Office For Civil Rights

HHS Announces New Divisions Within the OCR
HIPAA, Legislation

HHS Announces New Divisions Within the OCR

March 14, 2023 Comments Off on HHS Announces New Divisions Within the OCR

March 14, 2023 EXTRA EXTRA READ ALL ABOUT IT!! The U.S. Department of Health and Human Services, through the Office for Civil Rights (OCR), announced the formation of a new Enforcement Division, Policy Division, and Strategic Planning Division. Why isn’t this front-page news? And why did the HHS need to form three new divisions? “OCR’s caseload has multiplied in recent years, increasing to over 51,000 complaints in 2022– an increase of 69 percent between 2017 and 2022,” said OCR Director Melanie Fontes Rainer. “…reorganization improves OCR’s ability to effectively respond to complaints, puts OCR in line with its peers’ structure, and moves OCR into the future.” The OCR will now reflect the structure set by the U.S. Department of Education’s Office for Civil Rights. The Strategic Planning Division will not only work to coordinate public outreach to protect civil rights and health information privacy. They will also expand data analytics and coordinate data collection across HHS leadership. With the OCR being proactive and educating the public on their rights, now would be the time to make sure you are being proactive with HIPAA. What is something to make sure you are staying compliant and one step ahead of the OCR?  How about your Security Risk Analysis or the “Crown Jewel” of the OCR as we like to call it. It’s the first thing the OCR asks for when they come knockin’. So why not beat them to the punch? You’ll identify and assess potential threats and vulnerabilities to protected health information (PHI), as well as evaluate the effectiveness of the organization’s security measures and policies. A HIPAA Security Risk Analysis is an ongoing process that must be regularly reviewed and updated to ensure that the organization remains in compliance. Guess what, here at Abyde we automate the entire process for you.  Extra, extra, HIPAA violations can result in severe consequences, including fines, legal action, and damage to a healthcare organization’s reputation. Therefore, it is critical for healthcare providers and organizations to prioritize HIPAA compliance and regularly review and update their policies and procedures to ensure they are in line with the latest regulations.

2022 New Office for Civil Rights Director
HIPAA, Legislation

The Department of Health and Human Services Appoints Melanie Fontes Rainer as the New Office for Civil Rights Director

September 19, 2022 Comments Off on The Department of Health and Human Services Appoints Melanie Fontes Rainer as the New Office for Civil Rights Director

September 19, 2022 Did you check the news??? There’s a new sheriff in town and her name is Melanie Fontes Rainer! Recently announced, the Department of Health and Human Services (HHS) has appointed former Acting Director, Melanie Fontes Rainer, as the new Director of the Office for Civil Rights (OCR). Fontes Rainer has extensive experience in her career, serving as an Acting Director for the OCR and before that Counselor to Secretary Becerra.  Secretary Becerra stated, “Melanie has devoted her entire professional career to public service and has worked tirelessly to ensure that health care is accessible, affordable, and available to all, no matter where you live or who you are.” Fontes Rainer brings over 10 years of experience in civil rights, healthcare policy, and patient privacy. She was also involved in the 21st Century Cures Act, the Affordable Care Act, and the No Suprise Act. Fontes Rainer took part in ground-breaking settlements and created the first office that focused on health care rights and access in California. Melanie’s background, combined with her passion, will prepare her for the challenges she will face in her new role as OCR Director.  It is important to take into account that after Lisa J. Pino, former OCR Director, was appointed last year, we saw a surge in enforcement cases right away. Only a few months into Pino’s appointment as director, the OCR announced five Right of Access settlements in one day. This year we have already seen 17 including a record-breaking day with 11 settlements announced in just one day alone. With settlements totaling $1,992,140 already in 2022, the OCR clearly isn’t done yet. As we can see, between HIPAA violations, cybersecurity issues, and personal information privacy, practices continue to face challenges this year. But we can also see that Fontes Rainer is here to help, bringing years of expertise and fiery passion to the table. She enforces healthcare regulations, promotes healthy practice operations, and protects patient health information across the country. With years of dedication to civil rights and medical privacy, we can definitely expect to see a lot of settlements surfacing with Fontes Rainer in town.  

