Lost laptop = $65,000 fine. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties?
What happened? Most recently, an ambulance company out of Georgia paid $65,000 for a lost laptop that happened to be unencrypted. More often, small businesses and practices are taking work outside of the office, so this kind of violation is one that can occur to anyone.
The laptop contained 500 individual’s Protected Health Information. As a result of the investigation, the ambulance company will undergo a Technical Security Risk Assessment and is required to adopt a Corrective Action Plan. This is a great example of why it is important and mandatory to conduct a Technical and Objective Security Risk Assessment at least annually on all devices.
Following the investigation, it was uncovered that West Georgia Ambulance never provided a security awareness and training program for its employees! You and your workforce are your first line of defense. This reinforces the importance that both you, and your employees must understand what a breach is and the breach notification requirements! It was later revealed that West Georgia Ambulance failed to implement HIPAA Security Rule policies and procedures as well.
What can you do? As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, the Billing Company or independent physician practice, suspects a breach or complaint you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy, call us at (980) 999-1585, email me or visit LiveCompliance.com
Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
If you are enjoyed this article about the lost laptop as well as the informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.
