HIPAA

HIPAA Right of Access Initiative Fine
Fines, HIPAA

OCR Announces 20th HIPAA Right of Access Settlement

September 10, 2021 Comments Off on OCR Announces 20th HIPAA Right of Access Settlement

September 10, 2021 There might not be such thing as time travel but with the latest HIPAA settlement announcement, it’s looking like the Office for Civil Rights (OCR) has traveled back to their own version of the Roaring ‘20s. Two years, and now twenty resolutions later, the government initiative to support individuals’ right to timely record access has driven its own little economic boom – with the 20th financial penalty bringing the right of access running total to $1,173,500.  Children’s Hospital & Medical Center (CHMC) became the most recent healthcare organization to settle with the OCR, with a fine of $80,000 and requirement to adopt a corrective action plan that involves one year of government monitoring. But while the Nebraska-based pediatric provider probably isn’t too jazzed about the repercussions, the penalty comes as a result of an equally unhappy individual who was not provided the proper access that HIPAA strives to ensure. The issue was brought to the OCR’s attention back in May of 2020 after a parent filed a complaint alleging that CHMC failed to provide full access to her late daughter’s medical records. The complaint stated that while the organization fulfilled a portion of the request, CHMC failed to provide all of the requested records despite the parent’s several follow-up requests. The delay was in part due to the remainder of the requested records being needed to obtain from a different CHMC division but it wasn’t until after the OCR’s investigation that full access was provided. In addition to the resolution agreement, Acting OCR Director, Robinsue Frohboese released in a statement, “Generally, HIPAA requires covered entities to give parents timely access to their minor children’s medical records, when the parent is the child’s personal representative. OCR’s Right of Access Initiative supports patients’ and personal representatives’ fundamental right to their health information and underscores the importance of all covered entities’ compliance with this essential right.”  While this settlement shares plenty of similarities with the 19 other examples of noncompliance that we have seen since the enforcement initiative started, it’s important to note the fact that this $80,000 fine was the result of just one patient complaint. And though the Roaring ’20s might’ve been a relatively short-lived era, proposed updates to the HIPAA Privacy Rule and expansions to the OCR budget are enough to predict that the right of access enforcement initiative isn’t going anywhere, anytime soon. So with the latest settlement serving as the perfect example of just how much damage a single HIPAA complaint can have on a healthcare organization – ensuring you’re fulfilling all medical record requests in a timely and HIPAA-compliant manner is essential to avoid becoming lucky settlement number 21.

The Cost of a HIPAA Violation
Fines, HIPAA

The Cost of a HIPAA Violation

September 3, 2021 Comments Off on The Cost of a HIPAA Violation

September 3, 2021 We’ve all seen enough news headlines to know that the going rate for a HIPAA violation isn’t cheap. This past year has tallied up more than a handful of fines with numbers that might not have Jeff Bezos doing a double-take, but certainly have us seeing dollar signs. Not to mention that the first fine of 2021 brought in $5.1 million alone. And although not every HIPAA violation warrants front-page news status, even the minimum fine amount can do some major damage – especially when it’s a small, independent practice footing the bill.  So if you’re looking for an exact dollar amount, to date the Office for Civil Rights (OCR) has collected on 101 settlements to the tune of $135,328,482. We all know that a check that size doesn’t just add up without reason but what caused it to accumulate and why so high? Well back when HIPAA law was first introduced in 1996, the hope was to establish a set of standards to protect sensitive health information in the medical industry. But as the later published Privacy and Security Rules provided a laundry list of requirements for covered entities to follow, many failed to fully comply. So in 2006, the government came up with a solution and that’s where the HIPAA Enforcement Rule was born. It was this ruling that essentially started the tab on that billion-dollar bill, granting the OCR the right to hold covered entities and their business associates accountable with fines and other penalties for noncompliance.  Now just as the repercussions for speeding are understandably different than they are for a case of highway robbery, HIPAA fines also come with a “prices may vary” label attached. Each penalty is determined based on the extent to which the organization was aware that HIPAA rules were being violated and is broken down into the following four tiers: If you were wondering, that “per incident” statement is the reason why we see those multi-million dollar fines – and what comes with HIPAA’s many different rules is a lot of different ways to break them. But it’s not just the monetary penalties that violators have to worry about. HIPAA settlements are usually a package deal including a corrective action plan that typically involves anywhere from two to three years of OCR monitoring. And if hefty fines and the government breathing down your back aren’t enough to prove just how costly violations can be – in the case that the HHS decides that there was deliberate malicious intent, the Department of Justice can step in and also assign criminal penalties with maximum jail time of 10 years. We know that the mention of hefty fines and possible jail time definitely puts a damper on things, but with every “bad news” there’s typically good to follow. So the good news is there are ways to help avoid these worst-case scenarios, and recently passed legislation like the Safe Harbor Law to protect against incidents like data breaches that aren’t as easily avoidable. But the best protection? Having a full understanding of your organization’s responsibilities and a complete HIPAA compliance program to check all the governments’ boxes. Because after all – with how high the cost of a violation can be, you can’t put a price tag on the peace of mind that comes with being compliant.  

