New HIPAA Regulations 2020-2022 and beyond

New HIPAA Regulations 2020-2022 and beyond

On January 21, 2021, OCR published a Notice of Proposed Rulemaking (NPRM) to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. OCR says, the goal is to “support individuals’ engagement in their health care, remove barriers to coordinated care, and decrease regulatory burdens on the health care industry, while continuing to protect individuals’ health information privacy interests.” New regulations under consideration are centered around how substance abuse and mental health information records are protected. In addition, the HITECH Act called for an increase in penalties for non-compliance with the HIPAA.

In this article we will address the most recent changes to HIPAA and discuss which rules may have an impact on 2022 and beyond.

2020 CARES Act

2020 CARES Act aligned 42 CFR Confidentiality of Substance Use Disorder Patient Records (Part 2) regulations more closely with HIPAA as well. The CARES Act improves 42 CFR Part 2 regulations by expanding the ability of healthcare providers to share the records of individuals with substance abuse disorder, but also tightens the requirements in the event of a breach of confidentiality.

In short, rather than having to obtain a consent form for the SUD patient, and state the specific parties of whom information will be shared, patients can now give broad consent. It’s been suggested that HHS is considering changes to 42 CFR Part 2 regulations in 2022 to “to protect the privacy of substance abuse disorder patients who seek treatment at federally assisted programs to improve the level of care that can be provided.”

2021 HIPAA Safe Harbor Law

The HIPAA Safe Harbor Bill now instructs HHS to take into account the cybersecurity best practices that a HIPAA-regulated entity has adopted in the 12 months preceding any data breach.
“The bill also requires the HHS to decrease the length and extent of any audits in response to those breaches if industry security best practices have been implemented” says HHS.

21st Century Cures Act

The Cures Act called for the HHS to create a new Rule that would improve the flow of healthcare data between providers, patients, and developers of Health IT. Implementing reasonable and necessary activities that do not constitute information blocking, the implementation of these provisions will advance interoperability and support the access, exchange, and use of electronic health information.

Final Rule Expected on Proposed Changes to the HIPAA Privacy Rule

According to HHS, “the proposed changes to the HIPAA Privacy Rule include strengthening individuals’ rights to access their own health information, including electronic information; improving information sharing for care coordination and case management for individuals; facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhancing flexibilities for disclosures in emergency or threatening circumstances, such as the Opioid and COVID-19 public health emergencies; and reducing administrative burdens on HIPAA covered health care providers and health plans, while continuing to protect individuals’ health information privacy interests.”

The proposed new HIPAA regulations announced by OCR in December 2020 are as follows:

  • Allowing patients to inspect their PHI in person and take notes or photographs of their PHI.
  • Changing the maximum time to provide access to PHI from 30 days to 15 days.
  • Requests by individuals to transfer ePHI to a third party will be limited to the ePHI maintained in an EHR.
  • Individuals will be permitted to request their PHI be transferred to a personal health application.
  • States when individuals should be provided with ePHI at no cost.
  • Covered entities will be required to inform individuals that they have the right to obtain or direct copies of their PHI to a third party when a summary of PHI is offered instead of a copy.
  • Healthcare providers and health plans will be required to respond to certain records requests from other covered health care providers and health plans, in cases when an individual directs those entities to do so under the HIPAA Right of Access.

…to name a few.

At Live Compliance, we make checking off your compliance requirements extremely simple.

  • Reliable and Effective Compliance
  • Completely online, our role-based courses make training easy for remote or in-office employees.
  • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
  • Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real time.
  • Electronic, prepared document sending and signing to employees and business associates.

 

Don’t risk your company’s future, especially when we are offering a free Organization Assessment to help determine your company’s status. Call us at (980) 999-1585, or email Support@LiveCompliance.com or visit www.LiveCompliance.com

Have You Performed a Security Risk Assessment?

Have You Performed a Security Risk Assessment?

Have you performed and identified your organization’s vulnerabilities with a Security Risk Assessment this year?

We understand that achieving and maintaining compliance is a delicate matter as it requires auditing, constant supervision, good staffing, adequate policies, and procedures, along with excellent reporting and investigation of any issues.

The process of assessing and maintaining compliance to any standard is the same, irrespective of the industry but especially when HIPAA compliance is required:

1. Start with a complete understanding of all the rules that you are expected to follow.
2. Establish internal policies and procedures to ensure your organization follows the rules.
3. Regularly check and assess whether or not your organization is following the rules.
4. Address issues whenever you discover the rules are not being followed.
5. Document everything.
6. Perform accurate and thorough Security Risk Assessment(s)

Are you unsure or not clear on what your organization is required to do?

