing the importance of complying with this HIPAA component.  Utilizing smart software solutions can assist your team in ensuring that all staff members are aware of their responsibilities when handling PHI, including the responsibility to address patient requests quickly. This empowers your team to take accountability and keep patients happy.  To learn more about how to comply with HIPAA Right of Access legislation, meet with our team of compliance experts today.   

HIPAA Investigation Guide
Abyde News, Best Practices, HIPAA

Inside a HIPAA Investigation: A 4-Part Educational Series

March 17, 2025 No comments yet

March 17, 2025 Getting a HIPAA investigation letter can be overwhelming, but your practice can successfully navigate the process with the right resources. This series is designed to be your easy-to-read guide, walking you through each step of the process. We’ll break down everything from understanding the initial letter to navigating potential outcomes, providing you with best practices to keep your practice confident and prepared if you ever receive a letter.    Blog 1: Is Your Practice Prepared for a HIPAA Breach? A common misconception is that a HIPAA breach causes your practice to be fined. Instead, your practice’s lack of proactive measures and proper response to a breach is what leads to disciplinary action. Although it’s impossible to prevent breaches completely, the proper safeguards can minimize their risk and impact. Learn more about breach mitigation here.    Blog 2: Decoding the HIPAA Investigation Letter: What to Expect and How to Respond The official start of an investigation is when your practice receives the data request letter from the Office for Civil Rights (OCR). The letter is thorough, with the OCR inspecting your practice’s safeguards in the wake of a breach or a complaint. Learn more about what your practice can expect if they receive a letter here.    Blog 3: Responding to a HIPAA Investigation: A Guide to Document Organization From the second your practice gets a letter from the OCR, it’s time to start organizing documentation. Organizing documentation is vital for streamlining the investigation process. Having organized documentation is the key to passing an investigation and avoiding fines. Learn more here.    Blog 4: The Final Verdict: HIPAA Investigation Outcomes After months of investigation, the OCR will send a letter to your practice. Various outcomes can occur, from closing the investigation with no fines to corrective action. Learn more about the outcomes of an investigation here.    While we hope your practice never has to experience an investigation, things happen. With the right proactive safeguards in place, your practice can minimize the chance of an investigation and be organized and ready if one occurs.  With the right resources, like a compliance software solution, your practice can streamline compliance, take control, and easily identify vulnerabilities before they become serious issues.  Want to learn more about how you can protect your practice? Meet with a compliance expert today.

Oregon Health & Science University HIPAA Fine
Abyde News, Fines, HIPAA

Denied, Delayed, Fined: OHSU’s $200K HIPAA Fine

March 13, 2025 No comments yet

March 13, 2025 Oregon Health & Science University (OHSU), an academic research institution with public health centers, is the latest Covered Entity to be fined for a HIPAA Right of Access violation.  Unfortunately, Right of Access fines are common, usually sparked by a patient complaint. OHSU’s violation was no different, with a patient waiting for records much longer than the 30-day federal requirement.  This 53rd Right of Access rule enforcement showcases the critical importance of prioritizing patient requests.  What Happened?  A patient of OHSU required their medical records, and a medical representative requested records multiple times for years.  The representative’s initial written request was on April 24, 2019. At first, OHSU quickly addressed this request, having a Business Associate provide medical records to the representative by April 29, 2019. However, these were partial records, not including all of the vital information the patient needed.  The representative sent another request at the beginning of November 2019, which OHSU incorrectly denied due to a missing date. The representative submitted another request at the end of the month, which OHSU once again erroneously denied, this time for invoices.  When OHSU again only provided partial records after the representative asked for the records in May 2020, the representative filed a complaint with the Office for Civil Rights (OCR).  After another denial of medical records in July, the OCR closed the case in September, providing OHSU technical assistance to properly send medical records.  However, the records were still not provided as of January 2021, when the representative submitted a second complaint to the OCR.  The OCR notified the university on August 21, 2021. Within the week, OHSU provided the representative with medical records. All medical records were sent to the representative by the end of September.  Over two years had passed from the first request in April 2019 to finally receiving the records in late 2021.  This request’s drawn-out, back-and-forth nature resulted in OHSU being fined a $200,000 Civil Monetary Penalty.  Prioritize Patient Requests Almost half a million patient complaints have been received from the OCR. By prioritizing patient requests for records, your practice can avoid potential investigations, fines, and in general, unhappy patients.  When working in healthcare, your goal is to provide the best care for patients. Ignoring patients’ needs will leave them unhappy and dissatisfied, seriously impacting the overall quality of care your practice can provide. Intelligent compliance software solutions allow your practice to proactively identify and address vulnerabilities while educating staff on essential compliance requirements.  By streamlining compliance, your staff can be well aware of the importance of prioritizing patient requests, leading to a more successful practice with higher patient satisfaction. To learn more about simplifying compliance, schedule a consultation with a compliance expert. 