Security Risk Analysis Misconceptions
Best Practices, HIPAA

The Security Risk Analysis and its Many Misconceptions

August 13, 2021 Comments Off on The Security Risk Analysis and its Many Misconceptions

August 13, 2021 HIPAA is kind of like a puzzle – without having each and every individual requirement in place, your practice can’t consider itself fully compliant. But much like building a jigsaw blindfolded, it’s a lot harder to piece together the big picture of compliance with all of the misconceptions out there masking what HIPAA’s requirements actually entail.  Now, the first piece in this so-called “HIPAA puzzle” is the Security Risk Analysis (SRA) which requires all covered entities to assess any potential risks and vulnerabilities to protected health information (PHI) based on the physical, technical, and administrative safeguards that their organization has in place. It’s essentially just a self-evaluation that helps lay the groundwork for a complete HIPAA program AND is the first thing a practice will be asked to provide in the case of an audit. But despite its importance, only 14% of entities actually fulfill the requirement – so what is causing this lack of compliance and why does the SRA seem like an unsolvable puzzle in itself? A large piece of the widespread noncompliance is all of the confusion that surrounds the ‘what, why, and how’ of the SRA. This is why in order to ensure all organizations know how to complete the first part of the big HIPAA puzzle, we need to break down the myths vs the facts.  Myth #1: Small practices and independent providers don’t need to worry about the SRA. False: All providers, no matter the size or specialty, are covered entities under HIPAA and are therefore obligated to perform a risk analysis along with all other requirements under HIPAA law. Myth #2: My Electronic Health Record (EHR) takes care of privacy and security, so I don’t need to complete an SRA. False: Even with a certified EHR, the risk analysis isn’t completed for you. The EHR vendor may provide information and training on the privacy and security aspects of their product but they are not responsible for privacy and security compliance within your practice. Additionally, an SRA involves all PHI within your organization, including what isn’t housed in your EHR like paper records and files.   Myth #3: My IT company handles a full SRA.  False: Similar to the confusion around your organization’s EHR, IT companies might help to assess technical safeguards and identify technical risks – but do not provide a comprehensive analysis of all aspects of your organization to cover the administrative and physical requirements.  Myth #4: I can use a templated checklist to complete my SRA.  False: While the government does provide some tools that can be used as helpful guidance for conducting an SRA, in order for the analysis to meet the requirements it must assess specific elements of your organization and practice operations which may differ from the types of things assessed in a template or generic checklist.  Myth #5: The SRA is a one-time thing and as long as I completed it once, I’m good to go! False: The HIPAA Security Rule specifically states, “the risk analysis should be an ongoing process, in which a covered entity regularly reviews its records to track access to e-PHI and detect security incidents, periodically evaluates the effectiveness of security measures put in place, and regularly reevaluates potential risks to e-PHI.” But although, your organization does need to be conducting an SRA on a continual basis – this doesn’t mean that each year you’ll need to start over from scratch. It’s important (and required) that you update your SRA annually at the very least as well as any time there are changes to your practice or systems to identify any changes in risks and maintain the necessary safeguards within your organization.  While we hope our little game of “myth busters” helped clarify any confusion around what goes into completing this requirement and why it’s so important, we know that it might’ve also caused some concern for how a small, independent practice is supposed to tackle all of this alone. Completing a comprehensive analysis (on an ongoing basis) along with the proper documentation and risk mitigation that’s required involves time, resources, and expertise that might seem unfeasible to a small or medium-sized organization. But luckily there are outside resources available to help debunk the other misconception that completing an SRA HAS to be challenging. So while your practice can tackle this requirement DIY-style, a software solution like Abyde makes it so you don’t have to – providing all the tools and support to guide you through the misconceptions and help to put the pieces into place so that your practice can easily complete the puzzle of HIPAA compliance. Schedule a one-on-one consultation today to see where your practice currently stands and how Abyde makes meeting the SRA – and all other HIPAA requirements – a breeze!

