April 17, 2024 Imagine this: it’s a quiet Wednesday morning at the practice. As you’re watching the clock tick criminally slow to lunch hour, you check your email. It looks like your boss sent you an email! He wants you to print out the attached file. You absent-mindedly click on the file, and your once quiet morning is completely flipped on its head. The email was a phishing scam! If you looked a bit harder, you would have noticed it didn’t actually come from your boss, but an unknown suspicious email. The malware begins to infect your computer, starting to wreak havoc. What are you going to do? Email phishing scams are a common example of a breach, exposing patient data. Other forms of breaches include: stolen laptops, improper disposal of PHI, and overall, any time unauthorized access to sensitive patient data. Breaches, unfortunately, happen pretty often, affecting millions of patients. In 2023, over 133 MILLION patients’ information was exposed in breaches. What’s the HIPAA Breach Notification Rule? Now that we’ve painted a scary picture, let’s talk about what you can do. This is where HIPAA’s Breach Notification Rule comes in. The Breach Notification Rule is one of the pillars of HIPAA and guides Covered Entities (CEs) and Business Associates (BAs) when it comes to breaches. It mandates required information about a breach and how patients need to be notified of their exposed data. What Should I Do? Well, first, don’t panic! Time is of the essence when it comes to a breach. Here’s a step-by-step guide on what to do if you suspect a data breach: 1.Contain the Breach: First things first, stop the attack! If dealing with a cyber attack, like an email phishing scheme, disconnect the infected computer immediately, so it can’t spread the nasty virus to other computers on the network. Report the incident to your IT department or IT partner immediately. 2. Investigate the Breach: Time to play a bit of Sherlock Holmes and investigate the attack. What data was accessed or potentially accessed? How many individuals are potentially affected? How did the breach occur? All of these questions are vital when it comes to reporting this breach and notifying patients. In the Abyde software, we have our breach log, a quick questionnaire for you to organize your investigation.Notification Requirements: Depending on the severity of the breach, notifications may need to be sent to several parties: 3. Notification Requirements: Depending on the severity of the breach, notifications may need to be sent to several parties: 4. Mitigation and Prevention: Well, hopefully, that never happens again! Now, it’s time to take steps to prevent similar breaches in the future. This involves: How Abyde Can Help Mitigating breaches and protecting patient privacy can be daunting. Abyde can help! We offer a plethora of resources on compliance and data security best practices. As discussed above, Abyde assists with every step of the breach process, from proactively identifying risks and vulnerabilities with the Security Risk Analysis, to training, to breach logs. Want to learn more about how Abyde can help you Never Stress Over Compliance Again? Email info@abyde.com, and schedule a compliance consultation here and here for Business Associates.
What’s HIPAA? What’s OSHA? What’s the Difference?
April 11, 2024 Now, when you work in healthcare, you’re not only responsible for the care of patients but also a slew of compliance regulations. Sometimes, it can be confusing and overwhelming. The world of healthcare throws a whole lot of acronyms and regulations your way. HIPAA? OSHA? What do they mean? Well, don’t worry, this isn’t a pop quiz. We’re here to shed some light on these common compliance regulations and what they mean for your practice or business. HIPAA: Hip Hip Hooray for Patient Privacy First, if you are a Covered Entity (CE) or Business Associate (BA), you have most likely heard of HIPAA. HIPAA, or the Health Insurance Portability and Accountability Act guides how the Protected Health Information (PHI) of patients must be secure and safe. HIPAA also establishes the standards for how this sensitive health information is exchanged. HIPAA was signed into law by Bill Clinton almost 30 years ago, in 1996. HIPAA was established as we made major technological strides. As technology continued to advance and was making its way into healthcare, with ePHI, or electronic Protected Health Information, it was time for legislation to be put in place. HIPAA is composed of three key components: the Privacy Rule, the Security Rule, and the Breach Notification Rule. There is also the HIPAA Omnibus Rule of 2013, which expanded the definition of Business Associates, encompassing all that create, receive, or transport PHI on behalf of a Covered Entity. HIPAA regulations are enforced by the Office For Civil Rights (OCR), under the HHS. HIPAA violations can incur major monetary penalties and monitoring of a practice or business by the government. These fines can cost millions of dollars, so your practice must be HIPAA compliant! OSHA: Oh shucks, Little ol’ me? With OSHA in Healthcare, we flip the script from HIPAA. Instead of focusing on patients, it’s about you! Healthcare workers and Business Associates, or under OSHA, known as third-party vendors, falling under Joint Responsibility, are protected by this federal