OCR Announces Eleven HIPAA Right of Access Fines
Fines, HIPAA

OCR Announces Eleven More HIPAA Right of Access Settlements

July 18, 2022 Comments Off on OCR Announces Eleven More HIPAA Right of Access Settlements

July 18, 2022 Waking up every morning is an eye-opening experience. Do you know what else is an eye-opening experience? Waking up to see all of the enforcement investigations the OCR launched against practices like yours. The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced the completion of eleven investigations in its Health Insurance Portability and Accountability Act (HIPAA) Right of Access Initiative. Under the HIPAA Privacy Rule, the OCR launched this effort to assist individuals’ right to timely access to their health records at a reasonable cost. HIPAA provides individuals with the right to view and get copies of their health information from their healthcare providers and health plans. A HIPAA-regulated entity has 30 days after receiving a request to provide an individual or their representative with their records in a timely manner. OCR Director, Lisa J. Pino, states, “Health care organizations should take note that there are now 38 enforcement actions in our Right of Access Initiative and understand that OCR is serious about upholding the law and peoples’ fundamental right to timely access to their medical records.”  Practices are no longer sneaking under the radar! The Office for Civil Rights (OCR) just concluded its thirty-eighth enforcement action since the HIPAA Right of Access Initiative began in 2019. Totaling over $646,000 across eleven penalties, the announcement of the verdicts includes eleven cases. Here is a brief breakdown of a couple of the cases just released by HHS:  The first dental action includes a $5,000 settlement for failure to comply with the Right of Access provision stating covered entities must permit individuals to inspect and obtain a copy of their PHI. An eye care practice made the mistake of not providing a copy of a patient’s medical records until three days after the OCR investigated. Now that is crazy! To settle a potential violation of the HIPAA Privacy Rule right of access standard, the practice agreed to take corrective actions and pay $22,500. Something as simple as not giving your patients access to their data quickly enough can result in a huge fine! One not-for-profit health system learned the hard way by not responding timely enough to a complainant’s access request. This cost the health system a whopping $240,000!  So, whether it’s responding to a request or delivering that request on time, you need to make sure your practice is on point to avoid these heavy penalties. As we can see the queen bee (Lisa Pino) isn’t joking around on pushing the OCR’s  HIPAA Right of Access Initiative across practices, we encourage you to ensure you have the right HIPAA compliance measures in place. So what’s the holdup? For less than a scratch-off ticket a day you can save your practice from those sneaky fines and become friends with Abyde today!

OCR HIPAA Budget Proposal
HIPAA, Legislation

MORE MONEY, MORE PROBLEMS? OCR Budget Proposal Will Result in Greater Enforcement and More Fines

May 16, 2022 Comments Off on MORE MONEY, MORE PROBLEMS? OCR Budget Proposal Will Result in Greater Enforcement and More Fines