Controlling Access to Your ePHI
Cybersecurity, HIPAA

How Are You Controlling Access to Your ePHI?

July 22, 2021 Comments Off on How Are You Controlling Access to Your ePHI?

July 22, 2021 While there might not be such a thing as a real-life fairy godmother, technology has granted us the power to access a whole world of information with just a click of a mouse. Anything from research, shopping, to chatting with friends is now so simple it almost seems like magic, but this “instant-access” ability is a double-edged sword when it comes to the privacy and security risks that follow in its reign. Now if there’s one industry that truly feels the weight of technologies twofold, it’s healthcare. While sharing, receiving, and storing electronic protected health information (ePHI) is now easier than it ever was before, the heightened number of healthcare data breaches and cyber attacks seen over recent years have identified the ‘Achilles’ heel’ of technology’s power of accessibility. This ongoing battle between ease of access and security risks has been the topic of several Office for Civil Rights (OCR) alerts shared over the past year, and most recently, the main focus of their Summer 2021 Cybersecurity Newsletter.  The newsletter titled “Controlling Access to ePHI: For Whose Eyes Only?” highlights a recent report that found that “61% of analyzed data breaches in the healthcare sector were perpetrated by external threat actors.” So while most healthcare organizations know not to go and give the keys of the castle away to just anyone, technology has made access a possibility for really anyone who has a decent internet connection. But the even more striking statistic featured in the newsletter? It’s not just hackers that you have to worry about, the security incident report also uncovered that 39% of those data breaches were actually committed by insiders. Though most fairy-tales feature an evil villain, these insider breaches aren’t always the result of a malicious act. In addition to the multi-million dollar hacking schemes that we see all too often, are stories of staff impermissibly accessing ePHI or leaving sensitive data unattended. So if you’re wondering how you can best protect your practice, the answer is to have the proper authorization policies, procedures, and controls in place.    When it comes to those necessary policies and controls, the HIPAA Security Rule identifies certain standards and specifications that healthcare organizations are required to implement. The two standards, Information Access Management and Access Control, are administrative and technical safeguards that work in tandem to protect and secure ePHI – but what exactly do they entail? Information Access Management This standard essentially defines how access to ePHI is authorized and requires HIPAA-covered entities and business associates to implement policies and procedures regarding information access. So, what do some of these specific policies include? Access Control In addition to the administrative requirement for access management, Access Control is a technical safeguard that actually limits the availability of that ePHI based on the organizations’ Information Access Management policy. The OCR’s newsletter describes the necessary controls to coincide with the “flexible, scalable, and technology-neutral nature of the Security Rule” and provides a wide range of control mechanisms for organizations to consider and implement where they see fit. They also provide four implementation specifications which include: So as complementary requirements of the HIPAA Security Rule, your organization is expected to have these standards in place to best prevent both outsider and insider threats. And while it would be nice if you could just have a knight in shining armor there to guard your practice from cyber threats and impermissible ePHI access – implementing the safeguards provided above, and ensuring all staff members are trained on proper access, is the next best thing.

