April 28, 2023 Is it draft season already? NFL teams have been stressing daily to boost their lineups and prepare for the upcoming season. With the NFL draft officially underway, teams risk their future success with unproven prospects. Why take a risk? Maybe they have identified a position that isn’t as strong as another, or perhaps they are looking into future potential. At Abyde, we take all the stress and guesswork out of compliance. Whether it’s HIPAA or OSHA, we’ve got you covered. Just like in the NFL, we also have a starting lineup. The Security Rule establishes national standards for protecting electronic PHI (ePHI). Covered entities and their business associates must implement administrative, physical, and technical safeguards to protect ePHI from unauthorized access, use, or disclosure. So how do we save you? Like a good offensive center, our Security Risk Analysis will adapt to your practice’s needs and uncover potential risks. After taking this assessment, we will generate a Scorecard for the practice. Look at this as your playsheet. We will guide you through your high, medium, and low-risk items and even give you the ability to update any answer with the click of a button. There’s no “I” in a team, so what else is a part of our starting lineup? HIPAA Privacy Rule sets national standards for the protection of PHI. Covered entities and their business associates must ensure that they protect the privacy of patient’s PHI and provide patients with specific rights regarding their PHI, such as the right to access and correct their health records. Do you have Business Associate Agreements in place? How about policies and procedures for your practice? Abyde’sSecurity Risk Analysis will help dynamically generate your practice’s specific documentation. Like a good teammate, this will help guide you through you to ensure a culture of compliance within the office. Think we forgot about OSHA? There are also standards that the government requires practices to follow, which include Hazard Communication Standard, Bloodborne Pathogens Standard, and Personal Protective Equipment Standard, to name a few. So how do you keep pushing downfield while these standards set their sights on you? Abyde’s Facility Risk Assessment (FRA) and Emergency Action Plan (EAP) have your blindside like a hall-of-fame left tackle protecting you and your practice with insight on ensuring a safe and healthy workplace. In addition, the FRA establishes a game plan for the future. Abyde’s revolutionary software also provides specific employee training for the above standards. With Abyde, your documented compliance solution will protect you better than a Pro Bowl lineman! So, hopefully, your team – errr, practice – will make the right decisions this year, both on and off the field!
ChatGPT & HIPAA: A Quick Guide on What You Need to Know
April 26, 2023 If you haven’t heard about ChatGPT over the last few months, you might still be Googling everything! ChatGPT launched in November 2022 and has taken the internet by storm. Developed by OpenAI, using artificial intelligence (AI) technology, it can have human-like conversations while giving you all the details of whatever you may ask it. So we haven’t seen it be able to make you dinner just yet. Still, it has successfully written computer programming, passed a series of different exams, and written entire feature-length articles. (Wow, I feel like a doting parent!) AI language models are transforming how we approach everyday tasks or complete major projects, and the healthcare industry has even jumped on board the ChatGPT train. ChatGPT has assisted in scheduling appointments, treatment plan assistance, patient education, medical coding, and more! While this all sounds exciting and has the opportunity to improve patient care, protecting your patient’s data when using these types of tools will be imperative and should be approached with caution. So what are some of the red flags to be aware of when it comes to HIPAA compliance: • At this time, OpenAI does not sign a Business Associate Agreement. Therefore, it is not HIPAA compliant. HIPAA regulations require that covered entities only share PHI with vendors who have signed a BAA. This ensures that PHI is protected and that all parties comply with HIPAA laws and regulations. Prior to implementing any AI technology that processes or accesses PHI, covered entities must enter into a business associate agreement with the vendor of such technology. • Protect PHI when using the chat platform. OpenAI warns against inputting confidential information into the platform. As with many technology platforms, ChatGPT collects information and reviews conversations to improve systems and services. In other words, there is no telling where that data is being stored and, therefore, cannot