May 16, 2022 If you think the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) isn’t zeroed in on compliance, think again. OCR recently announced its request for a 55% increase in its overall funding, for a total of $60.2 million for the 2023 fiscal year. While this number may seem shocking, their plans for the money may make your jaw drop.  Let’s take a look at why the increase is needed.  Nearly 46,000 complaints were received in FY 2021, a dramatic increase from nearly 2,000 in 2003. Just this year, they’re expecting more than 28,000 related strictly to HIPAA. OCR states, “given the trend in complaints to OCR as well as the priorities articulated by the Administration, OCR anticipates a significant increase in the number of civil rights, information breaches, and cybersecurity complaints.” OCR opens an investigation for any breach that affects more than 500 people. In 2021, there were 714 of those instances, more than 30% growth over the last two years. Currently, OCR is limited to how many of these they can conduct a full investigation on. Imagine how powerful this could be if granted the resources to execute the necessary amount?! In addition, OCR is looking to add more regional investigators to address the backlog of existing complaints. With a goal of clearing the backlog by FY 2026, $8 million will be allocated to address the existing complaint inventory. OCR supports adding new regional investigators to “resolve new civil rights and HIPAA cases, address the backlog of complaints, and initiate compliance reviews in the Administration’s priority areas.” With a staff of 77 in 2020, they plan to add an additional 37 investigators and supervisory investigators in FY 2023. The budget accounts for a total increase of 64%, equating to 91 new employees. More staff could mean more knocks on your door!  Still think that you’re the one that got (or will get) away?! This next bit is for you. Increasing fines and the institution of injunctive relief are more immediate than 2023.  Not sure what a HIPAA violation could cost you? Don’t go get a tattoo of these any time soon – OCR is requesting increases based on a federal court evaluation. In 2019, then-OCR Director Roger Severino published a “notice of enforcement discretion” complementing the HITECH Act basing violation amounts on the party’s awareness and fault. While you could imagine this leaves some room for interpretation, the tiered fine structure will remain in place. Changing lanes, Injunctive relief essentially restrains a party from a certain action. OCR regulator, Adam Greene openly notes the HITECH Act “provides attorneys general with authority to seek injunctive relief.” Green continues to state, “If OCR were given authority to obtain injunctive relief, then it could require entities to take or discontinue actions –such as by requiring an entity to provide an individual with access to records or to discontinue a use or disclosure of protected health information – rather than only being able to penalize the entity after an act or omission occurs.” If you still aren’t convinced that OCR means business, let’s wrap up with a summary of what their request for extra dollar signs means for you. An increase in budget simply equates to an increase in resources – more employees to not only attack the existing backlog but the ability to complete more in-depth and frequent investigations. Higher fines and more meaningful corrective action plans mean greater penalties and violation costs. We hope you take your compliance seriously, OCR certainly is! Let us navigate these upcoming changes with you – from our simple software to our readily available education, we will be your companion in confidence that you are set up for any OCR changes that come our way.   

Asset Log HIPAA
Best Practices, Cybersecurity, HIPAA

OCR Highlights Asset Log as Key HIPAA Recommendation

August 25, 2020 Comments Off on OCR Highlights Asset Log as Key HIPAA Recommendation

August 25, 2020 Earlier today, the Office for Civil Rights (OCR) sent out their seasonal Cybersecurity Newsletter on a very timely and relevant topic – the importance of keeping track of devices that contain electronic protected health information (ePHI). The OCR’s newsletter highlights two important things for independent practices: first, that having an asset log is the recommended method for tracking and thus safeguarding devices that contain ePHI, and second, that the OCR views practice’s lack of knowledge around where their devices are as a key area of concern. Part of the HIPAA Security Rule, practices are required to implement the necessary technical safeguards covered in the Security Risk Analysis (SRA) – including encrypting and securing their devices that contain sensitive ePHI. While an asset log isn’t directly required under HIPAA, the OCR highly recommends the creation and maintenance of an IT asset inventory to better understand where ePHI may be stored and strengthen overall compliance with these requirements.  What does an Asset Log entail? We know it’s hard to keep tabs on everything within your practice, but when it comes to your devices keeping inventory is key. As the OCR’s newsletter highlights, the asset log should be a comprehensive list of all IT assets with corresponding descriptive information. The OCR notes that this list could include ALL devices, even those that don’t access ePHI directly, as they could contain ePHI unknowingly or be an entry point for cyberattackers to your network. Your list should include: When documenting these assets, Abyde recommends including all the following information:  Additionally, it is important to regularly update your asset log as devices are moved around by location or by assigned staff members. Just like an SRA, your asset log should not be a ‘one and done’ project, and should instead be reviewed regularly. You should also track when devices are disposed of, as properly disposing of devices that contain ePHI is a common cause of HIPAA violations.  No matter the size of your practice, creating and maintaining a thorough asset log isn’t an easy task. With a program like Abyde, our built in Asset Log covers all the OCR recommendations and then some – helping you track devices at high risk and making your IT inventory intuitive. Having the ability to access your asset log within a cloud-based solution like Abyde makes reviewing and updating inventory a breeze, and helps ensure you’re complying with all the right technical safeguards.  

Concerned about HIPAA & OSHA compliance requirements in 2025? Join our live webinar for expert answers to the most common questions to ensure your practice is protected.

REGISTER TODAY
X