Proposed 2022 HHS Budget
HIPAA, Legislation

What the Proposed 2022 HHS Budget Says About the Future of HIPAA & Cybersecurity

July 15, 2021 Comments Off on What the Proposed 2022 HHS Budget Says About the Future of HIPAA & Cybersecurity

July 15, 2021 HIPAA compliance has seemed to be on the government’s radar more than ever before. In just the past year, we’ve seen record-breaking Office for Civil Rights (OCR) enforcement, proposed Privacy Rule updates and the implementation of the HIPAA Safe Harbor Law and the 21st Century Cures Act – two new sets of legislation centered around healthcare, technology, and patient rights. So with the spotlight set on protecting the privacy and security of health data during a time where reliance on technology is especially prevalent – it should come as no surprise that the government’s newly proposed budget features a heavy focus and increase in funding for this area specifically.  What’s in the proposed budget?  The Biden Administration recently released their proposed 2022 budget for the Department of Health and Human Services (HHS) in early June. The proposal calls for additional spending to better protect the healthcare industry from evolving cyber threats and support government efforts in enforcing compliance among covered entities. So exactly how much of a budget increase are they requesting and what does that tell us about the future of HIPAA compliance? While those dollar figures are already a good indicator of where we can expect the government to continue its focus – ensuring that patients’ health data is properly protected goes beyond those hefty price tags. Fiscal 2022 proposed budget also seeks to add 39 staff members to the OCR, bringing the employment total to 229, and acknowledges that the “OCR will engage in rulemaking to further strengthen individuals’ rights to access their own health information, improve information sharing for care coordination and case management and reduce administrative burdens.” So just as recent enforcement numbers have proven the governments’ awareness of noncompliance and influx of cyberthreats has shed light on a lack of proper security protections amongst healthcare providers – this proposed budget provides a ‘crystal-ball’ prediction of what we can expect to see moving forward. Adding in millions of dollars to the budget and expanding the task force in these relevant government agencies will produce even more resources available to ensure all covered entities are best protecting health data privacy and security. And although the new budget is not finalized as of yet, the upcoming changes to the Privacy Rule and commitment outlined within the proposal to improve upon government rulemaking is a clear sign that their emphasis on HIPAA and other health IT-related laws is not going away anytime soon.  What does this mean for you?  First off, meeting HIPAA and cybersecurity requirements is essential to protecting your practice and your patients from a data breach or HIPAA violation. While these are certainly things that should be prioritized regardless of the government’s spending plans, the proposal creates even more urgency in ensuring that you have these necessary safeguards in place. So as the government continues to hone in their focus on health data privacy and security, your practice should too – and having a complete compliance AND security program is the perfect place to start.

Privacy Rule Proposed Modifications
HIPAA, Legislation

Privacy Rule Proposed Modifications | Public Comments Released

July 8, 2021 Comments Off on Privacy Rule Proposed Modifications | Public Comments Released

July 8, 2021 Remember those Privacy Rule modifications that the Department of Health and Human Services (HHS) proposed late last year? Well, after adding a 45-day extension on the public comment period back in March, the responses submitted have finally been made available – giving us some additional insight on what we can expect to see when the updates are officially finalized.   For anyone looking for a light-read while they drink their morning coffee – diving into the official HHS document might not be for you. The proposal included a lengthy list of changes centered around increasing permissible disclosures of protected health information (PHI) and enhancing care coordination and case management. As the healthcare industry has evolved, so have the necessary requirements for protecting data privacy and security – and these modifications address several issues that have become the source of widespread non-compliance over recent years. One of the major areas of focus should come as no surprise considering the initiative that was declared in 2019 to enhance enforcement for patient right of access violations – and the 19 different settlements that have resulted from it so far. So in looking at how the Privacy Rule changes plan to improve this issue, some of the major proposed provisions include: In addition to addressing patients’ right of access, the proposed modifications also clarify certain definitions and phrasing that oftentimes leads to confusion and misunderstanding by providers and patients. Some of these updates include: While the examples provided are only a snapshot of the full list of proposed modifications, each update follows suit with the evolving environment in the healthcare industry and covers relevant concerns felt by both providers and patients. So much so, that the comment period extension was made due to such a “high degree of public interest” and amounted to a total of 1,391 comments submitted in response to the HHS’s proposal.  So what can we expect?  These proposed modifications take into consideration the public comments received on the OCR’s 2018 RFI that requested public input on how HIPAA rules could improve to better “support care coordination and case management and promote value-based care while preserving the privacy and security of PHI.” Each provision is a direct reflection of the key themes identified in the public opinion received back in 2018 and addresses issues like administrative burdens and the need for improving upon patient rights. So although we don’t have a time machine to jump ahead and see what exactly the final rule will entail, we can pretty confidently say that these concerns addressed in the HHS document will continue to be a focus in regulatory amendments and government enforcement. And the high volume of public interest clearly depicts the impact and value that enacting these changes will have on patients and providers. When will you need to comply  As far as knowing the what and when of the final ruling – we don’t quite have a definitive answer. But it’s important for all covered entities to be aware and prepared for the expectations of complying with the modified Privacy Rule provisions when they are made official. According to the HHS, “The effective date of a final rule would be 60 days after publication.” Additionally, entities will still have 180 days from that effective date to update or implement policies and procedures to achieve compliance with these new standards.  So when it comes to the timeframe for when the government will actually start enforcing the new compliance standards, you have 240 days of breathing room once the final rule is published. BUT based on the HHS’s acknowledgment that the impact of adhering to these new guidelines will involve “covered entities actions to re-train their employees on, and adopt policies and procedures to implement, the legal requirements of this proposed rule” we highly recommend taking an ‘early bird gets the worm’ approach for compliance. Having a complete HIPAA program in place along with a full understanding of the potential changes that could be coming your way is the best way to ensure that your patients’ data is best protected and your practice is best prepared for avoiding a HIPAA violation and fine.

