How Kaiser Foundation Rolled Up Its Sleeves to Clean Up Its Waste Game After a $49 Million Settlement

September 12, 2023

Hey there, eco-warriors and healthcare aficionados! Buckle up because we have some intriguing news on the healthcare front that could give you both a sigh of relief and a chuckle. You know the Kaiser Foundation, right? The healthcare giant that’s practically the Beyoncé of California healthcare? Well, they recently found themselves in a bit of a trashy situation. But don’t worry, they’re taking out the trash—literally.


What Went Down?

Imagine a group of undercover agents not from a blockbuster film but from district attorneys’ offices in counties like San Francisco, San Mateo, and others. Their mission? Inspecting dumpsters at 16 different Kaiser facilities, which, get this, wasn’t even locked. Spoiler alert: The bins weren’t filled with outdated fashion magazines or pizza boxes; they were packed with hazardous and medical waste. We’re talking needles, batteries, and even patient records! Yup, patient records are in the trash. Not good nor compliant!


The Rule Book

So, some of you might be scratching your heads and thinking, “Wait, isn’t there a rule against this sort of thing?” And, oh boy, are you right! We’ve got the big acronym HIPAA (Health Insurance Portability and Accountability Act) and a handful of Californian laws like the Hazardous Waste Control Law and the Medical Waste Management Act saying, “Nah, that ain’t right!”


How Kaiser is Cleaning Up Its Act

Kaiser wasn’t like, “Eh, no big deal.” No, siree! They brought in third-party pros to audit over a thousand of their trash piles—now that’s some severe garbage dedication. They’ve also fine-tuned their waste disposal routines faster than you can say “recycle.”

And the price for this waste fiasco? Kaiser agreed to a $49 million settlement, with a chunk of it ($37.5 million) going toward civil penalties. They also have to hire an independent auditor for future trash checks. The auditor will ensure that hazardous items and patient info aren’t having dumpster parties together.


Attorney General’s Two Cents

Rob Bonta, the Attorney General, chimed in to say, “The illegal disposal of hazardous and medical waste is a no-go. Kaiser, as a healthcare provider, should know better.” But he also quickly acknowledged that Kaiser didn’t just shove its head in the sand. They’ve been cooperating to get their waste management back on track.

So, what’s the lesson here, folks? Maybe it’s that even giants like Kaiser can trip up, but it’s never too late to get your act together—whether it’s your personal life or your dumpsters. Because, let’s face it, nobody wants their confidential medical history ending up in a landfill next to last week’s tuna casserole. 🗑️✅


Don’t Let Compliance Be Your Blind Spot—Abyde Has Your Back!

Navigating the maze of healthcare compliance can be like playing a never-ending game of Whac-A-Mole—just when you think you’ve tackled one issue, another one pops up. And let’s be honest; nobody wants to be the next headline for not properly securing their hazardous waste or protecting patient information. That’s where we come in! 🌟

Abyde specializes in HIPAA and OSHA Compliance solutions. We understand the nitty-gritty details that can keep healthcare administrators up at night, so you don’t have to. With our cutting-edge SAAS solutions, you can rest easy knowing you’re in full compliance with not just federal laws but also state-specific regulations.

Our comprehensive audits and easy-to-implement changes can help you avoid dumpster dives and sticky situations like the one Kaiser found itself in. We’re more than just a service; we’re a partner who takes your compliance seriously so you can focus on what really matters—providing exceptional healthcare.

So, if you’re looking for a superhero in the complex world of healthcare compliance, look no further. Abyde is the sidekick you didn’t know you needed but won’t be able to live without.