be protected. Because this platform is not HIPAA compliant, it’s super important to remember not to input any identifiable patient information. When working with PHI, de-identifying or anonymizing data is key to minimizing the risk of a data breach. • Establish access controls and monitor chat logs. To minimize risk, access to chat logs should be restricted to those who need it as part of their job function. Don’t forget to implement written documentation of which employees can access chat logs, and be sure to revoke access if necessary. These chat logs are highly recommended to be monitored and audited to ensure they do not contain any PHI. • Establish Policies and Procedures and train employees. When implementing a new technology, such as ChatGPT, that potentially accesses PHI, policies, and procedures must be implemented to ensure that all appropriate safeguards are in place to support the use of the new technology. Training employees on properly using new technology is also super important. Training should include security best practices, data privacy importance, and incident reporting steps if necessary. • Create and implement an incident response policy. As with any security risk, having an incident response policy is super important to help mitigate risk in the case of a breach. This plan should include procedures for identifying and mitigating the incident, notifying affected individuals, and investigating the cause of the incident to prevent future incidents. By proactively prioritizing patient privacy and security, healthcare organizations can greatly benefit from ChatGPT and other AI language models. Streamlining administrative work and improving patient outcomes, sounds like a win-win. But, it’s critical that you carefully balance increased efficiency and elevated risks related to patient data privacy. This is new for everyone, so not making drastic changes to your business because of something ChatGPT can do should be considered. Your patients still want human experiences, and that is something ChatGPT can’t take away from you and your staff!How can you stay up to date on the latest compliance trends and news? Contact our compliance experts at Abyde today for guidance on this everchanging technical landscape and see how we can help you be successful in the years ahead! To book a demo with one of our Abyde specialists, click here or call us at (800) 594-0883
A Culture of Compliance – Your Get Out of Jail Free Card
April 18, 2023 Everyone wishes for the “Get Out of Jail Free” card in the game of Monopoly, so you can sell it and make money or free yourself from the slammer and continue your quest for wealth. But don’t you wish you had a card like this in real life so you could avoid paying a late fee, get out of an awkward situation, or get out of a speeding ticket? Imagine handing a police officer the card with your license and registration, I bet you would get a good chuckle! When it comes to healthcare compliance, demonstrating “good faith” could provide you with that much-needed “Get Out of Jail Free” card if you are investigated, audited, or are facing a violation. “Good faith” generally means that you have made a sincere and honest effort to comply with applicable laws, regulations, or standards pertaining to HIPAA and OSHA. So what do regulators look for when determining whether or not a practice has demonstrated “good faith”? First, you have implemented policies and procedures to include applicable forms or required logs. Next, staff has been trained in accordance with HIPAA and OSHA timeframes and requirements. And most importantly, whether or not you have completed a HIPAA Security Risk Analysis and OSHA Facility Risk Assessment that have identified risks, hazards, and mitigation efforts. While regulators may consider other factors, implementing a documented compliance program suggests you are committed to compliance and taking reasonable steps to protect your patients’ PHI and provide a safe and healthy workplace for staff. It is important to keep in mind “good faith” does not guarantee immunity from regulators. Every situation will have different mitigating factors, such as malicious intent or an identified hazard that went unmitigated. While you may be promoting a culture of compliance, ignoring the blatantly obvious could lead to you losing that “Get Out of Jail Free” card. Okay, how can you win at the HIPAA and OSHA compliance game? While it may be difficult to achieve compliance perfection, having a documented culture of compliance and, even more importantly, not letting your compliance program lapse will be key. These moves will show your “good faith” effort towards safeguarding patient information and employee safety and might even earn you the jackpot or a luxury Dark Blue property (IYKYK).
