Smartphone Apps and Best Practice to Reduce Risk

Smartphone Apps and Best Practice to Reduce Risk

There are many benefits to smartphones in the healthcare industry, however, there is also huge potential for HIPAA violations of patient privacy to be violated. It’s important to know what risk is associated with smartphones and other mobile devices.

CISA, or Cybersecurity and Infrastructure Security Agency, says “Mobile apps may gather information from your mobile device for legitimate purposes, but these tools may also put your privacy at risk.”

So, what are the risks associated with mobile device applications?

Apps are a convenient tool to access the news, get directions, or pick up rideshare, but these tools may also put your privacy at risk.

CISA says, when you download an app, it may ask for permission to access personal information—such as email contacts, calendar inputs, call logs, and location data—from your device. CISA goes on to say, “You should be aware that app developers will have access to this information and may share it with third parties, such as companies who develop targeted ads based on your location and interests.”

How can you avoid malicious apps and limit the information apps collect about you?

First, it’s helpful to reiterate that employee devices are for work purposes only. Therefore, applications on your workplace devices, including mobile devices must be approved by your Supervisor and must follow device guidelines set in place by your organization.

Employees must refrain from downloading, installing, and using apps such as social media platforms. Therefore, employees should refrain from posting, commenting, or sharing patient information on social media including patient names, photos, and descriptors that would identify the patient.

What steps can you take to secure data on your mobile devices?

  1. When using a public or unsecured wireless connection, avoid using apps and websites that require personal information and turn off Bluetooth.
  2. Avoid connecting your smartphone to any computer or charging station that you do not control. Charging stations are often found at transportation terminals and are not secure! Connecting a device to a computer using a USB cable can allow software running on that computer to interact with the phone.
  3. Do not leave your device unattended in public or in easily accessible areas.
  4. Ensure your device requires a password or biometric identifier to access it, so if is stolen, thieves will have limited access to its data.

If your device is stolen or misplaced, first, contact your IT administrator, supervisor, and/or designated HIPAA Security Officer immediately and notify them of the situation for immediate next steps. In general, it’s advised to, follow your organization’s Incident Response Policy immediately.

At Live Compliance, we make checking off your compliance requirements extremely simple.

    • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities, including those such as Password Protection.
    • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
    • Electronic, prepared document sending and signing to employees and business associates.

Call us at (980) 999-1585 or visit www.LiveCompliance.com.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

[ Contribution from the marketing team at Live Compliance ]

Healthcare Loses Billions Due to Over-Reliance on Manual Tasks

Healthcare Loses Billions Due to Over-Reliance on Manual Tasks

We already know the trend toward automation in healthcare continues to grow each year. As technology continuously improves and the financial bar to entry lowers, the opportunities for healthcare providers and health plans to enhance operational processes grow as well. But even with the radical progress and the easier-to-use-than-ever healthcare operations software, many organizations fail to implement the solutions. It may be a lack of organizational enthusiasm or a simple need for more skilled internal technological expertise.

And while this is likely common knowledge at your organization, the amount of money wasted each year – driven by the absence of process automation – may not. Billions of dollars that could otherwise be spent on improving patient care and satisfaction, on building and rolling out new service lines, and generally improving healthcare operations are wasted every year. Billions.

The most recent CAQH Index reports $372 billion is spent yearly on administrative tasks throughout the US healthcare system. Of that amount, $39 billion of those administrative transactions are specifically tracked by the CAQH Index. “Of the $39 billion, the industry can save $16.3 billion, or 42 percent of existing annual spend, by transitioning to fully electronic transactions,” according to CAQH.

$16 billion in savings.

The current opportunity for savings driven by automated, electronic transactions within the healthcare industry is tremendous. That’s not to say the healthcare industry is doing nothing. CAQH found that healthcare organizations already save $122 billion annually thanks to process automation.

Even with the apparent success of automation, however, CAQH found the utilization, adoption, and growth of fully-automated processes year-over-year was stagnant or modest at best:

      • Eligibility and benefit verification remained steady at 84%
      • Prior authorizations increased to 21% from 13%
      • Claim status inquiry grew slightly to 72% from 70%
      • Claim payment automation increased marginally to 71% to 70%

With the small and slow shift to the use of automated transaction processes in the healthcare industry, there’s a decided advantage–in time and money–to not automating many, if not all, backend operations. Doing so allows staff to focus on strategic initiatives, like building out new programs or service lines, rather than plodding through everyday tasks better tackled through repeatable processes supported by technology.