HIPAA Policies & Procedures
Best Practices, HIPAA

Your Organizations’ HIPAA Rulebook: Policies & Procedures

June 21, 2021 Comments Off on Your Organizations’ HIPAA Rulebook: Policies & Procedures

June 21, 2021 Imagine if each sport didn’t have its own set of rules – we’d have baseball players tackling each other in the outfield and hockey players kicking the puck down the ice in front of a stadium full of confused fans with not a clue as to what they’re supposed to be cheering for. These unique sets of guidelines tailored specifically to each sport enable athletes to excel and spectators to appreciate what they’re watching. Without them, the games wouldn’t make much sense. So while the excitement of HIPAA is nowhere near anything you might find in a sports arena, having a rulebook specific to your organization is essential to ensuring patients’ sensitive information is being handled properly and HIPAA requirements are being upheld. HIPAA law came into play back in 1996 to set a national standard for how protected health information (PHI) should be handled and protected. Part of its requirements include the implementation of reasonable and appropriate policies to comply with these standards, but what exactly does reasonable and appropriate mean? Essentially, your organization is required to have policies and procedures in place to set expectations for how PHI should be handled as well as guide daily work operations and ensure consistency in patient care. But just as the specific rules differ for a game of football versus tennis, a small eye care facility has different expectations and work operations than a large hospital would – and therefore requires its own unique HIPAA rulebook.  What Do These Documents Include? For any HIPAA fanatics out there, you might already be familiar with the Security Rule’s provisions around the administrative, technical and physical safeguards necessary for protecting PHI which cover a wide range of requirements like completing a Security Risk Analysis (SRA), implementing facility access controls and maintaining up to date asset logs. So in looking at the documentation requirements, your policies should outline these required safeguards as well as the standard procedures for your organization to implement these protections. While the full list of documents and their included content will vary based on your organization’s size and specialty – there are some must-have elements that each rulebook should contain, including:  How Should These Policies & Procedures be Implemented? While the list provided above is definitely extensive and probably brings along an image of an overflowing HIPAA manual, it’s only a sample size of all the policies and procedures that your organization could potentially need to implement. And while yes, you can find templates for the majority of these policies online and even some directly on the HHS website, they lack an especially important element to the HIPAA requirement – customization. The latest HIPAA Industry Audit Report uncovered widespread non-compliance for the policy and procedure requirement – a major red flag being the common usage of “template policy manuals that contain no evidence of entity-specific review or revision and no evidence of implementation” (their words not ours). This lack of entity-specific evidence came as a result of organizations not including details like their practice name and HIPAA Compliance Officer (HCO) contact information within each policy document – which are important elements of actually fulfilling this requirement. In addition to providing specific details about your organization itself, another piece to the “customization” requirement is taking into consideration certain state laws that might take precedence over HIPAA. It’s important to ensure that policies including things like breach reporting and responding to record requests meet the most stringent timeframes and requirements that apply to where your facility is located. So in order to meet this important HIPAA standard, the ball is truly in your court. As new opponents like legislative changes, technology advancements, and evolving patient needs require adjustments in your organizations’ operations – your policies and procedures must reflect these updates accordingly. But having the proper documentation and specific content included isn’t all that’s needed to make the cut. Providing employee training on a continual basis is essential to getting staff members up to speed on how they should be running the plays and ensuring that PHI is being handled correctly within your practice. So when it comes to developing a winning HIPAA strategy, having a comprehensive set of properly documented policies and procedures that are understood and followed by everyone within the organization is the best way to stay in the HIPAA compliance game.

