So, what’s the best path for HIPAA Compliance? It’s risk analysis.
The HIPAA Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) that it creates, receives, maintains, or transmits.
Conducting a risk analysis—which is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI held by an organization—is not only a Security Rule requirement, but is also fundamental to identifying and implementing safeguards that comply with and carry out the Security Rule standards and implementation specifications.
However, despite this long-standing HIPAA requirement, OCR investigations frequently find that organizations lack sufficient understanding of where all of the ePHI entrusted to their care is located.
Although the Security Rule does not require it, creating and maintaining an up-to-date, information technology (IT) asset inventory could be a useful tool in assisting in the development of a comprehensive, enterprise-wide risk analysis, to help organizations understand all of the places that ePHI may be stored within their environment, and improve their HIPAA Security Rule compliance.
How Can You Manage This at Your Organization?
You can try to manage this by yourself, but it would probably be more efficient and superior in implementation if you used an expert. A partner of EZClaim, Live Compliance, is one of those experts. They can help you easily manage, maintain, and assign your hardware and technical inventory to remote or in-office employees.
Do You Have Additional Questions?
If you have any questions about the best path for HIPPA compliance, contact Jim Johnson at Live Compliance (E-mail: firstname.lastname@example.org; Phone: (980) 999-1585).
For more on EZClaim’s products, either schedule a one-on-one consultation with their sales team, or download a FREE TRIAL to check it out the software yourself. For additional information right now, view their web site, send an e-mail to email@example.com, or contact the sales team at 877.650.0904.
[ Article contributed by Jim Johnson of Live Compliance ]
Failing to implement HIPAA causes a large fine for a small town North Carolina health services provider. They were fined $25,000 for multiple, easily avoidable, HIPAA violations for “longstanding, systemic noncompliance” with the HIPAA Security Rule. [Note: The provider is a part of a health center which offers discounted medical services to the underserved population in rural NC, and the fines were reduced in consideration of this, but it still resulted in a significant monetary loss].
In 2011, Metropolitan Community Health Services (Metro), doing business as Agape Health Services, filed a breach report regarding “the impermissible disclosure of protected health information to an unknown email account.” The breach affected over 1,200 patients!
In addition to the large monetary penalty, the practice is required to develop and adopt a corrective action plan (which includes two years of thorough monitoring) after the Office for Civil Rights (OCR) discovered that Metro failed to conduct a thorough and comprehensive HIPAA Security Risk Assessment and Analysis. In addition, Metro did not implement a single HIPAA Security Rule Policy and Procedure for the health center. Possibly worst of all, Metro failed to provide workforce members with HIPAA Privacy and Security Awareness training until 2016!
Patients must trust who they share their personal, private, and protected health information with. A breach such as this, is obviously devastating for the patient, in addition to their doctor’s reputation. So, how can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?
First off, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so highlights any major flaws in a practice’s administrative and technical safeguards, and accentuates the policies and procedures that the practice needs to implement.
In addition to that, the designated HIPAA Privacy and Security Officer must ensure that ALL employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy Rule and actionable policies and procedures.
So, remember, healthcare organizations and their vendors have a responsibility to be HIPAA compliant, and that starts by performing, updating, or reviewing an accurate and thorough Security Risk Assessment covering your technical, administrative, and physical safeguards. This will help uncover any vulnerabilities, and help you understand what information is being transmitted, shared, and how it is being transmitted.
TAKE AWAYS AND THINGS TO CONSIDER:
- Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
Remediate any potential risks or vulnerabilities.
- A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information (PHI)
- Develop actionable policies and procedures that clearly outline disclosures of PHI
- Ensure all employees have a clear understanding of the HIPAA Privacy rule and its policies and procedures
Live Compliance provides everything you need to become and maintain your organization’s HIPAA compliance requirements. All policies and procedures can be edited and shared directly with staff from your staff portal. Trainings are delivered and monitored within your portal, can be customized, role-based, and be accessed anytime and from anywhere. You can also easily send and monitor HIPAA training with one click.
Failing to implement HIPAA can cause tremendous problems and use precious resources and time to implement. Live Compliance makes it 10X easier than trying to do it on your own.
So, take advantage of Live Compliance’s FREE Organization Needs Assessment to understand your immediate compliance needs. For additional details, e-mail Jim Johnson (at firstname.lastname@example.org), call (980) 999-1585, or visit their website at livecompliance.com/oa
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
[ Written by Jim Johnson, President of Live Compliance ]
On March 26, 2020 Washington D.C significantly amended its Data Breach Notification Law (D.C. Act 23-268), to expand the definition of personal information and require businesses obtaining such information to implement “reasonable security safeguards”. The new law took effect on May 19, 2020 in the midst of dramatic societal change. Indeed, COVID-19 has accelerated the digital transition and hastened the need for security and privacy issues to be at the forefront of state legislature. So, what are the major changes and updates under the D.C Act 23-268?
A Broader Definition of Personal Information
The definition of personal information has been significantly expanded and includes several new elements. Previously, the law only considered personal information to be a person’s first name (or initial) and surname and sensitive identifying numbers i.e. social security number, driver’s license number, D.C identification card number or credit card number.
Personal information also included a combination of a person’s name and any codes that would enable access to a person’s individual financial or credit account. The current update expands the definition of what is classified as personal information to the following:
- Unique Identification Numbers: passport number, taxpayer identification number or any other identification number issued on a government document.
- Medical Information: DNA profile or genetic, biometric or health insurance information.
- Financial information: Account number or any numbers or codes allowing access to an individual’s financial or credit account.
