Oct 13, 2020 | HIPAA, Live Compliance, Medical Billing Software Blog, Partner
New HIPAA compliance requirements are coming!
In an effort to make the HIPAA Privacy Rule as easy to understand as possible, the Office for Civil Rights (OCR) has come up with a list of rules that clearly explain what Business Associates are now “directly liable” for. As OCR Director Roger Severino explains, “We want to make it as easy as possible for regulated entities to understand, and comply with, their obligations under the law.” The list consists of ten rules that, if failed to follow, can result in penalties and monetary fines.
[ Note: Check out our previous post to access this list ].
Immediate Requirements:
As we enter the fourth quarter of the year, you may be wondering what immediate requirements should a Business Associate complete before the end of the year?
One of the most important rules also includes information about Business Associates, and their need for proof of satisfactory assurance when the covered entity requests this of them. Satisfactory assurance is crucial, because it ensures the Business Associate is HIPAA compliant, and therefore, must also be in the form of a contract.
The Satisfactory Assurance contract is oftentimes outlined in the form of a questionnaire, and requires the Business Associate to disclose the date of completion for various compliance requirements.
These include distribution and completion of workforce HIPAA training, implementation and distribution of policies and procedures, Business Associate documentation, and completion of an annual HIPAA Security Risk Assessment.
Are You Prepared?:
If a Covered Entity requests this proof from your organization, would you be able to successfully complete it without outdated completion?
If you are uncertain that your organization would be able to easily and efficiently provide that documentation, you may be facing thousands of dollars in fines for each vulnerability!
HIPAA Compliance Myths:
False: The security risk analysis is optional for small providers: All providers who are “Covered Entities” under HIPAA are required to perform a risk analysis. In addition, all providers who want to receive MU, and MIPS incentive payments must conduct a risk analysis.
False: Our office uses the Cloud, so we don’t need a risk assessment: Even if you have a fully HIPAA compliant cloud vendor, your patient data (ePHI and PII) still must go through all your systems to get to the cloud. So, you are still required to perform technical, administrative, and physical security risk analyses.
False: Our EHR makes us compliant, so we’re fine: While your EHR may provide excellent privacy and security features, it definitely doesn’t exempt you from the HIPAA security requirements.
Live Compliance helps their clients meet the ever changing and complex HIPAA State and Federal regulations. They protect the information they are entrusted with, and ensure their clients pass any Health and Human Services audits. If you are unsure or need assistance, call Jim Johnson with Live Compliance at (980) 999-1585.
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
Sep 10, 2020 | Live Compliance, Medical Billing Software Blog, Partner
So, what’s the best path for HIPAA Compliance? It’s risk analysis.
The HIPAA Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) that it creates, receives, maintains, or transmits.
Conducting a risk analysis—which is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI held by an organization—is not only a Security Rule requirement, but is also fundamental to identifying and implementing safeguards that comply with and carry out the Security Rule standards and implementation specifications.
However, despite this long-standing HIPAA requirement, OCR investigations frequently find that organizations lack sufficient understanding of where all of the ePHI entrusted to their care is located.
Although the Security Rule does not require it, creating and maintaining an up-to-date, information technology (IT) asset inventory could be a useful tool in assisting in the development of a comprehensive, enterprise-wide risk analysis, to help organizations understand all of the places that ePHI may be stored within their environment, and improve their HIPAA Security Rule compliance.
How Can You Manage This at Your Organization?
You can try to manage this by yourself, but it would probably be more efficient and superior in implementation if you used an expert. A partner of EZClaim, Live Compliance, is one of those experts. They can help you easily manage, maintain, and assign your hardware and technical inventory to remote or in-office employees.
Do You Have Additional Questions?
If you have any questions about the best path for HIPPA compliance, contact Jim Johnson at Live Compliance (E-mail: jim@livecompliance.com; Phone: (980) 999-1585).
For more on EZClaim’s products, either schedule a one-on-one consultation with their sales team, or download a FREE TRIAL to check it out the software yourself. For additional information right now, view their web site, send an e-mail to sales@ezclaim.com, or contact the sales team at 877.650.0904.
[ Article contributed by Jim Johnson of Live Compliance ]
Aug 11, 2020 | ChartSwap, Partner
An online “Health Information Exchange” (HEI) can be the answer to managing the release-of-information (ROI) process completely digitally.
Many healthcare providers are spending a significant amount of time and money on fulfilling requests for medical and/or billing records. Outdated and inefficient modes of technology like printers, postal mail and fax machines make up much of that cost. Time spent on having employees complete record fulfillment operation—or money spent on working with third-party release-of-information (ROI) companies—add significantly to strains on manpower and/or budgets. Then add in the money spent on postage and in-office time spent responding to status calls, and you have a significant cost center that is not benefitting your business.
In today’s digital world, both businesses and consumers expect efficient, safe, online transactions. While the healthcare industry had a longer grace period for digital transformation initiatives, a new survey reveals that 75% of people now expect the same service from healthcare organizations that they receive from other businesses. This is driving many organizations to re-think the current, highly ROI process and seek a simple, secure, and more cost-effective digital ROI solution.