legislation. OSHA, or the Occupational Safety and Health Administration was established when the OSH ACT was signed by Richard Nixon on December 29, 1970. The administration itself was enacted as a result of this legislation, opening April 28, 1971. This workers’ rights legislation came at a time when there were limited protections for employees, and this federal law granted protection to employees from all industries. OSHA encompasses much more than just healthcare, providing legislation and regulation to every industry you can think of: from factories to construction sites, to even offices. OSHA is very prevalent in healthcare, ensuring employees feel safe and protected in their practice. For instance, common OSHA healthcare concerns include proper PPE (Personal Protective Equipment), handling sharps, and potential exposure to bloodborne pathogens. Different from HIPAA, since OSHA is an administration rather than just a law, OSHA enforces its regulations. OSHA enforcement can also cost a pretty penny: costing thousands per violation, with repeated violations going up to over $160,000. How Abyde Can Help Well, that was a lot of compliance talk! HIPAA and OSHA are two very important compliance regulations that protect both patients and employees. While compliance might feel like an added responsibility, it’s vital for the protection and safety of everyone. Without HIPAA and OSHA, patients’ privacy wouldn’t be protected and employees wouldn’t have safety and health standards in the workplace! At Abyde, we simplify the compliance process, offering HIPAA and OSHA solutions. We even make it easy. We know that this compliance jargon and rules can be stressful, so our mission is to have practices and businesses Never Stress Over Compliance Again. We offer streamlined documentation, dynamically generated for your organization. We turned the daunting Security Risk Analysis or Facility Risk Assessment for OSHA into a minutes-long questionnaire. We also provide entertaining training that equips employees with the knowledge they need. Abyde offers many more resources to keep you on your compliance A-game. To learn more about what you need for compliance, email us at info@abyde.com and schedule a consultation here for Covered Entities and here for Business Associates.
HHS’s Recent HIPAA Guidance on Telehealth and Public Health Emergency Expiration
July 11, 2022 Think you finally got the hang of telehealth? Don’t get too comfy just yet! The OCR recently released guidelines on how covered health care providers and health plans should utilize their remote communication technology to deliver audio-only telehealth services while also complying with HIPAA requirements. Why is Telehealth important? Let’s start at the beginning. Telehealth contributes to increasing a practice’s value and security by expanding access to health care across the nation and providing certain users who have difficulty using audio and video telehealth technologies. When systems are not properly secured, they pose risks to patient safety, health, and data. Cyberattacks and ransomware are extremely common in Telehealth and may quickly create issues that disclose medical information and other sensitive information. As a practice, it is critical and worthwhile to maintain excellent Telehealth especially now a days with the increased funding and resources the OCR has available. OCR Director, Lisa J. Pino, states, “Audio telehealth is an important tool to reach patients in rural communities, individuals with disabilities, and others seeking the convenience of remote options. This guidance explains how the HIPAA Rules permit health care providers and plans to offer audio telehealth while protecting the privacy and security of individuals’ health information.” With the OCR’s Telehealth Notification system possibly being taken down as early as July 15th, 2022, we recommend that practices stay alert and take every precaution by using your friendly, easy to use HIPAA-compliant software (hint Abyde) to assure full compliance today. The first step in remaining alert is to follow the guidance issued by the OCR in response to the recent news that the Telehealth Notification system may be shut down. The guidance below specifies the conditions under which telehealth may be utilized. The HHS is authorizing HIPAA-covered businesses to conduct telehealth and audio-only services using remote communication technology. However, these services must be provided in a private environment to the best of the entity’s abilities, and the individual’s identification must be verified. Even though HIPAA does not apply to audio-only telehealth services delivered through electronic communication methods, when offering telehealth services through mobile devices or applications, practices may face HIPAA compliance issues. Therefore, practices should identify all potential risks and vulnerabilities to PHI confidentiality as part of the risk analysis process prior to the completion of the PHE. Abyde will do anything possible to make sure you’re on top of your compliance game because the OCR may show up at any time! Allow us to guide you through these future changes – from our incredibly simple software to our readily available education, we will be your buddy in ensuring that you are prepared for any obstacles that show up at your door.
