Failing to implement HIPAA causes a large fine for a small town North Carolina health services provider. They were fined $25,000 for multiple, easily avoidable, HIPAA violations for “longstanding, systemic noncompliance” with the HIPAA Security Rule. [Note: The provider is a part of a health center which offers discounted medical services to the underserved population in rural NC, and the fines were reduced in consideration of this, but it still resulted in a significant monetary loss].
In 2011, Metropolitan Community Health Services (Metro), doing business as Agape Health Services, filed a breach report regarding “the impermissible disclosure of protected health information to an unknown email account.” The breach affected over 1,200 patients!
In addition to the large monetary penalty, the practice is required to develop and adopt a corrective action plan (which includes two years of thorough monitoring) after the Office for Civil Rights (OCR) discovered that Metro failed to conduct a thorough and comprehensive HIPAA Security Risk Assessment and Analysis. In addition, Metro did not implement a single HIPAA Security Rule Policy and Procedure for the health center. Possibly worst of all, Metro failed to provide workforce members with HIPAA Privacy and Security Awareness training until 2016!
Patients must trust who they share their personal, private, and protected health information with. A breach such as this, is obviously devastating for the patient, in addition to their doctor’s reputation. So, how can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?
First off, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so highlights any major flaws in a practice’s administrative and technical safeguards, and accentuates the policies and procedures that the practice needs to implement.
In addition to that, the designated HIPAA Privacy and Security Officer must ensure that ALL employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy Rule and actionable policies and procedures.
So, remember, healthcare organizations and their vendors have a responsibility to be HIPAA compliant, and that starts by performing, updating, or reviewing an accurate and thorough Security Risk Assessment covering your technical, administrative, and physical safeguards. This will help uncover any vulnerabilities, and help you understand what information is being transmitted, shared, and how it is being transmitted.
TAKE AWAYS AND THINGS TO CONSIDER:
- Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
Remediate any potential risks or vulnerabilities.
- A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information (PHI)
- Develop actionable policies and procedures that clearly outline disclosures of PHI
- Ensure all employees have a clear understanding of the HIPAA Privacy rule and its policies and procedures
Live Compliance provides everything you need to become and maintain your organization’s HIPAA compliance requirements. All policies and procedures can be edited and shared directly with staff from your staff portal. Trainings are delivered and monitored within your portal, can be customized, role-based, and be accessed anytime and from anywhere. You can also easily send and monitor HIPAA training with one click.
Failing to implement HIPAA can cause tremendous problems and use precious resources and time to implement. Live Compliance makes it 10X easier than trying to do it on your own.
So, take advantage of Live Compliance’s FREE Organization Needs Assessment to understand your immediate compliance needs. For additional details, e-mail Jim Johnson (at firstname.lastname@example.org), call (980) 999-1585, or visit their website at livecompliance.com/oa
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
[ Written by Jim Johnson, President of Live Compliance ]
Whether you and your workforce are back in the office, or still working from home, there are new compliance regulations, and your HIPAA Compliance program may be a bit different.
Reliable and Effective Compliance
• Completely online, our role-based courses make training easy for remote or in-office employees.
• Contact-free and accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
• Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in or out of the office, and updated in real time.
• Electronic, prepared document sending and signing to employees and business associates.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status regarding the new compliance regulations. [ Click here to download a “HIPAA Compliance Requirements” document ].
Live Compliance is a partner of EZClaim, and you can contact them directly by either calling them at (980) 999-1585, e-mail Jim Johnson at Jim@LiveCompliance.com, or visit them at LiveCompliance.com
[ Written by Jim Johnson, President of Live Compliance ]
Credit card collections are a BIG part of any successful medical practice, and there has been a shift, in the last decade, that more insurance policies are adding co-pays with higher deductibles—which makes getting paid even more challenging.1 One industry report said that “73% of physicians shared that it typically takes at least one month to collect a payment, and 12% of their patients wait more than three months to pay.”2 With the current trend, more medical practices and their billing departments (or outsourced billing firms) are going the route of processing payment via credit cards, which has its PROS and CONS.
In light of this new information, the following are a few pros and cons for credit card processing that we anticipate in the near future, and some insights for choosing the best billing software that supports the credit card processing needs of medical practices:
- PRO: To protect against the dangers of stolen data, fraud, or other compromises in security, practices should seek out medical billing software that has credit card processing built-in, which can help safeguard against these dangers.
- CON: Security is a big risk, and a leak in data leading to stolen funds can end up in a physician paying out-of-pocket for the breach. It is also important to note that breach of credit card data is also considered a violation under the federal Health Insurance Portability and Accountability Act (HIPAA).
- PRO: Implementing credit card processing will reduce long waiting periods for payments from the majority of your patients, and will also reduce the additional effort your billing staff has to extend to collect on overdue notices.
- CON: Practices cannot require patients to share their credit card information to receive medical care, and even if patients do share their credit card information, physicians cannot continue to charge the credit card without a patient’s consent.