HIPAA Notice of Privacy Practices
HIPAA

What is a HIPAA Notice of Privacy Practices & Why Do You Need One?

June 10, 2021 Comments Off on What is a HIPAA Notice of Privacy Practices & Why Do You Need One?

June 10, 2021 Whether you’re a self-appointed 5 star chef or an Uber Eats connoisseur, you know that skipping one small ingredient (or forgetting the guacamole on your Chipotle burrito) can throw the whole meal off. And while there aren’t many similarities between cooking up your famous casserole dish and implementing a complete HIPAA program – both require various steps that are each essential to the final product. So amongst the exhaustive list of HIPAA essentials like the Security Risk Analysis (SRA), annual staff training, business associate agreements, and more –  falls an important and often overlooked ingredient in achieving compliance, the Notice of Privacy Practices (NPP).  What is it?  Under the HIPAA Privacy Rule, covered entities are required to provide patients with a notice that states how their protected health information (PHI) will be used and shared. In a nutshell, the purpose of the document is to clearly outline the practices you have in place to protect the privacy of sensitive data (hence the name Notice of Privacy Practices) along with your organizations’ legal responsibilities and patients’ rights to their own PHI.  What’s in it?  Creating a proper notice requires a little prep work, so in looking at the meat and potatoes of what goes into this important HIPAA document, the NPP should include a description of the following:  How do I provide it? It’s one thing to have all of the ingredients needed for the NPP but the part that often gets healthcare organizations in a pickle is determining how to properly securely serve it to patients. Typically, the notice is given to a patient at their first appointment along with other important documents like the HIPAA authorization form. But simply getting a copy signed once isn’t all that’s needed. Most practices don’t understand it’s a HIPAA requirement to also post the notice in a clear and easily accessible location to the patient. Additionally, if your practice has a website, a copy of the NPP should be posted and readily available there as well.  Why is it so important?  Compared to the many other more complex pieces of a complete HIPAA program, putting together a Notice of Privacy Practices seems almost as easy as whipping up a box of Kraft Mac and Cheese. However, according to the most recent HIPAA Audit Results, only 2% of covered entities fully met the NPP requirements while two-thirds failed to or made minimal or negligible efforts to comply. So why is there such an overwhelming amount of noncompliance for a relatively easy standard to meet? Well, the report found that many entities audited were able to submit some type of document but the majority could not provide a notice that was written in plain language and most were missing required content often related to individual rights. In addition to the widespread lack of proper content within the notice, the report also found that many entities failed to meet the prominently posted requirement. This meant that even if the entities had the notice and posted it on their website – if it wasn’t easily accessible from the website’s homepage it didn’t cut it in the OCR’s books.  Some food for thought? Having a complete compliance program in place starts with following the recipe of HIPAA requirements. Ensuring that your practice has a properly written and accessible NPP might one be a small piece of the whole HIPAA pie – but just like forgetting to add yeast when baking the crust, missing one requirement – even if you have everything else in place – can cause all of your other compliance efforts to fall flat.