- Other Data: Any listed data that would allow an individual to carry out identity theft. The new legal definition also includes any username or email address combined with any information allowing access to another’s personal account.
Mandatory Breach Notification
- C Attorney General Notification Notices:
The law previously only required the D.C Attorney General to be notified if over 1,000 residents were affected by a data security breach. It now requires the D.C Attorney General to be notified when a qualifying data breach affects 50 D.C residents or more. The notice must include the nature and cause of the data breach, the number of affected residents, types of personal information compromised and corrective steps that have been taken.
- Individual Breach Notification Notices:
Affected residents must also be notified ‘’in the most expedient manner possible, without unreasonable delay’’. New content requirements for individual breach notification notices include the types of data compromised and toll-free numbers for credit reporting agencies and the D.C Attorney General.
Business and Service Provider Security Requirements
Businesses and service providers are now subject to more stringent security protection requirements. Any organization handling D.C residents’ personal information must “implement and maintain reasonable security safeguards”. The amended law also stipulates that any entity using a third-party service provider must have a written agreement in place requiring the latter to “implement and maintain reasonable security safeguards”.
Failure to comply with the new legal requirements of the new Data Breach Notification Law and to implement and ensure “reasonable security safeguards’, there could be significant economic and reputational loss.
To assist you in identifying the extent to which your organization is at risk of a data breach, Life Compliance is offering a FREE Organization Assessment to determine your company’s specific vulnerabilities and risk exposure to cyber crime. This will ensure you have the best possible insight and protection as you guide your company into the digital future.
Live Compliance provides all of your HIPAA privacy, security requirements, and measures. HIPAA compliance is a requirement for Covered Entities and Business Associates to safeguard personal, private, and protected health information. Organizations can excel in health care without the struggle of compliance requirements.
Live Compliance is a preferred partner of EZClaim, and their software is integrated into our medical billing software. For detailed product features or general information about EZClaim medical billing solutions, visit our website, contact us via e-mail, or call our support team directly at 877.650.0904.
[ Written by Jim Johnson, President of Live Compliance ]
Ransomware Targeting Medical Billing Companies
As the number of healthcare providers taking advantage of Telehealth increases during this uncertain time, the number of ransomware attacks continues to increase as well.
Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid. Microsoft says, “Multiple ransomware groups that have been accumulating access and maintaining persistence on target networks for several months activated dozens of ransomware deployments in the first two weeks of April 2020.”
The attacks are targeted towards aid organizations, medical billing companies, manufacturing, transport, government institutions, and educational software providers, however, Microsoft says that it doesn’t stop with critical service groups and suggests all networks are aware of these attacks and taking necessary steps to limit risk. NetWalker ransomware, for example, gained notoriety for targeting hospitals and healthcare providers with e-mails claiming to provide information about COVID-19.
Have you had an Accurate and Thorough Security Risk Assessment and/or penetration testing?
If you haven’t completed an accurate and thorough security risk assessment, you could also be penalized under ‘willful neglect’ (this category alone is $50,000 per violation!) in addition to the higher risk of ransomware attacks. What we do is keep this from ever being a worry for you! We perform your security risk assessment and manage all of your requirements, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy! Call us at (980) 999-1585, or email me, Jim Johnson at jim@LiveCompliance.com or visit
Live Compliance has partnered with EZClaim medical billing software to strengthen what they can provide for you. It provides all of your HIPAA Privacy, Security Requirements, and Measures. HIPAA compliance is a requirement for Covered Entities and Business Associates to safeguard personal, private, and protected health information—allowing organizations to relinquish the struggle of compliance requirements.
You can investigate the EZClaim medical billing software by either downloading a FREE DEMO, or just contact our knowledgeable sales staff to answer any and all of your questions by phone at (877) 650-0904 or by e-mail at email@example.com.
[Contributed by Jim Johnson of Live Compliance]
Since CMS HHS just updated their Telehealth regulations to adjust to the COVID-19 environment—including having a remote workforce—we wanted to provide a clear update to independent physicians and billers to advise them of the fast moving changes of many regulations, and what to expect in the near future.
It is important to note that CMS has recently announced that new and established patients have availability to Telehealth, and HHS OIG is providing flexibility for healthcare providers to reduce or waive cost sharing for Telehealth visits paid by federal healthcare programs. CMS is also expanding Telehealth services to people with medicare.
As a result, please see the below video from CMS which highlights the Medicare Coverage and Payment of Virtual Services and Telehealth.
In addition, we’ve included a few key questions and answers below. If you have further questions about Telehealth and your compliance, contact Jim Johnson with Live Compliance at Jim@LiveCompliance.com or (980) 999-1585.
1. Who can provide Telehealth services?
- Nurse Practitioners
- Physician assistants
- Nurse midwives
- Certified nurse anesthetists
- Clinical psychologists
- Registered dietitians
- Nutrition professionals
2. What services can a medicare beneficiary receive through Telehealth?
- Evaluation and management visits (common office visits)
- Mental health counseling
- Preventive health screenings
- More than 80 additional services
3. What are the types of virtual services?
- Medicare Telehealth visits
- Virtual check ins
- Telephone services
Live Compliance is an EZclaim premier partner for HIPAA compliance, and is integrated into EZclaim’s billing solution.
If you have any further questions about Telehealth regulations and your compliance, e-mail Jim Johnson at Live Compliance at Jim@LiveCompliance.com, or phone him at (980) 999-1585.
[Contribution by Jim Johnson with the Live Compliance]