MORE MONEY, MORE PROBLEMS? OCR Budget Proposal Will Result in Greater Enforcement and More Fines
May 16, 2022 If you think the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) isn’t zeroed in on compliance, think again. OCR recently announced its request for a 55% increase in its overall funding, for a total of $60.2 million for the 2023 fiscal year. While this number may seem shocking, their plans for the money may make your jaw drop. Let’s take a look at why the increase is needed. Nearly 46,000 complaints were received in FY 2021, a dramatic increase from nearly 2,000 in 2003. Just this year, they’re expecting more than 28,000 related strictly to HIPAA. OCR states, “given the trend in complaints to OCR as well as the priorities articulated by the Administration, OCR anticipates a significant increase in the number of civil rights, information breaches, and cybersecurity complaints.” OCR opens an investigation for any breach that affects more than 500 people. In 2021, there were 714 of those instances, more than 30% growth over the last two years. Currently, OCR is limited to how many of these they can conduct a full investigation on. Imagine how powerful this could be if granted the resources to execute the necessary amount?! In addition, OCR is looking to add more regional investigators to address the backlog of existing complaints. With a goal of clearing the backlog by FY 2026, $8 million will be allocated to address the existing complaint inventory. OCR supports adding new regional investigators to “resolve new civil rights and HIPAA cases, address the backlog of complaints, and initiate compliance reviews in the Administration’s priority areas.” With a staff of 77 in 2020, they plan to add an additional 37 investigators and supervisory investigators in FY 2023. The budget accounts for a total increase of 64%, equating to 91 new employees. More staff could mean more knocks on your door! Still think that you’re the one that got (or will get) away?! This next bit is for you. Increasing fines and the institution of injunctive relief are more immediate than 2023. Not sure what a HIPAA violation could cost you? Don’t go get a tattoo of these any time soon – OCR is requesting increases based on a federal court evaluation. In 2019, then-OCR Director Roger Severino published a “notice of enforcement discretion” complementing the HITECH Act basing violation amounts on the party’s awareness and fault. While you could imagine this leaves some room for interpretation, the tiered fine structure will remain in place. Changing lanes, Injunctive relief essentially restrains a party from a certain action. OCR regulator, Adam Greene openly notes the HITECH Act “provides attorneys general with authority to seek injunctive relief.” Green continues to state, “If OCR were given authority to obtain injunctive relief, then it could require entities to take or discontinue actions –such as by requiring an entity to provide an individual with access to records or to discontinue a use or disclosure of protected health information – rather than only being able to penalize the entity after an act or omission occurs.” If you still aren’t convinced that OCR means business, let’s wrap up with a summary of what their request for extra dollar signs means for you. An increase in budget simply equates to an increase in resources – more employees to not only attack the existing backlog but the ability to complete more in-depth and frequent investigations. Higher fines and more meaningful corrective action plans mean greater penalties and violation costs. We hope you take your compliance seriously, OCR certainly is! Let us navigate these upcoming changes with you – from our simple software to our readily available education, we will be your companion in confidence that you are set up for any OCR changes that come our way.
What is the HITECH Act and How Does it Relate to HIPAA?