OCR Announces Transition Period for Compliance with HIPAA Rules for Telehealth
April 12, 2023 As of May 12, 2023, a 90-calendar day transition period will be in effect to provide covered healthcare providers with time to come into compliance with the HIPAA Rules in relation to their provision of telehealth. The transition period will expire on August 9, 2023, at 11:59 p.m. During this period, the OCR will continue to exercise its enforcement discretion. It will not impose penalties on covered healthcare providers for noncompliance with the HIPAA Rules that occur in connection with the good faith provision of telehealth. The Notice of Expiration of Certain Notifications of Enforcement Discretion Issued in Response to the COVID-19 Nationwide Public Health Emergency is available at: https://public-inspection.federalregister.gov/2023-07824.pdf – PDF. This notice marks the end of the enforcement discretion period that was put in place by the OCR to support the healthcare sector and the public in responding to the COVID-19 public health emergency. OCR Director Melanie Fontes Rainer has emphasized that the OCR is committed to supporting the use of telehealth by ensuring that healthcare providers can make the necessary changes to their operations privately and securely in compliance with HIPAA Rules. In addition to announcing the transition period, it’s worth noting that the OCR had previously issued four Notifications of Enforcement Discretion in the Federal Register regarding how the HIPAA Rules would be applied to certain violations during the COVID-19 nationwide public health emergency. These notifications and their effective beginning and end dates are: It’s important to note that these notifications will also expire at 11:59 pm on May 11, 2023, due to the expiration of the COVID-19 public health emergency. The OCR will no longer exercise enforcement discretion for violations that occur after this date, which is why the transition period has been put in place to allow covered healthcare providers to make any necessary changes to their operations to ensure they comply with HIPAA Rules when providing telehealth services. Questions regarding HIPAA and OSHA Compliance, please email Abyde at info@abyde.com or call (800) 594-0883
HHS Announces New Divisions Within the OCR
March 14, 2023 EXTRA EXTRA READ ALL ABOUT IT!! The U.S. Department of Health and Human Services, through the Office for Civil Rights (OCR), announced the formation of a new Enforcement Division, Policy Division, and Strategic Planning Division. Why isn’t this front-page news? And why did the HHS need to form three new divisions? “OCR’s caseload has multiplied in recent years, increasing to over 51,000 complaints in 2022– an increase of 69 percent between 2017 and 2022,” said OCR Director Melanie Fontes Rainer. “…reorganization improves OCR’s ability to effectively respond to complaints, puts OCR in line with its peers’ structure, and moves OCR into the future.” The OCR will now reflect the structure set by the U.S. Department of Education’s Office for Civil Rights. The Strategic Planning Division will not only work to coordinate public outreach to protect civil rights and health information privacy. They will also expand data analytics and coordinate data collection across HHS leadership. With the OCR being proactive and educating the public on their rights, now would be the time to make sure you are being proactive with HIPAA. What is something to make sure you are staying compliant and one step ahead of the OCR? How about your Security Risk Analysis or the “Crown Jewel” of the OCR as we like to call it. It’s the first thing the OCR asks for when they come knockin’. So why not beat them to the punch? You’ll identify and assess potential threats and vulnerabilities to protected health information (PHI), as well as evaluate the effectiveness of the organization’s security measures and policies. A HIPAA Security Risk Analysis is an ongoing process that must be regularly reviewed and updated to ensure that the organization remains in compliance. Guess what, here at Abyde we automate the entire process for you. Extra, extra, HIPAA violations can result in severe consequences, including fines, legal action, and damage to a healthcare organization’s reputation. Therefore, it is critical for healthcare providers and organizations to prioritize HIPAA compliance and regularly review and update their policies and procedures to ensure they are in line with the latest regulations.