Warby Parker HIPAA Fine
Abyde News, Fines, HIPAA

Warby Parker’s $1.5 Million HIPAA Fine: A Security Risk Analysis Eye-Opener

March 6, 2025 No comments yet

March 6, 2025   Warby Parker, the popular prescription eyewear retailer with a strong online presence and expanding physical stores, was recently fined $1.5 million for a HIPAA violation. This enforcement highlights that no matter how big your organization is, the government can and will investigate breaches of PHI.  In 2025, the Office for Civil Rights (OCR) has issued over $5 million in fines so far, almost all of which involved a missing Security Risk Analysis (SRA). The SRA thoroughly assesses your practice’s physical, technical, and administrative safeguards for securing patient Protected Health Information (PHI).  The Warby Parker fine is a stark reminder that the SRA, a detailed examination of your PHI safeguards, is not just a recommendation; it’s a necessity.    What Happened?  In late 2018, Warby Parker experienced numerous unusual login attempts on its site. It was discovered that customer logins were breached through credential stuffing or when information was pulled from unrelated breaches. For example, a customer’s login was likely reused on another hacked site.  The OCR began its investigation in December 2018, but the flurry of attacks continued. Warby Parker, which also provides eye exams, issued several addendums to its initial breach report, revealing that additional customer and patient accounts were compromised. Additional attacks occurred in 2020 and 2022. Overall, these cybercrimes impacted almost 200,000 patients.  As the OCR investigated Warby Parker, it discovered that Warby Parker did not conduct an adequate security risk analysis, implement sufficient technical safeguards to prevent further attacks, or regularly review system access. These failures to protect PHI led to a $1.5 million Civil Monetary Penalty (CMP), demonstrating that even massive organizations need to comply with HIPAA requirements.  How to Protect Your Organization The first step to HIPAA compliance for your practice is proactively maintaining an SRA. By evaluating and identifying your vulnerabilities, your practice can address these weaknesses before they become serious problems. As stated before, no matter how small or large your organization is, you must complete the SRA annually.  Regular reviews of PHI access are essential to identify and address breaches promptly, minimizing the number of affected patients. Implementing an access log is crucial as well, ensuring staff is held accountable for documenting when they interact with PHI.  Utilizing a compliance software solution can alleviate the stress of managing numerous requirements. Software solutions can streamline compliance and offer a SRA and an access log within the program. By outsourcing compliance, your team can focus more time on patient care.  To learn how to simplify HIPAA compliance for your practice, schedule a consultation with a compliance expert today.   