“The industry continues to make progress towards a more automated administrative workflow as transaction volume increases, new business needs and technology emerge, and health insurance benefit and payment models evolve,” CAQH explains in the report. Nevertheless, as mentioned earlier, the “progress” remains slow, like a river choked with debris.

Ironically, even as automated solutions become more abundant and easier to use, CAQH reports healthcare providers to perform more manual tasks today than in the past. With today’s technology-rich environment, there’s little reason for healthcare providers to input any type of care-related documentation by hand. That time can and should be better spent improving the healthcare experience for patients and their families.

It’s far past time to clear the detritus from the river. With the advantage of today’s technology, it’s easier to make the change when each of us plays a part in the cleanup.

Contact a TriZetto Provider Solutions representative today to learn more about automation-enabled technologies that can help drive efficiencies and increase revenue.


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

[ Contribution from the marketing team at TriZetto ]

The Devastating Effects of Social Media in Healthcare

The Devastating Effects of Social Media in Healthcare

HIPAA Social Media Do’s and Don’ts in Healthcare

There are many benefits to social media in the healthcare industry, however, there is also huge potential for HIPAA violations of patient privacy to be violated on social media networks.  The Privacy Rule protects All “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral. The Privacy Rule calls this information “protected health information (PHI).”

Did you know that more than 71% of recorded data breaches in the healthcare industry are attributable to employee actions?

The most important rule is to never share Protected Health Information or Personally Identifiable Information on social media. Social media may include personal blogs and other websites, including Facebook, LinkedIn, Twitter, YouTube, or others of the like.

A few common identifiers include but are not limited to:

    • demographic data
    • medical histories
    • test results
    • insurance information
    • and other information used to identify a patient or provide healthcare services or healthcare coverage.

What is a breach and what can I do to avoid it?

 A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. This means employees should refrain from posting, commenting, or sharing patient information on social media including patient names, photos, and descriptors that would identify the patient.

What is considered identifiable information?

The most common social media HIPAA violations include:

    • Posting of images and videos of patients without written consent
    • Posting of gossip about patients
    • Posting of any information that could allow an individual to be identified
    • Sharing of photographs or images taken inside a healthcare facility in which patients or PHI are visible
    • Sharing of photos, videos, or text on social media platforms within a private group

“Friending” patients on social media websites is also strongly discouraged. This can lead to accidental identifying of patients, especially if your place of work is listed in your profile and accidental ‘discussion’ about the patient’s care. Therefore, employees in inpatient care roles generally should not initiate or accept friend requests. Do not enter into social media discussions with patients who have disclosed PHI on social media.

Employees should also refrain from messaging or texting PHI or PII on social media or messaging applications not approved by your organization. In general, no personally identifiable health information should be sent in any manner which does not ensure communication encryption in transit and at rest.

So, what do you do if you think you may have exposed a patient’s protected health information or personally identifiable information?

In general, it’s advised to, follow your organization’s Incident Response Policy immediately and notify your supervisor and/or designated HIPAA Security Officer for immediate next steps.

At Live Compliance, we make checking off your compliance requirements extremely simple.

    • Reliable and Effective Compliance
    • Completely online, our role-based courses make training easy for remote or in-office employees.
    • Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location. Conducting an accurate and thorough Security Risk Assessment is not only required but is a useful tool to expose potential vulnerabilities.
    • Policies and Procedures are curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in the office, or out. Update in real-time.
    • Electronic, prepared document sending and signing to employees and business associates.

Don’t risk your company’s future, especially when we are offering a free Organization Assessment to help determine your company’s status. Call us at (980) 999-1585, or email me, Jim Johnson at Jim@LiveCompliance.com or visit www.LiveCompliance.com

For more information about DarkWeb breaches please contact us at (980) 999-1585 or email us at support@livecompliance.com


ABOUT EZCLAIM:
As a medical billing expert, EZClaim can help the medical practice improve its revenues since it is a medical billing and scheduling software company. EZClaim provides a best-in-class product, with correspondingly exceptional service and support. Combined, EZClaim helps improve medical billing revenues. To learn more, visit EZClaim’s website, email them, or call them today at 877.650.0904.

Noncompliance of HIPAA Security Rules Has Huge Consequences

Noncompliance of HIPAA Security Rules Has Huge Consequences

The noncompliance of HIPAA security rules has had huge consequences for an IT and health information management company.

CHSPSC LLC, (“CHSPSC”) has agreed to pay over $2 million to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS), for the breach of Protected Health Information (PHI). The Business Associate was notified by the Federal Bureau of Investigation (FBI) that it had traced a cyber-hacking group’s advanced persistent threat into CHSPSC’s information system.

