Mar 10, 2020 | Live Compliance, Partner
An independent physician gastroenterology practice in Utah had to report a breach related to a dispute with a Business Associate to the Office for Civil Rights Department of HHS.
After the investigation into the breach, it was determined that the practice of Steven A. Porter, MD “had failed to complete an accurate and thorough risk analysis, and failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level” and therefore, has agreed to pay a $100,000 fine.
In addition to the monetary penalty, the practice is required to implement a Corrective Action Plan (CAP). According to the investigation resolution agreement, the practice agreed to conduct a thorough Risk Analysis, the Practice must develop a complete inventory of all its categories of electronic equipment, data systems, and applications that contain or store ePHI, which will then be incorporated into its Risk Analysis and must complete a Risk Management plan. They must also revise and implement actionable policies and procedures, all of which should have been in place prior to the breach incident.
Have you ever read such headlines and doubted whether a small Billing Company or independent physician practice actually ever face penalties?
According to the Resolution Agreement, the practice must also completely reinvent its Business Associate process, and implement a strict protocol to ensure it’s Business Associates are HIPAA Compliant. In addition to ensuring their Business Associate relationships are accurate, the entire staff must undergo security and privacy training that stresses the use of Business Associate services and applications, disclosures to Business Associates that require a Business Associates agreement, or other reasonable assurances in place to ensure that the Business Associate will and can safeguard the PHI and/or the ePHI. This puts immense pressure on the Business Associates, such as Billing Companies, to ensure that they are HIPAA Compliant, but also independent physician practices to ensure their Business Associates, “down the chain” are also compliant. This is also known as gaining Satisfactory Assurance of vendor HIPAA compliance.
What can you do?
As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, a billing company, or another vendor, suspect a breach you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no Billing Company too small or too large to comply with the Federal HIPAA regulations. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal. Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status. It’s easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com
[ Contributed by Jim Johnson, President of Live Compliance ].
Feb 10, 2020 | Uncategorized
Live Compliance – EZClaim’s trusted HIPAA Compliance Experts
It is often, small companies who work in healthcare falsely assume that HIPAA pertains to large organizations and hospitals, when in fact, a Business Associate, is a person or entity that works with Protected Health Information. Many organizations don’t realize that the fundamentals of a compliance program are Business Associate Agreements, and performing Security Risk Assessments.
In fact, an Indiana-based Business Associate, Medical Informatics Engineering, was recently fined $100,000 for “failing to perform a comprehensive risk assessment before its server was hacked in May 2015” resulting in what was concluded to be “one of the largest breaches in recent healthcare history!” According to the Resolution Agreement, MIE must assess whether its existing security measures are sufficient to protect its ePHI, and must revise its Corrective Action Plan, Policies and Procedures, and training materials, as needed.
In May of 2019, in an effort to make the HIPAA Privacy Rule as easy to understand as possible, the Office for Civil Rights (OCR) has come up with a list of rules that clearly explain what Business Associates are now “directly liable” for. As OCR Director Roger Severino explains, “We want to make it as easy as possible for regulated entities to understand, and comply with, their obligations under the law.”
The list consists of ten rules that, if failed to follow, can result in penalties and monetary fines.
The OCR has made it very clear that even so much as simply “[failing] to comply with the requirements of the Security Rule” can result in immediate penalties as well.
To this end, one of the most important rules also includes information about Business Associate Agreements and their need for proof of Satisfactory Assurance when the Covered Entity requests this of them.
Satisfactory Assurance is crucial because it ensures the Business Associate is HIPAA Compliant and therefore, must also be in the form of a contract. Because it is so often overlooked, the fact
sheet points out that there would be penalties associated with “Failure to enter into business associate agreements.”
Are you ready when asked by your clients to provide your statement of Satisfactory Assurances?
Checking off your Business Associate requirements, including those listed in the OCR’s fact sheet, is very easy with EZClaim’s trusted HIPAA Compliance Experts, Live Compliance.
First, it is most important that all Business Associates and Vendors have proof of Satisfactory Assurance at least annually, as well as a Business Associate Agreement outlining their roles, functions, and notification requirements.
Second, Business Associates and Vendors must complete an accurate and thorough Security Risk Assessment. A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information. Failing to do so could also result in a penalty under ‘willful neglect’. This category alone is $50,000 per violation! These fines are huge, but the reputational damage to your billing company and the covered entity is expensive and difficult to overcome. (Live Compliance has a 100% audit pass rate!)
Lastly, employees should be HIPAA trained with relevant course material to their role and your organization. Your workforce is your first line of defense. Completely built into your portal, Live Compliance training is custom, online, and role-based. Training is delivered and monitored within the Live Compliance portal, anytime and from anywhere.
If you enjoyed this article, please click here to stay up to date with our most recent blog posts! We thank you for reading.
Jan 13, 2020 | Live Compliance, Partner, Support and Training
Lost laptop = $65,000 fine. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties?