Outcomes of a HIPAA Investigation
Abyde News, Best Practices, HIPAA

The Final Verdict: HIPAA Investigation Outcomes

March 3, 2025 No comments yet

March 3, 2025   Welcome to the fourth and final installment of Abyde’s HIPAA Investigation Survival Series. We’ve already reviewed the initial breach, the letter you received, organizing documentation in response to the letter and data request from the OCR, and now the possible outcomes of a HIPAA investigation.  There are a few possible outcomes for a HIPAA investigation. As discussed at the end of the previous blog post, the ultimate judgment from the OCR could be levied months or even years after the investigation started.  What are the possible outcomes of a HIPAA Investigation? The most favorable outcome of an investigation is when the OCR closes your investigation. Your OCR investigator will inform you through writing, either through an official email or letter, that your documentation was sufficient, showcasing that your practice is implementing the right safeguards to secure Protected Health Information (PHI). Once an investigation is closed, you’ve officially passed the investigation.  However, the OCR can and will levy monetary fines if your documentation is insufficient. Monetary fines range from $141 to over $2 million per violation. Fines are tiered, starting with tier 1, which is the least serious based on a sincere lack of knowledge of a violation, to tier 4, or willful neglect of a situation if not corrected within 30 days. These fines are also adjusted yearly based on inflation.  HIPAA fines are categorized into two types: Civil Monetary Penalties and Settlements. Civil Monetary Penalties are imposed when a practice is found guilty of violating HIPAA regulations. The practice and the OCR negotiate settlements, and the practice does not admit to any HIPAA violations once paying the fine.  Both forms of penalties are highlighted on the OCR’s website as press releases and written about by numerous healthcare compliance news professionals, meaning this fine will live on the internet forever.  Lastly, the OCR can levy a Corrective Action Plan (CAP) in addition to a monetary penalty. A CAP requires a fined practice to be monitored by the OCR for several years, as defined by the CAP. This leaves the practice subject to government scrutiny, another hurdle.    How Can I Avoid This? Proactive measures are key when it comes to avoiding a HIPAA investigation. By implementing the appropriate safeguards before a situation occurs and properly training all staff, your practice can avoid common mistakes leading to breaches.  Utilizing a software solution is imperative when handling HIPAA compliance. Outsourcing compliance streamlines compliance for your practice, freeing your time and providing an easily accessible hub for all documentation.  To learn more about simplifying HIPAA compliance for your practice, schedule a consultation with one of our experts today.  To visit our first installment of this series about the breach that likely causes an investigation, please visit here, learn more about the audit letter, visit here, and learn more about organizing documentation for an investigation here.   

HIPAA Investigation Documentation Organization
Abyde News, Best Practices, HIPAA

Responding to a HIPAA Investigation: A Guide to Document Organization

February 24, 2025 No comments yet

February 24, 2025 Welcome to the third installment of Abyde’s HIPAA Investigation Survival Series. We’ve reviewed the initial breach and the letter itself, and now we will review those steps you need to take when organizing documentation to send back to the OCR.  As discussed in our last blog post, you must start organizing documentation immediately after receiving an investigation letter. Since the turnaround is usually 30 days, it’s important to have documentation sent promptly to your investigator.  Proper organization of documents is essential for a successful practice.     How Should I Organize Documentation? The OCR will specify the documentation required in the initial investigation letter. For instance, if your practice experienced a ransomware attack, the OCR will likely ask specific questions about your practice’s cybersecurity safeguards.  This response can be sent either through traditional mail or by email. If using email, ensure that the email is properly encrypted if any Protected Health Information (PHI) is mentioned.  When responding to the OCR, being thorough and specific is crucial. The OCR expects you to provide relevant policies, procedures, your practice’s Security Risk Analysis (SRA), and other important documentation. Having this documentation readily available for your practice is essential. With only 30 days or less, you don’t have time to scramble.  There isn’t an exact number of questions the OCR will ask about your practice. It all depends on what information the OCR currently has about your practice.  As investigation documentation will likely span hundreds of pages, providing an index and table of contents is vital. Organize your documentation by ensuring it directly answers the specific question being asked. When compiling documentation, reference the question to maintain organization. The pages should also be numbered and match the index provided at the beginning of the response.  If you have questions when organizing documentation, you can contact your investigator. Working with a third party, such as a HIPAA software solution provider or a lawyer, who has experience navigating an investigation is also recommended.  Lastly, review your documentation carefully, ensuring all questions have been comprehensively answered. Then, send in the requested documentation to your HIPAA investigator with your OCR case number labeled appropriately.      What’s Next? After the initial submission, the OCR might ask for additional information. That’s why answering questions thoroughly is vital to streamlining the investigation process. It could take months before the OCR responds. Once all necessary documentation is received, the OCR may close its investigation. Your practice could be found compliant or face monetary penalties and government monitoring.  The need to quickly gather and organize documentation during an investigation highlights the importance of proactive document management. Easy access to documentation promotes a transparent culture of compliance within your practice. This organization also reduces stress in stressful situations, such as investigations. By utilizing an intelligent software solution, your practice can organize all documentation within the software, easily downloading and compiling all required documents for an investigation. Software solutions can also include incident response programs, providing healthcare practices with expert guidance when navigating a HIPAA investigation. To learn more about how your practice can ace an investigation, schedule a consultation with one of our experts today.  To visit our first installment of this series, which is focused on the breach, please visit here, and to learn more about the audit letter, visit here. To finish the series, learn more about the potential outcomes of an investigation here. 

