Privacy Rule

$5.1 Million Dollar HIPAA Fine
Fines, HIPAA

OCR Announces 2nd HIPAA Settlement of 2021 with Health Insurer for $5.1 Million

January 15, 2021 Comments Off on OCR Announces 2nd HIPAA Settlement of 2021 with Health Insurer for $5.1 Million

January 15, 2021 Buckle your seatbelts – it’s only 15 days into 2021 and it’s already looking like this year will be a wild ride when it comes to HIPAA enforcement. The Office for Civil Rights (OCR) just announced another HIPAA settlement (and a doozy at that), bringing in not one but TWO fines just this week.   The latest (and greatest) HIPAA fine of 2021 was just awarded to Excellus Health Plan, Inc., a health insurance provider serving over 1.5 million people in New York. The settlement includes a whopping $5.1 million fine and a 2-year corrective action plan, the result of cyber attack affecting more than 9 million records along with a slew of other HIPAA Privacy and Security Rule violations. Fun fact: the OCR didn’t reach $5 million in total fines levied until September of last year, and today’s announcement means they’ve already exceeded the $5 million mark just 15 days into 2021 – talk about starting the year off strong!   Excellus’ story all started when the OCR received a breach report on September 9, 2015 that cyber-attackers had gained access to Excellus Health Plan’s information technology systems. Of note with this particular breach story is that the hackers in Excellus’ case were accessing their systems so long, they not only set up shop but practically built a whole mall to go with it – hanging out in the health plans’ database from December 23, 2013 allllll the way until May 11, 2015 – an entire year and a half.  Their overextended stay allowed the hackers to install malware in addition to other malicious activities that provided unauthorized access to the protected health information (PHI) of over 9.3 million individuals – improperly accessing everything from names, to addresses, social security numbers, financial information and clinical treatment information.  If having hackers in your IT system for almost 2 years wasn’t bad enough, the OCR also found that Excellus had violated some pretty important HIPAA rules, including:  As a great example of what NOT to do when it comes to your HIPAA and technical security programs, today’s fine also offered words of wisdom from the OCR: “Hacking continues to be the greatest threat to the privacy and security of individuals’ health information. In this case, a health plan did not stop hackers from roaming inside its health record system undetected for over a year which endangered the privacy of millions of its beneficiaries,” said OCR Director Roger Severino. “We know that the most dangerous hackers are sophisticated, patient, and persistent. Health care entities need to step up their game to protect the privacy of people’s health information from this growing threat.”    One positive when it comes to increasingly concerning cyberthreats? The recently passed HIPAA Safe Harbor Bill offers your practice the chance to receive smaller HIPAA fines (even more important with the whopping $5.1 million precedent just set) IF you have the necessary safeguards in place 12 months BEFORE a cyber event. Even though data breaches and hacking incidents aren’t always in your control, practice’s preparation beforehand is – and could mean the difference between a smaller, manageable fine and ranking among the top 10 greatest hits on the OCR’s fine list.    

Privacy Rule HIPAA
HIPAA, Legislation

HIPAA Building Blocks: The Privacy Rule

November 24, 2020 Comments Off on HIPAA Building Blocks: The Privacy Rule

November 24, 2020 Implementing a complete HIPAA program is kind of like assembling a piece of furniture from IKEA – there’s lots of different pieces and little direction when putting it all together. Even if you’re a master IKEA-assembler, HIPAA is a whole extra level of confusion, and breaking it down into the basics can help make things a little less stressful.  The first step in building a complete HIPAA compliance program is to start with the base – the HIPAA Security Rule. Once you have a sturdy foundation made up of all of the proper documentation and required safeguards, it’s onto step number two: otherwise known as the HIPAA Privacy Rule. Many of the nuts and bolts of HIPAA law are built into the HIPAA Privacy Rule, which provides strong privacy protections to safeguard sensitive patient information and ensure patients have proper access to their own medical records. Thanks to the Privacy Rule:    Record access and privacy are the basic goals behind the Privacy Rule, but the second piece of the rule includes an extensive list of ongoing compliance requirements, such as:  Just like opening up that new box from IKEA, taking on a complete HIPAA compliance program can feel overwhelming. However, Privacy Rule complaints continue to roll in to the Office for Civil Rights (OCR) and patient right of access violations have become an increasing point of OCR focus since 2019 – making compliance with the Privacy Rule a top HIPAA priority. Now unless you’re a DIY enthusiast, you might opt for new furniture that doesn’t come in a 1,000 different pieces. Choosing a pre-assembled option instead saves you time, energy, and headaches – and the same can be said of HIPAA.  Choosing a HIPAA compliance software like Abyde lets you fill in a few quick areas to get your program up to speed, instead of having to build each piece from scratch. In less than an hour, and with far less headaches, you can get everything you need to be compliant, and so much more. The best part? There’s no need for an instruction manual – Abyde has real people ready and waiting to help walk you through the process and make sure you aren’t missing any important pieces (like finding that missing screw from step 7 on step 28) along the way. 

When Sharing PHI is HIPAA Approved
HIPAA

Should I Share This? When Sharing PHI is HIPAA Approved

June 18, 2020 Comments Off on Should I Share This? When Sharing PHI is HIPAA Approved

June 18, 2020 We get it, the struggle is real. The moans and groans with HIPAA always seem to get louder when medical practices are faced with figuring out to whom and how sensitive data can be shared. Contrary to what many believe, HIPAA is all about properly sharing protected health information (PHI) – not preventing it entirely. Sometimes, lacking confidence that internal policies are in alignment with best practices on sharing PHI securely can cause a practice to hesitate to (or altogether not) send PHI to other parties requesting it, including other providers. Unfortunately, not acting in a timely manner and failing to comply with the request to share PHI with another provider can be a costly one. Proper disclosure of PHI is highly regulated under HIPAA when it comes to sharing or receiving patient records from another practice, and there are consequences to both sharing too much information – or not enough. First, the HIPAA Privacy Rule does in fact permit a health care provider to share patient information for treatment and healthcare operation purposes without needing written patient authorization as long as the reasonable safeguards to protect the information are used. To clarify what the U.S. Department of Health and Human Services (HHS) considers as treatment and operation purposes, “Treatment means the provision, coordination, or management of healthcare and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.”  Some key notes on sharing PHI between providers:  Additionally, if a patient is the one requesting their records to be sent to another provider: It’s time for providers to change their perspective on HIPAA – which is widely considered a restrictive set of laws and regulations. HIPAA is meant to be a guideline on how to securely and efficiently share sensitive and valuable data. Not a barrier or inhibitor as so many see it now. Being able to do so will have positive effects on the healthcare industry as a whole and improve patient care for years and years. Don’t let the unknowns of HIPAA keep data from those who have lawful access to them such as other providers or patients. If so, it is just as much of a HIPAA violation as sharing sensitive data with the wrong people.

Are you prepared for OSHA's Workplace Violence Prevention requirements? Learn what you need to do to be compliant.

DOWNLOAD CHECKLIST
X