- PRO: Physicians can end the process of being a “line of credit” to unpaid or underpaid claims, and collect on funds immediately.
- CON: You will need to implement internal processes that include, but are not limited to proper personal information storage and security, establishing guidelines on maximum percentages charged per bill, and personal consent forms.
Overall, there are definitely MORE ‘PROS’ than cons for implementing credit card processing for your medical practice, and all the trends are pointing to this being the PREFERRED METHOD of payment in the near future. EZClaim is proud to announce that it will release an integrated credit card processing solution, EZClaimPay, that is backed by a national merchant services vendor. [ EZClaim will be sharing more details about EZClaimPay in the weeks to come, via their social media platforms, their monthly newsletter, direct communications, and more ].
In addition to the credit card collections PROS and CONS above, we reached out to one of our partners, Live Compliance, to gather some regulatory and security advice. They suggested the following:
- When accessing, transmitting, storing, or receiving any Protected Health Information (PHI), Health and Human Services (HHS) Office of Civil Rights (OCR) mandates that you are to maintain HIPAA compliance.
- When accepting, processing, or maintaining credit card information and debit card information, you must ensure that your organization is PCI DSS compliant (Payment Card Industry Data Security Standard).
- In addition to the above Federal regulatory requirements, most states require privacy and security compliance requirements to be implemented, along with strict adherence to the privacy of Personally Identifiable Information (PII) and Breach Notification requirements.
For more information on your compliance requirements, visit Live Compliance for a Free Organization Assessment to identify and uncover your organization’s vulnerabilities.
If you are not a current customer of EZClaim, we would very much like to connect with you. You can either schedule a one-on-one consultation with our sales team, view a recorded demo, or download a FREE 30-day trial right now. For detailed product features or general information about EZClaim, visit our website at ezclaim.com.
[ NOTE: If you would like a quote on the upcoming merchant services, please e-mail email@example.com your last three merchant statements. For more on our ongoing updates and industry news, you can follow EZClaim on Facebook and LinkedIn ].
1 – America’s Health Insurance Plans” report that there were 20.2 million co-pays in 2017, which was up tremendously from just over 1 million in 2005.
2 – Source: From InstaMed’s annual “Trends in Healthcare Payments” report.
> For more on this topic, read a previous article, “Why Do I Have A Balance? – Patient Payments”
On March 26, 2020 Washington D.C significantly amended its Data Breach Notification Law (D.C. Act 23-268), to expand the definition of personal information and require businesses obtaining such information to implement “reasonable security safeguards”. The new law took effect on May 19, 2020 in the midst of dramatic societal change. Indeed, COVID-19 has accelerated the digital transition and hastened the need for security and privacy issues to be at the forefront of state legislature. So, what are the major changes and updates under the D.C Act 23-268?
A Broader Definition of Personal Information
The definition of personal information has been significantly expanded and includes several new elements. Previously, the law only considered personal information to be a person’s first name (or initial) and surname and sensitive identifying numbers i.e. social security number, driver’s license number, D.C identification card number or credit card number.
Personal information also included a combination of a person’s name and any codes that would enable access to a person’s individual financial or credit account. The current update expands the definition of what is classified as personal information to the following:
- Unique Identification Numbers: passport number, taxpayer identification number or any other identification number issued on a government document.
- Medical Information: DNA profile or genetic, biometric or health insurance information.
- Financial information: Account number or any numbers or codes allowing access to an individual’s financial or credit account.
- Other Data: Any listed data that would allow an individual to carry out identity theft. The new legal definition also includes any username or email address combined with any information allowing access to another’s personal account.
Mandatory Breach Notification
- C Attorney General Notification Notices:
The law previously only required the D.C Attorney General to be notified if over 1,000 residents were affected by a data security breach. It now requires the D.C Attorney General to be notified when a qualifying data breach affects 50 D.C residents or more. The notice must include the nature and cause of the data breach, the number of affected residents, types of personal information compromised and corrective steps that have been taken.
- Individual Breach Notification Notices:
Affected residents must also be notified ‘’in the most expedient manner possible, without unreasonable delay’’. New content requirements for individual breach notification notices include the types of data compromised and toll-free numbers for credit reporting agencies and the D.C Attorney General.
Business and Service Provider Security Requirements
Businesses and service providers are now subject to more stringent security protection requirements. Any organization handling D.C residents’ personal information must “implement and maintain reasonable security safeguards”. The amended law also stipulates that any entity using a third-party service provider must have a written agreement in place requiring the latter to “implement and maintain reasonable security safeguards”.
Failure to comply with the new legal requirements of the new Data Breach Notification Law and to implement and ensure “reasonable security safeguards’, there could be significant economic and reputational loss.
To assist you in identifying the extent to which your organization is at risk of a data breach, Life Compliance is offering a FREE Organization Assessment to determine your company’s specific vulnerabilities and risk exposure to cyber crime. This will ensure you have the best possible insight and protection as you guide your company into the digital future.