Till then, keep your dumpsters clean and your patient records cleaner! 🌱🗂️✨

RECENT POSTS

Related posts

Multi-Location HIPAA Security Risk Analysis
Abyde News, Best Practices, HIPAA

Location-Specific SRAs: A Must-Have for Healthcare Organizations

December 17, 2024 No comments yet

December 17, 2024 Keeping all locations in line with HIPAA regulations can be quite a challenge, especially when managing a multi-location practice. It’s a complex puzzle that requires careful attention to detail and a proactive approach to ensure compliance across the board. And we hate to break it to you, but a blanket Security Risk Analysis for your organization isn’t enough. A Security Risk Analysis, or SRA, is a thorough review of your organization’s physical, administrative, and technical safeguards to protect patient data. Even when you’re managing compliance at a single location within a multi-location organization, you are responsible for ensuring an SRA is completed for your location. The Office for Civil Rights (OCR) is serious about this requirement, as indicated by a recent significant fine. A penalty of over $500,000 was recently announced for the Children’s Hospital of Colorado system. While this investigation was sparked by a phishing attack, one of the major findings was missing SRAs for all locations. Completing this SRA is imperative. As the OCR spearheads new enforcement and initiatives, it’s time to get compliant.   What is a SRA? The SRA is an in-depth review of everything your practice does to ensure patient data is safe. This means everything from whether your practice utilizes alarms and codes on doors to the servers you use and even how your staff handles patient intake, like how the sign-in sheet process works. The SRA is the first step of a compliant practice because it allows you to review your vulnerabilities and make changes to uphold your commitment to keeping data safe. The SRA is also a requirement for MIPS. Unfortunately, the SRA is a commonly missed requirement for medical practices. In fact, 86% of all practices could not show an adequate SRA in the last round of random HIPAA audits. Completing a sufficient Security Risk Assessment (SRA) is essential for maintaining a compliant medical practice. This process is closely linked to the Office for Civil Rights (OCR) Risk Analysis Initiative, which mandates that medical practices and organizations carry out this required assessment. Recently, the Bryan County Ambulance Authority was fined $90,000 for failing to conduct an SRA, marking the first enforcement action under this new initiative. This incident demonstrates the OCR’s commitment to this initiative and its dedication of resources to ensure compliance.   Importance of Location-Specific SRAs When conducting a SRA, assessing every location within your organization is vital. While performing a single SRA for the entire entity might seem easier, compliance is more intricate and requires ongoing attention rather than being a one-off endeavor. Each location has distinct vulnerabilities that must be acknowledged and addressed. For instance, one location might have different vendors than another, and another location might be in an older building, with different security to keep Protected Health Information (PHI) safe. Although some overarching requirements may come from the main location, capturing each site’s specific conditions is essential. This thorough documentation demonstrates that every location takes compliance seriously, addresses vulnerabilities, and keeps patient data safe.   How to Complete an SRA With the right resources, managing and completing an SRA for a multi-location practice can be simplified. Organization is key: ensuring each location completes all SRAs and can be easily accessed in a centralized location. Your organization can efficiently complete this requirement by having a tailored set of questions for each location. To learn more about streamlining your multi-location SRAs for your organization, schedule a consultation with a HIPAA expert today.