After OCR ‘s investigation, it was found that CHSPSC had “longstanding, systemic noncompliance with the HIPAA Security Rule including failure to conduct a risk analysis, and failures to implement information system activity review, security incident procedures, and access controls.” The large health system provided various Business Associate services, including IT and health information management, to hospitals and physician clinics. These violations could have easily been avoided! OCR Director Roger Severino said, “The healthcare industry is a known target for hackers and cyber-thieves. The failure to implement the security protections required by the HIPAA Rules, especially after being notified by the FBI of a potential breach, is inexcusable.”

 

In addition to the monetary penalty, the Business Associate will be required to complete a “robust” Corrective Action Plan (CAP) with monitoring activity for at least the next two years. CHSPSC will also be required to do the following:

Implement technical policies and procedures to allow access only to those persons or software programs that have been granted access rights to information systems maintained
Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports
Conduct accurate and thorough assessments of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI

All this shows that ANYONE can face HUGE penalties, and they would most likely bankrupt a small billing company or an independent physician practice.

 

So, based on this specific example, it is VERY important to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, a billing company, or other vendor, suspect a breach, you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action.

Keep in mind, a Business Associate is a ‘person’ or ‘entity’. This means that ALL billing companies—large or small—need to comply with the Federal HIPAA security rules and regulations. So, if your company has not completed an accurate and thorough security risk assessment, there is a possibility that you could be penalized under ‘willful neglect’. (This category alone gas a fine of $50,000 per violation!)

 

So then, what can be done to ensure this doesn’t happen to my billing company or my organization? Well, one of EZClaim’s partners, Live Compliance, can make determining your compliance requirements extremely simple:

Completely online, Life Compliance’s role-based courses make training easy for remote or in-office employees
Contact-free, accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
Policies and procedures are curated to fit your organization, ensuring employees are updated on all workstation use and security safeguards in or out of the office. Update is in real time.
Electronic, prepared document sending and signing to employees and business associates

 

So, don’t risk your company’s future, especially when Life Compliance is offering a FREE Organization Assessment to help determine your company’s status. Either call Life Compliance at 980.999.1585, visit LiveCompliance.com to schedule an assessment, or e-mail Jim Johnson.

[ Article contributed by Jim Johnson of Live Compliance ]

———————————-

ABOUT EZCLAIM:
EZClaim is a medical billing and scheduling software company that provides a best-in-class product, with correspondingly exceptional service and support, and can help improve medical billing revenues. To learn more, visit their website, e-mail them at sales@ezclaim.com, or call a representative today at 877.650.0904.

CMS HHS Updates Telehealth Regulations

CMS HHS Updates Telehealth Regulations

Since CMS HHS just updated their Telehealth regulations to adjust to the COVID-19 environment—including having a remote workforce—we wanted to provide a clear update to independent physicians and billers to advise them of the fast-moving changes of many regulations, and what to expect in the near future.

It is important to note that CMS has recently announced that new and established patients have availability to Telehealth, and HHS OIG is providing flexibility for healthcare providers to reduce or waive cost-sharing for Telehealth visits paid by federal healthcare programs. CMS is also expanding Telehealth services to people with medicare.

As a result, please see the below video from CMS which highlights the Medicare Coverage and Payment of Virtual Services and Telehealth.

In addition, we’ve included a few key questions and answers below. If you have further questions about Telehealth and your compliance, contact Jim Johnson with Live Compliance at Jim@LiveCompliance.com or (980) 999-1585.

1. Who can provide Telehealth services?

    • Physicians
    • Nurse Practitioners
    • Physician assistants
    • Nurse-midwives
    • Certified nurse anesthetists
    • Clinical psychologists
    • Registered dietitians
    • Nutrition professionals

2. What services can a medicare beneficiary receive through Telehealth?

    • Evaluation and management visits (common office visits)
    • Mental health counseling
    • Preventive health screenings
    • More than 80 additional services

3. What are the types of virtual services?

    • Medicare Telehealth visits
    • Virtual check-ins
    • E-visits
    • Telephone services

Live Compliance is an EZclaim premier partner for HIPAA compliance and is integrated into EZclaim’s billing solution.

If you have any further questions about Telehealth regulations and your compliance, e-mail Jim Johnson at Live Compliance at Jim@LiveCompliance.com, or phone him at (980) 999-1585.

[ Contribution by Jim Johnson with the Live Compliance ]