New HIPAA compliance requirements are coming!
In an effort to make the HIPAA Privacy Rule as easy to understand as possible, the Office for Civil Rights (OCR) has come up with a list of rules that clearly explain what Business Associates are now “directly liable” for. As OCR Director Roger Severino explains, “We want to make it as easy as possible for regulated entities to understand, and comply with, their obligations under the law.” The list consists of ten rules that, if failed to follow, can result in penalties and monetary fines.
[ Note: Check out our previous post to access this list ].
As we enter the fourth quarter of the year, you may be wondering what immediate requirements should a Business Associate complete before the end of the year?
One of the most important rules also includes information about Business Associates, and their need for proof of satisfactory assurance when the covered entity requests this of them. Satisfactory assurance is crucial, because it ensures the Business Associate is HIPAA compliant, and therefore, must also be in the form of a contract.
The Satisfactory Assurance contract is oftentimes outlined in the form of a questionnaire, and requires the Business Associate to disclose the date of completion for various compliance requirements.
These include distribution and completion of workforce HIPAA training, implementation and distribution of policies and procedures, Business Associate documentation, and completion of an annual HIPAA Security Risk Assessment.
Are You Prepared?:
If a Covered Entity requests this proof from your organization, would you be able to successfully complete it without outdated completion?
If you are uncertain that your organization would be able to easily and efficiently provide that documentation, you may be facing thousands of dollars in fines for each vulnerability!
HIPAA Compliance Myths:
False: The security risk analysis is optional for small providers: All providers who are “Covered Entities” under HIPAA are required to perform a risk analysis. In addition, all providers who want to receive MU, and MIPS incentive payments must conduct a risk analysis.
False: Our office uses the Cloud, so we don’t need a risk assessment: Even if you have a fully HIPAA compliant cloud vendor, your patient data (ePHI and PII) still must go through all your systems to get to the cloud. So, you are still required to perform technical, administrative, and physical security risk analyses.
False: Our EHR makes us compliant, so we’re fine: While your EHR may provide excellent privacy and security features, it definitely doesn’t exempt you from the HIPAA security requirements.
Live Compliance helps their clients meet the ever changing and complex HIPAA State and Federal regulations. They protect the information they are entrusted with, and ensure their clients pass any Health and Human Services audits. If you are unsure or need assistance, call Jim Johnson with Live Compliance at (980) 999-1585.
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
Credit card collections are a BIG part of any successful medical practice, and there has been a shift, in the last decade, that more insurance policies are adding co-pays with higher deductibles—which makes getting paid even more challenging.1 One industry report said that “73% of physicians shared that it typically takes at least one month to collect a payment, and 12% of their patients wait more than three months to pay.”2 With the current trend, more medical practices and their billing departments (or outsourced billing firms) are going the route of processing payment via credit cards, which has its PROS and CONS.
In light of this new information, the following are a few pros and cons for credit card processing that we anticipate in the near future, and some insights for choosing the best billing software that supports the credit card processing needs of medical practices:
- PRO: To protect against the dangers of stolen data, fraud, or other compromises in security, practices should seek out medical billing software that has credit card processing built-in, which can help safeguard against these dangers.
- CON: Security is a big risk, and a leak in data leading to stolen funds can end up in a physician paying out-of-pocket for the breach. It is also important to note that breach of credit card data is also considered a violation under the federal Health Insurance Portability and Accountability Act (HIPAA).
- PRO: Implementing credit card processing will reduce long waiting periods for payments from the majority of your patients, and will also reduce the additional effort your billing staff has to extend to collect on overdue notices.
- CON: Practices cannot require patients to share their credit card information to receive medical care, and even if patients do share their credit card information, physicians cannot continue to charge the credit card without a patient’s consent.
- PRO: Physicians can end the process of being a “line of credit” to unpaid or underpaid claims, and collect on funds immediately.
- CON: You will need to implement internal processes that include, but are not limited to proper personal information storage and security, establishing guidelines on maximum percentages charged per bill, and personal consent forms.
Overall, there are definitely MORE ‘PROS’ than cons for implementing credit card processing for your medical practice, and all the trends are pointing to this being the PREFERRED METHOD of payment in the near future. EZClaim is proud to announce that it will release an integrated credit card processing solution, EZClaimPay, that is backed by a national merchant services vendor. [ EZClaim will be sharing more details about EZClaimPay in the weeks to come, via their social media platforms, their monthly newsletter, direct communications, and more ].
In addition to the credit card collections PROS and CONS above, we reached out to one of our partners, Live Compliance, to gather some regulatory and security advice. They suggested the following:
- When accessing, transmitting, storing, or receiving any Protected Health Information (PHI), Health and Human Services (HHS) Office of Civil Rights (OCR) mandates that you are to maintain HIPAA compliance.
- When accepting, processing, or maintaining credit card information and debit card information, you must ensure that your organization is PCI DSS compliant (Payment Card Industry Data Security Standard).
- In addition to the above Federal regulatory requirements, most states require privacy and security compliance requirements to be implemented, along with strict adherence to the privacy of Personally Identifiable Information (PII) and Breach Notification requirements.
For more information on your compliance requirements, visit Live Compliance for a Free Organization Assessment to identify and uncover your organization’s vulnerabilities.
If you are not a current customer of EZClaim, we would very much like to connect with you. You can either schedule a one-on-one consultation with our sales team, view a recorded demo, or download a FREE 30-day trial right now. For detailed product features or general information about EZClaim, visit our website at ezclaim.com.
[ NOTE: If you would like a quote on the upcoming merchant services, please e-mail firstname.lastname@example.org your last three merchant statements. For more on our ongoing updates and industry news, you can follow EZClaim on Facebook and LinkedIn ].
1 – America’s Health Insurance Plans” report that there were 20.2 million co-pays in 2017, which was up tremendously from just over 1 million in 2005.
2 – Source: From InstaMed’s annual “Trends in Healthcare Payments” report.
> For more on this topic, read a previous article, “Why Do I Have A Balance? – Patient Payments”