New Compliance Regulations for Working at Home

Whether you and your workforce are back in the office, or still working from home, there are new compliance regulations, and your HIPAA Compliance program may be a bit different.

New Compliance RegulationsReliable and Effective Compliance

Completely online, our role-based courses make training easy for remote or in-office employees.

Contact-free and accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.

Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in or out of the office, and  updated in real time.

Electronic, prepared document sending and signing to employees and business associates.

Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status regarding the new compliance regulations. [ Click here to download a “HIPAA Compliance Requirements” document ].

Live Compliance is a partner of EZClaim, and you can contact them directly by either calling them at (980) 999-1585, e-mail Jim Johnson at Jim@LiveCompliance.com, or visit them at LiveCompliance.com

[ Written by Jim Johnson, President of Live Compliance ]

Lost Laptop = $65,000 Fine

lost laptopLost laptop = $65,000 fine. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties? 

What happened? Most recently, an ambulance company out of Georgia paid $65,000 for a lost laptop that happened to be unencrypted. More often, small businesses and practices are taking work outside of the office, so this kind of violation is one that can occur to anyone. 

The laptop contained 500 individual’s Protected Health Information. As a result of the investigation, the ambulance company will undergo a Technical Security Risk Assessment and is required to adopt a Corrective Action Plan. This is a great example of why it is important and mandatory to conduct a Technical and Objective Security Risk Assessment at least annually on all devices. 

Following the investigation, it was uncovered that West Georgia Ambulance never provided a security awareness and training program for its employees! You and your workforce are your first line of defense. This reinforces the importance that both you, and your employees must understand what a breach is and the breach notification requirements! It was later revealed that West Georgia Ambulance failed to implement HIPAA Security Rule policies and procedures as well. 

What can you do? As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, the Billing Company or independent physician practice, suspects a breach or complaint you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!

What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal. 

Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status. 

It’s easy, call us at (980) 999-1585, email me or visit LiveCompliance.com 

Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations. 

LEARN MORE

If you are enjoyed this article about the lost laptop as well as informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.

ONE Patient Complaint

ONE patient complaint leads to $2.175 Million fine! AND 2 Years of OCR Monitoring.

Contributed by Jim Johnson, President of Live Compliance

One patient complaint, that’s all it takes. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties? Actually, there should be no doubt! The Sentara Hospital violations are violations that every small billing company or independent physician practice would face, not just because Sentara is a hospital.

So what happened? In short, a complaint from an individual came from a person receiving a bill containing another individual’s billing statement. As a result of Sentara investigating this breach, Sentara reported a breach affecting 8 individuals, when in actuality, Sentara mailed 577 patient’s statements to the wrong addresses. This is an example of why you must perform and document a breach risk analysis as soon as you become aware of a potential incident. It is important that you understand what a breach is and the breach notification requirements.

The second issue discovered during the investigation revealed Sentara failed to have a business associate agreement in place with an entity that performed business associate services for Sentara. This reinforces the importance of having business associate agreements in place and your understanding that BAA’s are contracts that outline timeframes and provide your attestation to a satisfactory assurance of your ability to safeguard PHI among other things.

Maybe most importantly, you should know every complaint must be investigated by HHS/OCR. What that means is, if you improperly disclose protected health information, like sending a statement to the wrong patient, you, a billing company, must inform the covered entity (your client) and have a breach risk assessment completed to determine several key factors. Then the covered entity must take action based on these findings. If you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation! 

In fact, Texas Health received a $1.6 million fine for improperly disclosing ePHI. Texas Health failed to comply with several HIPAA requirements including failure to perform the HIPAA Security Risk Assessment.

The fines are huge, but the reputational damage to your billing company and the covered entity is expensive and difficult to overcome.

What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.

Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status. 

It’s easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com

Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.

LEARN MORE

Click here to read more informative articles from EZClaim and our partners.

The Importance of Administrative Safeguards

The Importance of Administrative Safeguards

Hundreds of Patient Records Found in Trash

The Importance of Administrative Safeguards

The Importance of Administrative Safeguards. Guest Author: Jim Johnson President of Live Compliance

A gastroenterology office in New York is under investigation after hundreds of patient records were left in boxes on a curb outside of the office and in the trash. These records contained Protected Health Information (PHI) such as first and last names, dates of birth, social security numbers and even pictures of the patients.

They recently moved to a new office down the hall and some of the old records were waiting to be picked up by the shredding company from the former office, and they believe the cleaning company may have disposed of them.

Ensuring that proper administrative and physical safeguards are in place is absolutely necessary and to avoid HIPAA violations, and in doing so, Media Disposal Policies are essential to be understood by all workforce members, especially because breaches and improper disclosures of this kind seem to be occurring more frequently. For example, a medical records maintenance company was fined $100,000 for leaving patient records in an unlocked vehicle!

Patients must trust who they share their personal, private and protected health information with, and breaches such as this, are obviously devastating for the patient and their doctor’s reputation. How can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?

First, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so would have highlighted a major flaw in the practice’s administrative safeguards and the importance of Media Disposal policies and procedures and the practice’s need to implement.

It is also important to note, that all compliance solutions and Business Associates, must also, in turn, be compliant. Ensuring that your Patient Scheduling (check out our last post about if Google Calendar is compliant!) and other software solutions are HIPAA Compliant can eliminate the risk associated with maintaining paper patient records.

Next, ensure all employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy rule and actionable policies and procedures.

Finally, if visitors, such as janitorial services have access to the facility, it is crucial that  Facility and Visitor Access Logs are kept, as well as a clear understanding of who has access to keys and alarm codes. 

Remember:

Healthcare organizations and their vendors have a responsibility to be HIPAA Compliant, and that starts by performing, updating or reviewing an accurate and thorough Security Risk Assessment covering your Technical, Administrative and Physical Safeguards. This will help uncover vulnerabilities and help you understand what information is being transmitted, shared and how.

TAKEAWAYS AND THINGS TO CONSIDER:

  • Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
  • Remediate any potential risks or vulnerabilities. A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information.
  • Develop Actionable policies and procedures that clearly outline the disclosures of PHI. Policies and Procedures can be edited and shared directly with staff from your Live Compliance staff portal.
  • Ensure all employees complete and have a clear understanding of the HIPAA Privacy Rule and policies and procedures. Completely built into your portal, Live Compliance training is custom, online, and role-based. Training is delivered and monitored within your Live Compliance portal, anytime and from anywhere. Easily send and monitor HIPAA training in one click.

Don’t be the cause of your provider’s reputational damage and fines! Take advantage of the limited time offer for a FREE Organization Assessment to ensure you are meeting the requirements mandated for you and your organization. We hope you enjoyed this article about The Importance of Administrative Safeguards. Click here to read more interested and informative articles from EZClaim.