Utilizing an online Health Information Exchange may be the answer to your problems. By utilizing the FREE proprietary software that the country’s fastest growing HIE, ChartSwap, healthcare entities can manage the ROI process completely digitally in a HIPPA- and HITECH-compliant, SOC 2, Type II-certified and conveniently cloud-based environment. In addition to eliminating the need for paper, printers, postage, and other unnecessary and inconvenient expenses, ChartSwap allows records providers to conduct all communication with requestors 100% online without the security concerns associated with e-mail.
ChartSwap users set their own fees and can quickly and conveniently collect payments electronically via either credit card or PayPal (which includes the option for ACH transfer). Over 90% of ChartSwap requestors use online payment methods, and for the few who still prefer to send a paper check, ChartSwap handles the receipt and processing of those payments on your behalf. That means that 100% of your payments for medical and billing records will be handled by the ChartSwap platform—at absolutely no cost to you!
Using ChartSwap has been shown to improve employee productivity by 50% or more, thanks to ChartSwap’s advanced digital workflows, automatic status alerts, and fully online communication model. Additionally, the turnaround time for fulfilling records requests via ChartSwap can be as quick as two days and rarely exceeds 14 days—that’s more than 50% faster than the turnaround time on requests fulfilled by traditional methods.
To learn more about taking back control of your office’s record fulfillment operations, and turn this cost center into a profit center, visit ChartSwap today.
ChartSwap is a partner of EZClaim, a medical billing software solution. For more details about EZClaim, visit their website at EZClaim.com
Aug 11, 2020 | Administrative Safeguards, Live Compliance, Partner
Failing to implement HIPAA causes a large fine for a small-town North Carolina health services provider. They were fined $25,000 for multiple, easily avoidable, HIPAA violations for “longstanding, systemic non-compliance” with the HIPAA Security Rule. [ Note: The provider is a part of a health center that offers discounted medical services to the underserved population in rural NC, and the fines were reduced in consideration of this, but it still resulted in a significant monetary loss ].
In 2011, Metropolitan Community Health Services (Metro), doing business as Agape Health Services, filed a breach report regarding “the impermissible disclosure of protected health information to an unknown email account.” The breach affected over 1,200 patients!
In addition to the large monetary penalty, the practice is required to develop and adopt a corrective action plan (which includes two years of thorough monitoring) after the Office for Civil Rights (OCR) discovered that Metro failed to conduct a thorough and comprehensive HIPAA Security Risk Assessment and Analysis. In addition, Metro did not implement a single HIPAA Security Rule Policy and Procedure for the health center. Possibly worst of all, Metro failed to provide workforce members with HIPAA Privacy and Security Awareness training until 2016!
Patients must trust with who they share their personal, private, and protected health information. A breach such as this is obviously devastating for the patient, in addition to their doctor’s reputation. So, how can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?
First off, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so highlights any major flaws in a practice’s administrative and technical safeguards, and accentuates the policies and procedures that the practice needs to implement.
In addition to that, the designated HIPAA Privacy and Security Officer must ensure that ALL employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy Rule and actionable policies and procedures.
So, remember, healthcare organizations and their vendors have a responsibility to be HIPAA compliant, and that starts by performing, updating, or reviewing an accurate and thorough Security Risk Assessment covering your technical, administrative, and physical safeguards. This will help uncover any vulnerabilities, and help you understand what information is being transmitted, shared, and how it is being transmitted.
TAKEAWAYS AND THINGS TO CONSIDER:
- Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
Remediate any potential risks or vulnerabilities.
- A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information (PHI)
- Develop actionable policies and procedures that clearly outline disclosures of PHI
- Ensure all employees have a clear understanding of the HIPAA Privacy rule and its policies and procedures
Live Compliance provides everything you need to become and maintain your organization’s HIPAA compliance requirements. All policies and procedures can be edited and shared directly with staff from your staff portal. Training are delivered and monitored within your portal, can be customized, role-based, and be accessed anytime and from anywhere. You can also easily send and monitor HIPAA training with one click.
Failing to implement HIPAA can cause tremendous problems and use precious resources and time to implement. Live Compliance makes it 10X easier than trying to do it on your own.
So, take advantage of Live Compliance’s FREE Organization Needs Assessment to understand your immediate compliance needs. For additional details, e-mail Jim Johnson (at jim@livecompliance.com), call (980) 999-1585, or visit their website at livecompliance.com/oa
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
[ Written by Jim Johnson, President of Live Compliance ]
Jul 14, 2020 | Alpha II, MIPS Reporting, Partner, Webinar
Join this MIPS Reporting Webinar to be sure you are up to speed on the latest updates and changes.
Now that the MIPS (Merit-based Incentive Payment System) submission period is drawing to a close, join our partner, Alpha II, as they review the updates and changes for MIPS reporting in 2020. This session will discuss important program updates for 2020 reporting including:
• Eligibility requirements
• Performance thresholds
• Payment adjustments
• Performance category weighting
• Measure updates and more…
MIPS Reporting Webinar details:
Start reporting correctly now to ensure success for the 2020 performance year!