OCR Releases Annual HIPAA Compliance Reports
February 24, 2023 Believe it or not, the Office for Civil Rights kicked off NBA All-Star Weekend with their very own showcase of HIPAA enforcement’s latest and greatest. Last Friday the government released not one but two annual reports starring key HIPAA enforcement activities from 2021. While you probably won’t be seeing these reports featured on the next SportsCenter Top 10, the insights that they provide into recent healthcare data breaches and HIPAA noncompliance cases are certainly worthy of a highlight reel. So to give your practice some helpful pointers on how your compliance efforts should be focused, let’s break down the most important stats from each report: OCR’s 2021 Report to Congress on HIPAA Privacy, Security and Breach Notification Rule Compliance The biggest takeaway? Between 2017 and 2021, the OCR has seen a 39% increase in the number of HIPAA complaints received and in turn, has initiated 44% more compliance reviews. Meaning that not only are your patients paying more attention to non-compliance, but the government is too. OCR’s 2021 Report to Congress on Breaches of Unsecured Protected Health Information Now, what does all this data really mean? OCR Director, Melanie Fontes Rainer, made the intentions of these reports clear in her statement saying, “We will continue to provide guidance and technical assistance on compliance with the HIPAA Rules, as well as a vigorous enforcement program to address potential HIPAA violations.” Meaning that not only do each of those statistics provide eye-opening insight into what’s going on in the healthcare industry, but they help identify exactly what areas of compliance are too commonly overlooked. And when it comes to ensuring your practice has an all-star compliance line-up, here’s what the OCR identified as the top areas for needing improvement: So knowing what common compliance gaps exist and what a winning HIPAA program looks like, the ball is in your court. You wouldn’t put a rookie up against LeBron, and the findings from these reports are perfect examples of why you can’t go head-to-head with an evolving healthcare industry without having both compliance AND cybersecurity on your team.
Big Fish, Big Fine
February 3, 2023 A hacker dropped a line and an Arizona-based nonprofit health system got baited, hook line and sinker. Yesterday, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights announced a settlement resolving a data breach. The breach, executed by a “threat actor”, disclosed the protected health information of 2.1 million consumers. Ouch! Outlined by the HHS, the HIPAA violations include: The investigation began back in 2016 after OCR received a receipt of a breach report. The hacker was able to access PHI such as patient names, physician names, dates of birth, addresses, Social Security numbers, clinical details, dates of service, claims information, lab results, medication, diagnoses and conditions, and health insurance information. As part of the settlement, the hospital paid $1,250,000 to OCR and agreed to a Corrective Action Plan. The plan highlights efforts to resolve their violations against the HIPAA Security Rule. Before you catch yourself becoming a victim of “here fishy fishy”, make sure all your ducks – or should we say fish – are in a row. As we continue to see the relevance and impact of cybersecurity incidents increase, you should be more alert and secure than ever. And if you’re thinking, well that was a hospital – that could never happen to me, be careful what your next Go Fish card is. Whether you’re a big fish in a little pond or a little fish in a big pond, hackers are targeting healthcare. This particular hospital is facing extensive hours of work to complete its Corrective Action Plan which includes conducting a risk analysis, developing a risk management plan, implementing and distributing policies and procedures, and regular follow-up with the HHS. Conveniently, these are all things Abyde can help with. Reach out today to find out how we can save you over 80 hours a year and a time-consuming Corrective Action Plan down the road.
Outsourced Doesn’t Mean Overlooked
January 26, 2023 We get it. The hiring market is tough out there right now and when your main goal is providing the best experience for your patients, you will do whatever it takes to build a strong team. But before you go sailing the high seas to find your next hire, you might want to make sure they’re paddling in the same direction. Are you considering outsourcing job roles to agencies that employ individuals in other countries? A company’s location and where its employees are located doesn’t necessarily mean they are or are not HIPAA compliant. As a practice, you are responsible for checking the company’s policies and procedures of any company you hire to ensure that they comply with all relevant regulations. If an organization outsources any function that involves access to PHI, it must have a written contract with the Business Associate. Here are some questions we recommend asking prior to working with an outsourced company: Let’s make sure all eyes are on the same prize – HIPAA compliance. Still not sure if you’re asking the right questions? Give us a buzz and we will walk you through the most important processes and policies to follow.