Security Risk Analysis for MIPS
Abyde News, Best Practices, HIPAA

The Security Risk Analysis: Setting the Pace for MIPS and HIPAA Compliance

December 4, 2024 No comments yet

December 4, 2024 As a healthcare provider, tackling your daily to-do list probably feels like running a marathon without a finish line at times. You’re tasked with managing a successful business, keeping up with ever-changing legislation and new technology while ensuring that your top priority of patient care never falls behind. Despite the challenging course, there’s a benefit to keeping pace with both quantity and quality. Providers are rewarded for going the extra mile thanks to Value-Based payment programs like MIPS and other government incentives like the HIPAA Safe Harbor Law.  What is MIPS?  You’ve most likely heard of the Merit-based Incentive Payment System (MIPS) and might already be a participant in it. Whether it’s a Quality Payment Program or new legislation passed into law, the government continually emphasizes the importance of being proactive rather than reactive and providing incentives for doing so. This is why it’s valuable to know whether your organization is eligible to participate in government programs (you can check here). Many of these different program requirements align with the standards your practice already has to meet under HIPAA law—protecting your patients, checking off compliance requirements, and receiving incentives can often be done all in one stride.  To take a quick step back, MIPS is one of two payment tracks under the Medicare Quality Payment Program. The Centers for Medicare and Medicaid Services (CMS) uses this system to measure eligible clinician performance and reward high-value, low-cost care. MIPS participants can receive a payment adjustment to their Medicare reimbursements based on their performance scores across four different categories: Quality: The type of care you deliver based on specific measures of performance. Promoting Interoperability: Focuses on patient engagement and electronic exchange of information using Electronic Health Record (EHR) technology to improve patient access to their health information and exchange of information between providers. Improvement Activities: Your participation in clinical activities that work towards improving care coordination and patient engagement and safety. Cost: Assesses the cost of care you provide in relation to your Medicare claims. The Importance of the Security Risk Analysis (SRA) Before you can engage with the various performance measures, you must first meet a prerequisite for participating in the MIPS Promoting Interoperability performance category. This requirement is crucial not only for achieving HIPAA compliance but also for benefiting from other government incentives: the Security Risk Analysis (SRA). Conducting an SRA involves evaluating any potential risks to your organization’s electronic Protected Health Information (ePHI) and implementing necessary security updates and safeguards to address any identified vulnerabilities. Your organization must complete an SRA at least once a year to comply with MIPS and HIPAA standards. Additionally, it’s important to review and update the assessment regularly throughout the year to reflect any changes in your processes. Getting Compliant for MIPS Beginning your compliance journey can be overwhelming, but it is essential to take advantage of government initiatives such as MIPS. Intelligent software solutions can help keep your practice on track by outlining the requirements for HIPAA compliance and offering a streamlined SRA that meets MIPS standards. To learn more about how to become compliant for MIPS, schedule a meeting with a compliance expert today.  

The Price of Delay: A Costly HIPAA Lesson
Abyde News, Fines, HIPAA

The Price of Delay: A Costly HIPAA Lesson

December 2, 2024 No comments yet

December 2, 2024   Over a million dollars in HIPAA fines have been levied in the past few months, and like this winter’s snow, the fines continue to pile up, with a $100,000 fine recently announced.  Last week, Rio Hondo Community Mental Health Center, an outpatient program managed by the Los Angeles Department of Health, was fined for a Right of Access violation.  This marks the 51st enforcement of the Right of Access rule, highlighting the importance of handling patient records in a timely manner.    What Happened? A patient requested a copy of their records on March 18, 2020.  As we all know, March 2020 was marked by the beginning of the unprecedented COVID-19 virus, which led to the mental health center’s closure after the Governor of California put into action a “stay-at-home” order.  However, the center reopened at the beginning of May 2020, allowing some staff to return to the facility. While the patient was told her records would be ready at this time, she was misinformed and began the summer with a flurry of calls and other forms of contact to request her medical records.  After her requests were unfulfilled several times, the patient filed a complaint with the Office for Civil Rights (OCR) at the end of August 2020.  The OCR then began investigating the Rio Hondo at the beginning of October. The medical records were finally sent on October 20, 2020, 216 days after the first request.  The Right of Access rule requires Covered Entities to provide patients with their medical records within 30 days of the initial request.  While the medical center was under a “stay-at-home” order during those 30 days, this was still significantly longer than the extension period of an additional 30 days and could have been handled when it was first deemed safe for staff to return to the medical center.  This fine comes after a series of Right of Access fines, including another significant fine of $70,000 imposed at the end of October. The numerous fines issued this past year regarding the Right of Access initiative demonstrate the government’s commitment to this important aspect of patients’ rights.    Protect Your Practice from Costly Mistakes Even during the peak of the global health crisis, HIPAA regulations stayed in effect. Implementing software solutions can help safeguard your practice.  To ensure your staff remains compliant, it is highly recommended to use automated software that keeps you and your team in check, regardless of the circumstances. Schedule a consultation today to learn more about automated compliance for your practice. 

Looking to finish your SRA for MIPS by the Dec 31 deadline? We're here to help you get compliant in minutes.

SCHEDULE CONSULTATION
X