OCR Announces 19th Right of Access Settlement
Fines, HIPAA

OCR Announces 19th Right of Access Settlement

June 2, 2021 Comments Off on OCR Announces 19th Right of Access Settlement

June 2, 2021 With the official kickoff of summer only a few weeks away, the Office for Civil Rights (OCR) is getting some last minute spring cleaning in – announcing their latest HIPAA settlement with a practice whose Privacy Rule violations couldn’t be swept under the rug. Diabetes, Endocrinology & Lipidology Center, Inc. (DELC) was handed a $5,000 fine and tasked with a two-year corrective action plan (CAP) to help clean up their “HIPAA mess” that started back in 2019.  Today’s fine marks the 19th Patient Right of Access settlement since the OCR officially announced their initiative two years ago. And ironically enough – around the same time that the government was declaring their focus on enforcing the standards around patient rights, DELC became a perfect example of just how many practices weren’t upholding them.  The incident began in July of 2019 when a parent requested access to her minor child’s health records. After DELC failed to take timely action in response to the request, a complaint was filed with the OCR in early August 2019. It wasn’t until the OCR got involved that the healthcare organization finally provided access, almost two whole years after the initial request.  Though the fine amount might seem on the lower end of what the OCR typically doles out, the corrective action plan has plenty of requirements to make up for it and just to name a few: This hefty “honey-do list” shows that the dollar amount doesn’t cover all the costs associated with violating HIPAA and proves why it’s so important to get your practice’s compliance efforts in order before an incident occurs. So while DELC took longer to fulfill the request than it would to dust off every book in the Library of Congress, the OCR hasn’t delayed in performing quite a bit of housekeeping themselves. With 19 settlements and $1,093,500 collected on behalf of patient right of access violations, the OCR has stuck to their initiative and continued to sweep up any and all violators. And though the settlements all range in resolution amount, corrective action requirements, and organization size and specialty – the message has always been the same and was reiterated by Acting OCR Director Robinsue Frohboese in that, “It should not take a federal investigation before a HIPAA covered entity provides a parent with access to their child’s medical records. Covered entities owe it to their patients to provide timely access to medical records.”   

Vaccination Status & HIPAA
Best Practices, HIPAA

Vaccination Status & HIPAA

May 28, 2021 Comments Off on Vaccination Status & HIPAA

May 28, 2021 News reports centered around patient privacy and COVID-19 seem to break on the daily – bringing newfound fame to HIPAA law and even more speculation on what is – and isn’t – covered within its requirements. Most recently, the conversation of vaccinations has been a trending headline with the question of ‘HIPAA violation’ commonly featured. So while there’s still plenty of uncertainty where COVID-19 is concerned, hopefully, we can at least shed some light on where HIPAA truly comes into play. When it comes to the commonly asked question of whether HIPAA protects against employers and other businesses requesting vaccination records, the short answer is no. HIPAA law only applies to covered entities which therefore means that private businesses and citizens are not obligated under the stringent data protection laws and CAN ask about vaccination status. However, patients do have the right to not disclose their own health information and can choose to decline to answer, but based on state-specific laws and company requirements there may be repercussions as a result. In a quote from Kayte Spector-Bagday, a lawyer and bioethicist at the University of Michigan, she highlights the popular misconception in saying, “People often feel like HIPAA protects them from being asked about their medical information, or prohibits other people from asking about their medical information. Neither is true. HIPAA prohibits health professionals, such as your doctor, from sharing your identified health information without your permission in most circumstances. People can always ask about your health information, and you can almost always decline to answer.”  So where does HIPAA come in?  As we just mentioned, healthcare organizations and their business associates are liable under the federal law meaning that your practice can NOT disclose vaccination information (or any protected health information for that matter) unless direct patient authorization is granted. So, say a patient’s employer calls your office to ask about their employee’s vaccination status. Well, because of the standards outlined in the HIPAA Privacy Rule, you cannot disclose any sensitive health information without patient consent, and doing so would result in a HIPAA violation. While vaccination status and test results are the trending topics at the moment, it’s important to note that these stipulations go for any and all types of patients’ health information, not just what’s related to COVID-19. And while the current state of the public health emergency still leaves a lot of unanswered questions – when it comes to your practice’s ability to disclose protected health information (PHI), HIPAA law still applies.

Looking to finish your SRA for MIPS by the Dec 31 deadline? We're here to help you get compliant in minutes.

SCHEDULE CONSULTATION
X