Brushing & Flossing Are Important to Your Practice, Too
January 19, 2023 You know the drill, no pun intended. The hygienist finishes a cleaning and hands the patient their goody bag full of all the fun things, including a toothbrush and dental floss. While this has become the norm for the practice and the patient, there is a good reason for it. Hygienists are taught to preach good oral hygiene, and it’s no secret that most patients that brush and floss regularly will experience better oral health and require less invasive treatment down the road. But what about those patients who don’t follow the advice or over time fall out of best practice? Yes, we’re looking at you, guy who only flosses the night before their appointment. The patient is typically aware of their intermittent compliance but since they are asymptomatic, they continue hoping for the best and vow to do better after the next cleaning. Then as it usually does, life happens and they cancel their next cleaning. And with the best of intentions, they plan to reschedule but keep forgetting. Disease begins to take hold. If the patient is fortunate, they return to the office before the issue is too serious and it can be resolved with a relatively simple treatment plan. Those less fortunate may require more involved and expensive procedures. So you’re probably wondering by now, how does any of this tie back to Abyde, a healthcare software company? Well, we’ve brought in one of our Abyde Ambassadors to tie it all together. Michael Wilgus shares his experience from the last 20 years in the industry. “Ironically, I have seen a similar scenario in hundreds of practices regarding HIPAA and OSHA compliance. A practice starts out with positive intent and implements what they believe is a strong and complete compliance program. Things get busy, there is turnover, and compliance gets pushed to the back burner. When violations or inspections occur (because they are not an if situation), they are usually due to a knowledge gap or are accidental, and may even be asymptomatic to the practice owner.” With HIPAA, if an event is reported, the Office of Civil Rights (OCR) may choose to implement a corrective action plan (think treatment plan) for the practice. That plan can be expensive, time-consuming, and involve an OCR specialist monitoring your progress regularly for an extended period. The U.S. Department of Labor isn’t missing out on the fun either. They are actively ramping up their OSHA program by hiring more investigators and estimate their budget to increase by 14.7%, going from $612 Million in the fiscal year 2022 to $701 million in 2023. The average penalty levied on a dental practice in 2022 for a HIPAA violation was measured in the tens of thousands of dollars; one estimate shows it to be approximately $45,000. Sacrificing the net revenue from months’ worth of crowns is something most practices cannot afford. When it comes to OSHA, the punch-to-the-gut penalties are nothing to chuckle at. And let’s not forget the recent increase in these dollar amounts. Achieving and maintaining compliance when using services from Abyde takes less time than a patient should spend brushing and flossing, and if we can humble brag for a minute – we make it easy and fun! Brushing and flossing are not only good for your patients but are also good for your practice. Ready to get your practice’s compliance hygiene up to par?
With the first settlement announcement of 2023, OCR selects…
January 4, 2023 We didn’t even make it through the first week of the new year before we saw the first settlement announcement. Yesterday, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services announced a settlement with a Georgia full-service diagnostic lab. The potential violation marks the 43rd associated with the HIPAA Right of Access Initiative to date. This is now the third Right of Access settlement we have seen in the last month. The initial complaint was first filed back in August of 2021 when a personal representative was unable to obtain a copy of her deceased father’s medical records. While the lab finally complied in February of 2022, it took seven months for the requester to receive the records. The HIPAA right of access provision requires that patients be able to access their health information in a timely manner, typically within 30 days. The lab has agreed to pay $16,500 and implement a corrective action plan to resolve this investigation. The corrective action plan includes two years of OCR monitoring. OCR Director, Melanie Fontes Rainer, shared her thoughts, “Access to medical records, including lab results, empowers patients to better manage their health, communicate with their treatment teams, and adhere to their treatment plans. The HIPAA Privacy Rule gives individuals and personal representatives a right to timely access their medical records from all covered entities, including laboratories.” While we all have the same goal in common – to provide the best experience for our customers and patients – that doesn’t always equate to direct care. Ensuring that their needs and requests are met is essential to the overall experience. From the first time they Google you all the way to a request for records, you are making an impression. And whether it’s the first impression or the last, don’t you want it to be a good one?