Decoding HIPAA Investigation Letters
Abyde News, Best Practices, HIPAA

Decoding the HIPAA Investigation Letter: What to Expect and How to Respond

February 17, 2025 No comments yet

February 17, 2025 Welcome to the second installment of Abyde’s HIPAA Investigation Survival Series. We’ve reviewed the initial breach, which usually sparks an investigation. Still, the actual start of an investigation is when a practice receives an official investigation letter.  The investigation letter is usually sent by mail to a practice. However, depending on what information the Office for Civil Rights (OCR) has, this letter could also be sent by email.  Knowing how to read and understand a HIPAA investigation letter is vital to the success of your practice.  What’s in an Investigation Letter? A HIPAA investigation letter might be overwhelming to receive at first, but it’s important to keep calm. Getting a letter doesn’t necessarily mean you’ll be fined. It is solely a data request from the OCR if you can prove your due diligence in protecting patient data.  An investigation letter begins with official letterhead from the Department of Health & Human Services—OCR. It will also provide an OCR Transaction Number, which will be used in all communications regarding this situation. This letter will also include the contact information for the OCR investigator assigned to your case.  The letter will begin with the current information presented. For example, if the OCR receives a breach report about a stolen device, it will be mentioned alongside potentially violated HIPAA legislation due to that breach. The first part of the letter sets the scene for what the OCR currently has information about.  The second part of the letter is the data request form. In addition to the information previously shared in a breach report (or what was provided by a patient complaint), the OCR requires more information about your current practices regarding securing Protected Health Information (PHI).  As stated in the previous installment of this series, sometimes breaches happen, no matter how many precautions your practice takes. Your practice being breached is not the reason for a fine, but your practice’s inability to showcase adequate safeguards in place is.  The OCR can and will ask thorough questions. The data request will ask you to provide proof of the compliance standards you have in place. Common questions include proof of an up-to-date and accurate location-specific Security Risk Analysis (SRA), what safeguards you have in place (encryption, antivirus, access logs, etc.), and training completed by staff. These questions all depend on the situation, but overall, they will ask about preventative measures taken, how the situation was handled, and what your practice is currently doing to avoid a similar breach.  After the initial questions, the OCR will provide instructions on correctly submitting documentation. The documentation can be sent electronically (and must be encrypted if there’s any PHI) or through mail to the investigator.  The letter then concludes with potential enforcement. Potential enforcement includes monetary fines, government monitoring, and, depending on the severity of the violation, criminal time.  What’s Next?  Upon receiving the letter, it’s time to gather documentation. The timeline documentation that needs to be received is also included in the initial letter. Most often, documentation must be returned to the investigator within 30 days of receiving the letter.  Following the initial submission, more documentation might also be requested, so it’s vital to answer the questions thoroughly and provide as much information as possible.  Due to how serious a HIPAA investigation is, it’s important to outsource HIPAA compliance for your practice. By having a third party assist in your compliance program, like a smart software solution, you can also be provided a team of compliance experts for support throughout an investigation. By working with a team, their experience is vital to navigate an investigation.  To learn more about getting compliant for your practice, schedule a consultation with one of our experts today.  To visit our first installment of this series, which is focused on the breach, please visit here. To learn more about organizing documentation for a HIPAA investigation, read the next part of this series. To finish the series, read about the potential outcomes of an investigation here. 

How to Mitigate a HIPAA Breach
Abyde News, Best Practices, HIPAA

Is Your Practice Prepared for a HIPAA Breach?