Live Compliance provides all of your HIPAA privacy, security requirements, and measures. HIPAA compliance is a requirement for Covered Entities and Business Associates to safeguard personal, private, and protected health information. Organizations can excel in health care without the struggle of compliance requirements.
Live Compliance is a preferred partner of EZClaim, and their software is integrated into our medical billing software. For detailed product features or general information about EZClaim medical billing solutions, visit our website, contact us via e-mail, or call our support team directly at 877.650.0904.
[ Written by Jim Johnson, President of Live Compliance ]
ONE patient complaint leads to $2.175 Million fine! AND 2 Years of OCR Monitoring.
Contributed by Jim Johnson, President of Live Compliance
One patient complaint, that’s all it takes. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties? Actually, there should be no doubt! The Sentara Hospital violations are violations that every small billing company or independent physician practice would face, not just because Sentara is a hospital.
So what happened? In short, a complaint from an individual came from a person receiving a bill containing another individual’s billing statement. As a result of Sentara investigating this breach, Sentara reported a breach affecting 8 individuals, when in actuality, Sentara mailed 577 patient’s statements to the wrong addresses. This is an example of why you must perform and document a breach risk analysis as soon as you become aware of a potential incident. It is important that you understand what a breach is and the breach notification requirements.
The second issue discovered during the investigation revealed Sentara failed to have a business associate agreement in place with an entity that performed business associate services for Sentara. This reinforces the importance of having business associate agreements in place and your understanding that BAA’s are contracts that outline timeframes and provide your attestation to a satisfactory assurance of your ability to safeguard PHI among other things.
Maybe most importantly, you should know every complaint must be investigated by HHS/OCR. What that means is, if you improperly disclose protected health information, like sending a statement to the wrong patient, you, a billing company, must inform the covered entity (your client) and have a breach risk assessment completed to determine several key factors. Then the covered entity must take action based on these findings. If you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
In fact, Texas Health received a $1.6 million fine for improperly disclosing ePHI. Texas Health failed to comply with several HIPAA requirements including failure to perform the HIPAA Security Risk Assessment.
The fines are huge, but the reputational damage to your billing company and the covered entity is expensive and difficult to overcome.
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com
Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
Click here to read more informative articles from EZClaim and our partners.
The Importance of Administrative Safeguards
Hundreds of Patient Records Found in Trash
The Importance of Administrative Safeguards. Guest Author: Jim Johnson President of Live Compliance
A gastroenterology office in New York is under investigation after hundreds of patient records were left in boxes on a curb outside of the office and in the trash. These records contained Protected Health Information (PHI) such as first and last names, dates of birth, social security numbers and even pictures of the patients.
They recently moved to a new office down the hall and some of the old records were waiting to be picked up by the shredding company from the former office, and they believe the cleaning company may have disposed of them.
Ensuring that proper administrative and physical safeguards are in place is absolutely necessary and to avoid HIPAA violations, and in doing so, Media Disposal Policies are essential to be understood by all workforce members, especially because breaches and improper disclosures of this kind seem to be occurring more frequently. For example, a medical records maintenance company was fined $100,000 for leaving patient records in an unlocked vehicle!
Patients must trust who they share their personal, private and protected health information with, and breaches such as this, are obviously devastating for the patient and their doctor’s reputation. How can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?
First, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so would have highlighted a major flaw in the practice’s administrative safeguards and the importance of Media Disposal policies and procedures and the practice’s need to implement.
It is also important to note, that all compliance solutions and Business Associates, must also, in turn, be compliant. Ensuring that your Patient Scheduling (check out our last post about if Google Calendar is compliant!) and other software solutions are HIPAA Compliant can eliminate the risk associated with maintaining paper patient records.
Next, ensure all employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy rule and actionable policies and procedures.
Finally, if visitors, such as janitorial services have access to the facility, it is crucial that Facility and Visitor Access Logs are kept, as well as a clear understanding of who has access to keys and alarm codes.
Healthcare organizations and their vendors have a responsibility to be HIPAA Compliant, and that starts by performing, updating or reviewing an accurate and thorough Security Risk Assessment covering your Technical, Administrative and Physical Safeguards. This will help uncover vulnerabilities and help you understand what information is being transmitted, shared and how.
TAKEAWAYS AND THINGS TO CONSIDER:
- Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
- Remediate any potential risks or vulnerabilities. A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information.
- Develop Actionable policies and procedures that clearly outline the disclosures of PHI. Policies and Procedures can be edited and shared directly with staff from your Live Compliance staff portal.
- Ensure all employees complete and have a clear understanding of the HIPAA Privacy Rule and policies and procedures. Completely built into your portal, Live Compliance training is custom, online, and role-based. Training is delivered and monitored within your Live Compliance portal, anytime and from anywhere. Easily send and monitor HIPAA training in one click.
Don’t be the cause of your provider’s reputational damage and fines! Take advantage of the limited time offer for a FREE Organization Assessment to ensure you are meeting the requirements mandated for you and your organization. We hope you enjoyed this article about The Importance of Administrative Safeguards. Click here to read more interested and informative articles from EZClaim.