January 28, 2021 Trying to understand all of the complicated rules and regulations your practice needs to follow can sometimes feel like keeping up with the Joneses – but HIPAA isn’t the only compliance rulebook your practice needs to follow, and other laws (both new and old) impact your practice operations and your HIPAA compliance program – enter the HITECH Act. Whether it’s your first time visiting our news page (welcome!) or you’re a regular reader (welcome back!) you might’ve seen last week’s article covering the new HIPAA Safe Harbor bill that offers practices reduced HIPAA fines IF they have reasonable security safeguards already in place before a breach. The bill amends the HITECH Act to incorporate this change, but if you aren’t even sure what the HITECH Act really is, let’s take a step back and cover what the Act means for you and where these new changes come into play. The What The ‘Health Information Technology for Economic and Clinical Health’ Act, or HITECH Act (much easier to say), was signed into law way back in 2009 to essentially promote the implementation of health information technology, specifically the use of electronic health records (EHRs), by healthcare providers. Transitioning from paper to electronic records was (and still is) time-consuming and costly, and the HITECH act provided incentives for making the switch – while also ensuring that healthcare organizations along with their business associates remained in line with HIPAA law as they upgraded their systems. The Why So you might be thinking – well doesn’t HIPAA law already promote the secure usage of EHR’s? You’re right (high five!) but the HITECH Act goes one step further and expands the enforcement and strength of HIPAA regulations related to technical requirements within the HIPAA Privacy and Security Rules. Thanks to the HITECH Act, violation tiers were introduced, increasing financial penalties for HIPAA violations and ultimately giving the Office for Civil Rights (OCR) more money in the bank to go after non-compliant covered entities. The HITECH act was also designed to answer questions around how to offer the same HIPAA protections to electronic protected health information (ePHI), not just physical PHI, as practices went digital. This included: Where the HIPAA Safe Harbor Bill Fits In Fast forward to 2021, and all the same needs the HITECH act was introduced to fill still apply. However, the newly signed HIPAA Safe Harbor Bill helps to reinforce the value of these security measures with the new incentives offered and opportunity for reduced fines – and it’s one of the few pieces of new legislation you should actually feel GOOD about! So whether it’s HIPAA, HITECH, or the brand new Safe Harbor Bill – understanding and complying with each and every one of their requirements is essential to protecting your patients. Still not quite sure about what’s required? Don’t sweat it! Schedule a free consult with one of our HIPAA experts today to ensure you’re up to speed.
What is the New HIPAA Safe Harbor Law?
January 14, 2021 There’s a lot of legislative changes coming in 2021 (including changes to the HIPAA Privacy Rule) that affect your practice’s HIPAA program, but there’s at least one change we think you should be pretty thrilled about. We’re usually pretty happy about HIPAA (we know, we’re weird, but we’ve accepted it) – but what should make your practice just as happy? Well, after an unprecedented year of cyber threats and HIPAA enforcement, recently ratified changes to the HITECH Act include some really good news – reduced HIPAA fines and penalties for data breaches if practices have proper security measures in place. What Changed HR 7898, or the HIPAA Safe Harbor Bill, was officially signed on January 5th, 2021, and amends the HITECH act to require the Department of Health and Human Services (HHS) to take into account if practices have “recognized cybersecurity practices” in place when investigating a data breach, and to be lenient with their fines or other enforcement actions if the practice has met all the basic technical safeguard requirements. Translation: if you have the right HIPAA Security Rule basics down, and appropriate technical safeguards to mitigate your identified threats, you’ll be able to stress less when a breach occurs – and see a lot fewer $$$ from the HHS. See why it’s not just us that should be happy about this one? What Else to Know So smaller fines is a major plus – but what’s the fine print? Like any law, there are a few caveats to make sure your practice gets to enjoy these incentives: The next question – what does “recognized cybersecurity practices” mean? What to do NOW To put it frankly, if you don’t have the required security standards in place already – it’s time to get a move on. Implementing these recognized security practice’s could mean the difference between a hefty fine or enforcement effort in the case that your practice ever falls victim to a data breach or other HIPAA violation – which is often out of your control. What’s really important about this law change is that having some cyber security measures in place does not cut it – if you don’t have the specific measures required under the HIPAA Security Rule (that Security Risk Analysis, documentation, and more) you will not meet the requirements outlined in HR 7898. This is another way compliance and security go hand in hand – and to get the benefits of reduced fines, you’ll need both.