February 10, 2025 No comments yet

February 10, 2025  Welcome to Abyde’s HIPAA Investigation Survival Series. HIPAA investigations can last for years, making it one of the most stressful experiences a practice can endure. It’s vital your practice understands the investigation process. The first step of the HIPAA investigation is the breach itself. Experiencing a data breach is pretty common in healthcare and can affect organizations of all sizes. For example, the Change Healthcare breach, a subsidiary of UnitedHealthcare, exposed at least 100 million patients’ data. While they might be common, it’s still your practice’s responsibility that the proper precautions are put in place to mitigate risks.   What is a Breach? A breach is any impermissible disclosure of Protected Health Information (PHI) without authorization. PHI is data that can individually identify a patient, including information like Social Security numbers, birth dates, medical records, and more. Healthcare faces significant data breaches due to various threats, including stolen computers and unauthorized access. However, the largest threat by far comes from ransomware and cybercrimes. Ransomware reports to the Office for Civil Rights have increased 264% in the last five years. Ransomware can infect systems through several channels, like email. Successful phishing attempts are the most common way malicious actors hack healthcare systems. That’s why it’s imperative to provide proactive training to staff, ensuring they are aware of common phishing scams and how to handle spam emails when they arrive, such as forwarding them to IT or immediately sending them to spam.   If my practice is breached, what do I do? If your practice is breached, handling the situation calmly is important. Time is of the essence when it comes to HIPAA breaches, with every second pivotal for a hacker to leak more information. When becoming aware of a HIPAA breach, your practice must take the infected device offline and review the scope of the hack. In situations like these, Based on the size of your organization, it’s important to have an in-house or outsourced IT team to navigate you through the technical process. A breach report needs to be filed as well. This can depend on the size of the breach, with breaches impacting less than 500 needing to be filed within 60 days from the end of the year and large breaches, or 500+, needing to be reported to the OCR within 60 days of discovering the breach. This report needs to be filed here. The state where a breach occurs is a crucial factor, as some states have stricter requirements, including shorter timelines. In either situation, affected patients need to be notified. Under the Breach Notification Rule, patients must be notified within 60 days of discovering the breach. For large breaches, media notice is required, usually in the form of a press release, to ensure impacted patients are aware their health information was put at risk. Once again, depending on the state, different parties, like the State Attorney, need to be notified.   What’s Next? The OCR may investigate your practice to ensure you had the proper protocols in place before and if the response after a breach is sufficient. This investigation would take place after breach recovery efforts are completed, such as restoring systems and notifying the necessary parties. A common misconception is a HIPAA fine is due to a cyber attack. Sometimes, breaches occur no matter how many safeguards you have in place. Fines are levied on practices that did not take the proper precautions before an event, such as training staff, having antivirus software, or having a Security Risk Analysis (SRA) in place. The fine is not due to the breach itself, but it triggers an investigation, where fines can be levied for lack of preventative measures. During an investigation, the government looks to see that your practice has taken steps to mitigate and prevent cybersecurity issues before they escalate into a breach. That’s why it’s imperative to implement protective measures for your practice before a breach occurs. Getting compliant can be overwhelming, but with the right tools, you can easily streamline your HIPAA program. Smart software solutions can serve as a comprehensive compliance hub, allowing you to see your practice’s vulnerabilities and offer steps to fix them. To learn more about HIPAA compliance for your practice, meet with a compliance expert today. Read the second installment of the series, focused on the HIPAA Investigation letter here. Read the third installment of the series, focused on organizing documentation for a HIPAA Investigation here. Finish the series here to learn about the potential outcomes of a HIPAA investigation. 

HIPAA in Eye care
Abyde News, Best Practices, HIPAA

HIPAA in Eye Care: Are You Doing Enough?

February 6, 2025 No comments yet

February 6, 2025 Running your eye care practice presents a unique set of challenges. From patient care to handling intricate technology, the workload can be demanding. Even though working in eye care keeps you busy, HIPAA compliance must be maintained.  While taking care of your patients’ vision is your first priority, their data health is also important.  HIPAA, or the Health Insurance Portability & Accountability Act, is a federal law that defines what Protected Health Information (PHI) is and what your eye care practice needs to do when ensuring data security.  The Office for Civil Rights enforces HIPAA compliance and has levied monetary fines and other penalties against eye care practices. In fact, an eye care center was fined $250,000 last year after a major ransomware attack revealed its inadequate compliance practices.  When getting your compliance program in order, knowing where to start is vital.    How Can I Achieve HIPAA Compliance for My Eye Care Practice?   HIPAA consists of several major rules and regulations, including the Security Rule, the Privacy Rule, and the Breach Notification Rule.  The Security Rule focuses on the administrative, technical, and physical safeguards a practice needs to deploy to secure patient data. Some common precautions examples include antivirus software, door alarms, and employee ID badges.  A significant component of the Security Rule is the Security Risk Analysis (SRA). The SRA is a comprehensive assessment of your eye care practice’s current efforts to protect patient data. This analysis is the foundation of a compliant practice and allows your practice to identify and address vulnerabilities. The OCR has also increased enforcement surrounding missing this document with the Risk Analysis Initiative.  This rule, as of January 2025, is currently being updated. The proposed Security Rule updates are focused on modernizing the legislation, requiring more safeguards to protect patient data. For an in-depth analysis of the updates, please read here.  The Privacy Rule focuses on limiting how patient data is shared. One part of this rule is the Minimum Necessary Standard, which requires practices to share only the necessary amount of information when handling PHI.  Another component of the Privacy Rule is the Right of Access standard. This requires practices to give patients access to their medical records within 30 days. In some states, this timeline is even shorter.  Lastly, the Breach Notification Rule dictates how affected patients and the OCR need to be notified after a breach. How a breach is handled can vary depending on the severity of the incident. The OCR must be notified of breaches affecting fewer than 500 people within 60 days of the end of the year. Breaches affecting 500 or more patients must be reported within 60 days of the incident. Affected individuals must be notified within 60 days. Depending on the state, some of these timelines may be shorter, and the state attorney may also need to be notified. These announcements are usually sent out as press releases and provide credit monitoring and more to impacted patients.    What’s Next?   While HIPAA compliance might feel overwhelming, there are ways to streamline compliance. Utilizing smart software solutions can alleviate the stress of compliance, allowing your practice to focus on providing quality eye care.  To learn more about how you can streamline HIPAA compliance in your eye care practice, schedule a consultation with one of our experts today. x