What happened? Most recently, an ambulance company out of Georgia paid $65,000 for a lost laptop that happened to be unencrypted. More often, small businesses and practices are taking work outside of the office, so this kind of violation is one that can occur to anyone.
The laptop contained 500 individual’s Protected Health Information. As a result of the investigation, the ambulance company will undergo a Technical Security Risk Assessment and is required to adopt a Corrective Action Plan. This is a great example of why it is important and mandatory to conduct a Technical and Objective Security Risk Assessment at least annually on all devices.
Following the investigation, it was uncovered that West Georgia Ambulance never provided a security awareness and training program for its employees! You and your workforce are your first line of defense. This reinforces the importance that both you, and your employees must understand what a breach is and the breach notification requirements! It was later revealed that West Georgia Ambulance failed to implement HIPAA Security Rule policies and procedures as well.
What can you do? As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, the Billing Company or independent physician practice, suspects a breach or complaint you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy, call us at (980) 999-1585, email me or visit LiveCompliance.com
Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
LEARN MORE
If you are enjoyed this article about the lost laptop as well as the informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.
Dec 10, 2019 | AMBA National Conference, Live Compliance
Compliance Plan Breakout
AMBA 2019 National Conference Session Recap
Compliance Plan Breakout – Written by Stephanie Cremeans of EZClaim
Any provider that is treating Medicare or Medicaid patients is required to have a compliance plan for their practice. This is mandated under the Patient Protection and Affordable Care Act of 2010.
The Office of Inspector General (OIG) has established an outline of seven components to help the small or individual provider offices get started. They also understand that small practices don’t typically have extensive resources creating and establishing a plan, and encourage practices to start with one item, making the compliance plan a working document that is updated and added to as necessary. The seven components are as follows:
- Conduct internal monitoring and auditing
- Implement compliance and practice standards
- Designate a compliance officer or contact
- Conduct appropriate training and education
- Respond appropriately to detected offenses and develop corrective action
- Develop open lines of communication with employees
- Enforce disciplinary standards through well-publicized guidelines
Let’s dig in a bit to the first component, conducting internal monitoring and auditing. Starting with this step will help a practice lay the groundwork of its compliance plan and shed light on areas that need additional work. There is no set number of records that are required to be audited, rather a suggestion of 5 (or more) per provider annually for a small or solo practice. You can start your compliance plan by simply documenting that no less than 5 charts per provider will be audited annually. Keep track of the results and use them to start implementing other components. For instance, you have the audit results, but what is considered passing? What are you going to do if a provider isn’t compliant? Document the answers and you are building your plan. Did the audit show specific areas for improvement? Find applicable training or host training for those that need it, document it in your plan. Did you find overpayments? Document how these are to be handled, resolve them quickly, and put policies in place to prevent a bigger problem.
By taking steps to create a compliance plan and show a good-faith effort to improve on risk areas your practice will reap the benefits of clean claims with a reduction in denials, fewer billing errors, and the assurance that your records are ready for an audit. This will also reduce your risk exposure to fines.
For help getting started with that first audit, setting benchmarks and improvement plans or for education on problem areas contact RCM Insight. For additional assistance with building your HIPAA compliance plans contact Live Compliance.
If you are enjoying the informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.
Dec 10, 2019 | Administrative Safeguards, Live Compliance, Partner
ONE patient complaint leads to $2.175 Million fine! AND 2 Years of OCR Monitoring.
Contributed by Jim Johnson, President of Live Compliance
One patient complaint, that’s all it takes. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties? Actually, there should be no doubt! The Sentara Hospital violations are violations that every small billing company or independent physician practice would face, not just because Sentara is a hospital.
So what happened? In short, a complaint from an individual came from a person receiving a bill containing another individual’s billing statement. As a result of Sentara investigating this breach, Sentara reported a breach affecting 8 individuals, when in actuality, Sentara mailed 577 patient’s statements to the wrong addresses. This is an example of why you must perform and document a breach risk analysis as soon as you become aware of a potential incident. It is important that you understand what a breach is and the breach notification requirements.
The second issue discovered during the investigation revealed Sentara failed to have a business associate agreement in place with an entity that performed business associate services for Sentara. This reinforces the importance of having business associate agreements in place and your understanding that BAA’s are contracts that outline timeframes and provide your attestation to a satisfactory assurance of your ability to safeguard PHI among other things.
Maybe most importantly, you should know every complaint must be investigated by HHS/OCR. What that means is, if you improperly disclose protected health information, like sending a statement to the wrong patient, you, a billing company, must inform the covered entity (your client) and have a breach risk assessment completed to determine several key factors. Then the covered entity must take action based on these findings. If you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
In fact, Texas Health received a $1.6 million fine for improperly disclosing ePHI. Texas Health failed to comply with several HIPAA requirements including failure to perform the HIPAA Security Risk Assessment.
The fines are huge, but the reputational damage to your billing company and the covered entity is expensive and difficult to overcome.
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com
Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
LEARN MORE
Click here to read more informative articles from EZClaim and our partners.