THINGS TO CONSIDER:
● A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information. Correct any potential risks identified within your Technical, Administrative, and Physical deficiencies.
● A Security Risk Assessment should be completed at least twice a year to target vulnerabilities
● Your policies and procedures should be thorough and accurate and reflect the Corrective Action Plan that is determined by the Security Risk Assessment and remediation steps should be taken to correct any deficiencies or vulnerabilities found.
● Workforce training should reflect the organization’s HIPAA Policies and Procedures

Would you like to schedule a compliance team meeting phone conference? If so, please contact support@livecompliance.com or at (980) 999-1585, and one of our compliance support team members will reach out to you.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

Identify Your Organization’s Vulnerabilities

Identify Your Organization’s Vulnerabilities

Have you performed and identified your organization’s vulnerabilities with a Security Risk Assessment this year? We understand that achieving and maintaining compliance is a delicate matter as it requires auditing, constant supervision, good staffing, adequate policies, and procedures, along with excellent reporting and investigation of any issues.

The process of assessing and maintaining compliance to any standard is the same, irrespective of the industry but especially when HIPAA compliance is required:

1. Start with a complete understanding of all the rules that you are expected to follow.
2. Establish internal policies and procedures to ensure your organization follows the rules.
3. Regularly check and assess whether or not your organization is following the rules.
4. Address issues whenever you discover the rules are not being followed.
5. Document everything.
6. Perform accurate and thorough Security Risk Assessment(s)

Are you unsure or not clear on what your organization is required to do?

THINGS TO CONSIDER:

● A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information. Correct any potential risks identified within your Technical, Administrative, and Physical deficiencies.

● A Security Risk Assessment should be completed at least twice a year to target vulnerabilities

● Your policies and procedures should be thorough and accurate and reflect the Corrective Action Plan that is determined by the Security Risk Assessment and remediation steps should be taken to correct any deficiencies or vulnerabilities found.

● Workforce training should reflect the organization’s HIPAA Policies and Procedures

Would you like to schedule a compliance team meeting phone conference? If so, please contact support@livecompliance.com or at (980) 999-1585 and one of our compliance support team members will reach out to you.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

HIPAA Training Standards Businesses Need to Know

HIPAA Training Standards Businesses Need to Know

Per the HIPAA Privacy Rule and HIPAA Security Rule, both Covered Entities and Business Associates, must require HIPAA training for all workforce members that access protected health information (PHI) or electronically protected health information (e-PHI) in any of its forms and should be provided “as necessary and appropriate for the members of the workforce to carry out their functions within the [organization].”

According to the Rule, training must be provided “to each new member of the workforce within a reasonable period of time after the person joins the covered entity’s workforce.” Along with all other annual compliance requirements, HIPAA training is arguably the most important. Your workforce members are your first line of defense in the event of a Breach and must be able to identify your organization’s designated HIPAA Security Officer, and have a firm understanding of the HIPAA Privacy and Security Rule. Training should also highlight the organization’s Technical, Administrative, and Physical Safeguard objective security requirements. It is best practice to provide ongoing security awareness training and, in addition to the mandatory annual training, the Privacy Rule also highlights what’s known as “periodic” training. The goal is to ensure workforce member’s knowledge of HIPAA compliance is not forgotten.

The HIPAA Privacy Rule states that “An [organization] must document that the training as described [in the HIPAA Text] has been provided.” Failing to do so will be seen as “willful neglect” and will result in HIPAA violations including monetary penalties as high as $1.5 million dollars. A minor violation may only result in a corrective action plan requirement, whereas a significant data breach attributable to a lack of training will be viewed more seriously.

At Live Compliance, we make checking off your compliance requirements extremely simple.

      • Completely online, our role-based courses make training easy for remote or in-office employees.
      • Short informative video trainings to meet periodic training requirements
      • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities, including those such as Password Protection.
      • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
      • Electronic, prepared document sending and signing to employees and business associates.

Call us at (980) 999-1585 or visit www.LiveCompliance.com.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

Smartphone Apps and Best Practice to Reduce Risk

Smartphone Apps and Best Practice to Reduce Risk

There are many benefits to smartphones in the healthcare industry, however, there is also huge potential for HIPAA violations of patient privacy to be violated. It’s important to know what risk is associated with smartphones and other mobile devices.

CISA, or Cybersecurity and Infrastructure Security Agency, says “Mobile apps may gather information from your mobile device for legitimate purposes, but these tools may also put your privacy at risk.”

So, what are the risks associated with mobile device applications?

Apps are a convenient tool to access the news, get directions, or pick up rideshare, but these tools may also put your privacy at risk.