Top HIPAA Questions
Best Practices, HIPAA

HIPAA Help: Your Top Compliance Questions Answered

January 29, 2025 No comments yet

January 29, 2025 Managing HIPAA compliance for your practice can be challenging. Given the overwhelming number of laws, requirements, and procedures to navigate, you likely have questions about ensuring compliance. Other practices likely have the same questions as yours. Learn more about the most common questions healthcare practices have and how you can ensure compliance. Who Needs to Do HIPAA Training? One of the most important HIPAA requirements is making sure staff members complete training. When facing a HIPAA investigation or audit, the Office for Civil Rights (OCR) will ask for documentation proving your practice has been properly trained. However, many questions might arise around this, including: How often should staff members train? How long should I keep training records? Who in my practice has to complete HIPAA training? First, HIPAA training is required for all staff that have access to Protected Health Information (PHI). PHI includes information like names, Social Security numbers, medical records, and more. Staff with access to sensitive data need to understand the foundation of HIPAA and how thorough data management protects patients. As staff members learn about vital skills such as breach management, compliant patient communication, and handling sensitive information, they become better equipped to manage PHI. Documentation of this training is required for each individual, such as each staff member receiving a completion certificate. This completion certification, or whatever proof that training has been completed, must be saved for at least six years. When being investigated, the OCR can and will ask for multiple years of training proof, so ensure your training program documentation is properly organized. This training needs to be completed at least annually, and it is recommended that new staff be trained as soon as possible before handling PHI. Staff should also be retrained should a breach occur, refreshing staff on proper procedures. What is a Business Associate Agreement? When entrusted with PHI, it is crucial that any third-party vendors working with your practice implement appropriate safeguards to protect sensitive data. This is where a Business Associate Agreement (BAA) comes in. The BAA is a document that holds both parties responsible for the protection of PHI. This document includes what PHI is defined as and how both parties have to uphold its protection. HIPAA requires this document to be signed by any Business Associate (BA) with access to PHI. Some common examples of BAs include shredding companies, billing companies, and more. If your BA doesn’t want to sign this agreement, that’s a bad sign, and it’s recommended that your practice works with another vendor. The OCR also recently proposed strengthened requirements for BAs. This would require businesses work with a cybersecurity expert to prove adequate safeguards for patient data are in place. What Should I Do with Patient Consent Forms? The HIPAA Authorization for Use or Disclosure of Health Information Patient Consent Form must be provided to the patient before you can work with them. Consent forms allow patients to understand and authorize how their health information is shared. This includes granting access to specific individuals. Patients can decline to sign this form and still be treated by the practice, but it must be noted in their records. It is also always best practice to review these consent forms with patients every three years, ensuring that the information is still current. What’s Next? From staff training and business associate agreements to patient consent forms, staying HIPAA compliant requires attention to detail. Smart software solutions with expert teams and simplified compliance can help alleviate this burden and allow you to easily check your compliance status. HIPAA compliance may seem daunting, but by taking these steps and utilizing the right tools, you can protect your practice and your patients. Ready to learn more? Watch our latest webinar, which addresses even more of the top questions healthcare professionals have when it comes to healthcare compliance.

Are you sure you've got HIPAA covered? Get your compliance grade in 5 minutes.

TAKE THE CHALLENGE
X