The 21st Century Cures Act: What Your Practice Needs to Know
September 24, 2020 Technology is increasingly at the heart of healthcare, and navigating all this new technology, including providing the right electronic access to protected health information (PHI), to the right people, can be headache-inducing. The cure? The recently passed 21st Century Cures Act (see what we did there?) which provides new requirements and guidance around the exchange, access, and use of electronic protected health information (ePHI). The Cures Act’s requirements are set to go into effect on November 2, 2020 – read on for what your practice needs to know before then. What is the Cures Act, anyway? A complement to existing HIPAA laws, the Cures Act is designed to further outline how practices and healthcare app providers should be navigating the balance between providing patients access to their ePHI while maintaining their data privacy and security. In short, it provides patients clear access to their data – in the ways they choose to receive it – while outlining clear requirements for providers and app developers to promote patient access and prevent information blocking all with the right technical safeguards to protect health information. So what’s changed? The Cures Act does make some specific changes that may affect your healthcare operations, including: What do I need to do about it? The final rule establishes additional policies that supplement existing HIPAA programs. To best comply with these new requirements, your practice should: The biggest takeaway from all this? HIPAA. Doesn’t. Change. All the same safeguards and policies you have in place still apply under the Cures Act – they are just supplemented by new ways to better use patient data and prevent information blocking. These new standards of innovation mean that patients can soon access their medical records on hand (literally) through their app of choice, and will continue to pave the way for HIPAA to interact with advancing technology. You can read more on the Cures Act by visiting the ONC Cures Act website, or reading through the full Cures Act final rule text (if you do, we would be seriously impressed – but before you read all 320 pages, know that the Abyde team is here to help translate all this legal-ese into something that actually makes, well, sense.)
Updates to HIPAA & Telehealth During COVID-19
March 18, 2020 Amidst the current national public health emergency for COVID-19 or the Novel Coronavirus, the OCR has released a bulletin regarding the increased use of telehealth services among the medical community. In addition to the bulletin, during a press conference held yesterday, the OCR acknowledged the need for healthcare providers to seek remote communications with their patients and understand that these technologies may not be fully compliant with standard HIPAA regulations. “We are empowering medical providers to serve patients wherever they are during this national public health emergency.” OCR Director Roger Severino emphasized in a statement, “We are especially concerned about reaching those most at risk, including older persons and persons with disabilities.” Under this update, any healthcare provider has the ability to use any non-public remote communication technology to provide telehealth services. This enforcement discretion applies to telehealth services needed for any reason, not strictly for the diagnosis or treatment of the COVID-19 related health conditions. During this time, the OCR will not impose violations for any noncompliance against healthcare providers under the good faith provision of telehealth during this national emergency. This provision also allows healthcare providers to defer to their own judgment in requesting to examine a patient showing potential COVID-19 symptoms using technology such as video chat applications. This allows providers to assess a larger number of patients as well as limit the risk associated with being exposed to the virus during an in-person consultation. The telehealth services can be provided on any non-public facing communication applications without facing noncompliance penalties. Some acceptable applications include: Other similar video communication methods such as Facebook Live are considered public-facing and should not be used in the provision of telehealth. Health providers can seek additional privacy protections by providing telehealth services through technology vendors that are HIPAA compliant. They can enter into business associate agreements with these vendors in the provision of their video communication products. Some of the vendors that offer HIPAA-compliant video communication services include: While there will not be any enforcement of HIPAA noncompliance for providers choosing to utilize these methods of communication, it is important to still understand the security risks associated. The OCR recommends that providers notify patients when using these third party applications for these services as they potentially introduce privacy risks and any available encryption and privacy settings should be implemented during use. If as a provider you already have a HIPAA-compliant and secure telehealth application, it is still recommended to use the most secure application available to you. Even during a public health crisis, HIPAA law still applies and includes specific caveats for sharing PHI in such an emergency. Read our blog article on Handling HIPAA During Public Health Emergencies for more information.