CISA says, when you download an app, it may ask for permission to access personal information—such as email contacts, calendar inputs, call logs, and location data—from your device. CISA goes on to say, “You should be aware that app developers will have access to this information and may share it with third parties, such as companies who develop targeted ads based on your location and interests.”

How can you avoid malicious apps and limit the information apps collect about you?

First, it’s helpful to reiterate that employee devices are for work purposes only. Therefore, applications on your workplace devices, including mobile devices must be approved by your Supervisor and must follow device guidelines set in place by your organization.

Employees must refrain from downloading, installing, and using apps such as social media platforms. Therefore, employees should refrain from posting, commenting, or sharing patient information on social media including patient names, photos, and descriptors that would identify the patient.

What steps can you take to secure data on your mobile devices?

  1. When using a public or unsecured wireless connection, avoid using apps and websites that require personal information and turn off Bluetooth.
  2. Avoid connecting your smartphone to any computer or charging station that you do not control. Charging stations are often found at transportation terminals and are not secure! Connecting a device to a computer using a USB cable can allow software running on that computer to interact with the phone.
  3. Do not leave your device unattended in public or in easily accessible areas.
  4. Ensure your device requires a password or biometric identifier to access it, so if is stolen, thieves will have limited access to its data.

If your device is stolen or misplaced, first, contact your IT administrator, supervisor, and/or designated HIPAA Security Officer immediately and notify them of the situation for immediate next steps. In general, it’s advised to, follow your organization’s Incident Response Policy immediately.

At Live Compliance, we make checking off your compliance requirements extremely simple.

    • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities, including those such as Password Protection.
    • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
    • Electronic, prepared document sending and signing to employees and business associates.

Call us at (980) 999-1585 or visit www.LiveCompliance.com.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

[ Contribution from the marketing team at Live Compliance ]

The Devastating Effects of Social Media in Healthcare

The Devastating Effects of Social Media in Healthcare

HIPAA Social Media Do’s and Don’ts in Healthcare

There are many benefits to social media in the healthcare industry, however, there is also huge potential for HIPAA violations of patient privacy to be violated on social media networks.  The Privacy Rule protects All “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral. The Privacy Rule calls this information “protected health information (PHI).”

Did you know that more than 71% of recorded data breaches in the healthcare industry are attributable to employee actions?

The most important rule is to never share Protected Health Information or Personally Identifiable Information on social media. Social media may include personal blogs and other websites, including Facebook, LinkedIn, Twitter, YouTube, or others of the like.

A few common identifiers include but are not limited to:

    • demographic data
    • medical histories
    • test results
    • insurance information
    • and other information used to identify a patient or provide healthcare services or healthcare coverage.

What is a breach and what can I do to avoid it?

 A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. This means employees should refrain from posting, commenting, or sharing patient information on social media including patient names, photos, and descriptors that would identify the patient.

What is considered identifiable information?

The most common social media HIPAA violations include:

    • Posting of images and videos of patients without written consent
    • Posting of gossip about patients
    • Posting of any information that could allow an individual to be identified
    • Sharing of photographs or images taken inside a healthcare facility in which patients or PHI are visible
    • Sharing of photos, videos, or text on social media platforms within a private group

“Friending” patients on social media websites is also strongly discouraged. This can lead to accidental identifying of patients, especially if your place of work is listed in your profile and accidental ‘discussion’ about the patient’s care. Therefore, employees in inpatient care roles generally should not initiate or accept friend requests. Do not enter into social media discussions with patients who have disclosed PHI on social media.

Employees should also refrain from messaging or texting PHI or PII on social media or messaging applications not approved by your organization. In general, no personally identifiable health information should be sent in any manner which does not ensure communication encryption in transit and at rest.

So, what do you do if you think you may have exposed a patient’s protected health information or personally identifiable information?

In general, it’s advised to, follow your organization’s Incident Response Policy immediately and notify your supervisor and/or designated HIPAA Security Officer for immediate next steps.

At Live Compliance, we make checking off your compliance requirements extremely simple.

    • Reliable and Effective Compliance
    • Completely online, our role-based courses make training easy for remote or in-office employees.
    • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities.
    • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
    • Electronic, prepared document sending and signing to employees and business associates.

Don’t risk your company’s future, especially when we are offering a free Organization Assessment to help determine your company’s status. Call us at (980) 999-1585, or email me, Jim Johnson at Jim@LiveCompliance.com or visit www.LiveCompliance.com

For more information about DarkWeb breaches please contact us at (980) 999-1585 or email us at support@livecompliance.com


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.