The Devastating Effects of Social Media in Healthcare

The Devastating Effects of Social Media in Healthcare

HIPAA Social Media Do’s and Don’ts in Healthcare

There are many benefits to social media in the healthcare industry, however, there is also huge potential for HIPAA violations of patient privacy to be violated on social media networks.  The Privacy Rule protects All “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral. The Privacy Rule calls this information “protected health information (PHI).”

Did you know that more than 71% of recorded data breaches in the healthcare industry are attributable to employee actions?

The most important rule is to never share Protected Health Information or Personally Identifiable Information on social media. Social media may include personal blogs and other websites, including Facebook, LinkedIn, Twitter, YouTube, or others of the like.

A few common identifiers include but are not limited to:

    • demographic data
    • medical histories
    • test results
    • insurance information
    • and other information used to identify a patient or provide healthcare services or healthcare coverage.

What is a breach and what can I do to avoid it?

 A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. This means employees should refrain from posting, commenting, or sharing patient information on social media including patient names, photos, and descriptors that would identify the patient.

What is considered identifiable information?

The most common social media HIPAA violations include:

    • Posting of images and videos of patients without written consent
    • Posting of gossip about patients
    • Posting of any information that could allow an individual to be identified
    • Sharing of photographs or images taken inside a healthcare facility in which patients or PHI are visible
    • Sharing of photos, videos, or text on social media platforms within a private group

“Friending” patients on social media websites is also strongly discouraged. This can lead to accidental identifying of patients, especially if your place of work is listed in your profile and accidental ‘discussion’ about the patient’s care. Therefore, employees in inpatient care roles generally should not initiate or accept friend requests. Do not enter into social media discussions with patients who have disclosed PHI on social media.

Employees should also refrain from messaging or texting PHI or PII on social media or messaging applications not approved by your organization. In general, no personally identifiable health information should be sent in any manner which does not ensure communication encryption in transit and at rest.

So, what do you do if you think you may have exposed a patient’s protected health information or personally identifiable information?

In general, it’s advised to, follow your organization’s Incident Response Policy immediately and notify your supervisor and/or designated HIPAA Security Officer for immediate next steps.

At Live Compliance, we make checking off your compliance requirements extremely simple.

    • Reliable and Effective Compliance
    • Completely online, our role-based courses make training easy for remote or in-office employees.
    • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities.
    • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
    • Electronic, prepared document sending and signing to employees and business associates.

Don’t risk your company’s future, especially when we are offering a free Organization Assessment to help determine your company’s status. Call us at (980) 999-1585, or email me, Jim Johnson at Jim@LiveCompliance.com or visit www.LiveCompliance.com

For more information about DarkWeb breaches please contact us at (980) 999-1585 or email us at support@livecompliance.com


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

Noncompliance of HIPAA Security Rules Has Huge Consequences

Noncompliance of HIPAA Security Rules Has Huge Consequences

The noncompliance of HIPAA security rules has had huge consequences for an IT and health information management company.

CHSPSC LLC, (“CHSPSC”) has agreed to pay over $2 million to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS), for the breach of Protected Health Information (PHI). The Business Associate was notified by the Federal Bureau of Investigation (FBI) that it had traced a cyber-hacking group’s advanced persistent threat into CHSPSC’s information system.

After OCR ‘s investigation, it was found that CHSPSC had “longstanding, systemic noncompliance with the HIPAA Security Rule including failure to conduct a risk analysis, and failures to implement information system activity review, security incident procedures, and access controls.” The large health system provided various Business Associate services, including IT and health information management, to hospitals and physician clinics. These violations could have easily been avoided! OCR Director Roger Severino said, “The healthcare industry is a known target for hackers and cyber-thieves. The failure to implement the security protections required by the HIPAA Rules, especially after being notified by the FBI of a potential breach, is inexcusable.”

 

In addition to the monetary penalty, the Business Associate will be required to complete a “robust” Corrective Action Plan (CAP) with monitoring activity for at least the next two years. CHSPSC will also be required to do the following:

Implement technical policies and procedures to allow access only to those persons or software programs that have been granted access rights to information systems maintained
Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports
Conduct accurate and thorough assessments of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI

All this shows that ANYONE can face HUGE penalties, and they would most likely bankrupt a small billing company or an independent physician practice.

 

So, based on this specific example, it is VERY important to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, a billing company, or other vendor, suspect a breach, you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action.

Keep in mind, a Business Associate is a ‘person’ or ‘entity’. This means that ALL billing companies—large or small—need to comply with the Federal HIPAA security rules and regulations. So, if your company has not completed an accurate and thorough security risk assessment, there is a possibility that you could be penalized under ‘willful neglect’. (This category alone gas a fine of $50,000 per violation!)

 

So then, what can be done to ensure this doesn’t happen to my billing company or my organization? Well, one of EZClaim’s partners, Live Compliance, can make determining your compliance requirements extremely simple:

Completely online, Life Compliance’s role-based courses make training easy for remote or in-office employees
Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
Policies and procedures are curated to fit your organization, ensuring employees are updated on all workstation use and security safeguards in or out of the office. Update is in real time.
Electronic, prepared document sending and signing to employees and business associates

 

So, don’t risk your company’s future, especially when Life Compliance is offering a FREE Organization Assessment to help determine your company’s status. Either call Life Compliance at 980.999.1585, visit LiveCompliance.com to schedule an assessment, or e-mail Jim Johnson.

[ Article contributed by Jim Johnson of Live Compliance ]

———————————-

ABOUT EZCLAIM:
EZClaim is a medical billing and scheduling software company that provides a best-in-class product, with correspondingly exceptional service and support, and can help improve medical billing revenues. To learn more, visit their website, e-mail them at sales@ezclaim.com, or call a representative today at 877.650.0904.

CMS HHS Updates Telehealth Regulations

CMS HHS Updates Telehealth Regulations

Since CMS HHS just updated their Telehealth regulations to adjust to the COVID-19 environment—including having a remote workforce—we wanted to provide a clear update to independent physicians and billers to advise them of the fast-moving changes of many regulations, and what to expect in the near future.

It is important to note that CMS has recently announced that new and established patients have availability to Telehealth, and HHS OIG is providing flexibility for healthcare providers to reduce or waive cost-sharing for Telehealth visits paid by federal healthcare programs. CMS is also expanding Telehealth services to people with medicare.

As a result, please see the below video from CMS which highlights the Medicare Coverage and Payment of Virtual Services and Telehealth.

In addition, we’ve included a few key questions and answers below. If you have further questions about Telehealth and your compliance, contact Jim Johnson with Live Compliance at Jim@LiveCompliance.com or (980) 999-1585.

1. Who can provide Telehealth services?

    • Physicians
    • Nurse Practitioners
    • Physician assistants
    • Nurse-midwives
    • Certified nurse anesthetists
    • Clinical psychologists
    • Registered dietitians
    • Nutrition professionals

2. What services can a medicare beneficiary receive through Telehealth?

    • Evaluation and management visits (common office visits)
    • Mental health counseling
    • Preventive health screenings
    • More than 80 additional services

3. What are the types of virtual services?

    • Medicare Telehealth visits
    • Virtual check-ins
    • E-visits
    • Telephone services

Live Compliance is an EZclaim premier partner for HIPAA compliance and is integrated into EZclaim’s billing solution.

If you have any further questions about Telehealth regulations and your compliance, e-mail Jim Johnson at Live Compliance at Jim@LiveCompliance.com, or phone him at (980) 999-1585.

[ Contribution by Jim Johnson with the Live Compliance ]