HIPAA Security Rule requirements, Part I

It is hard to believe we are in 2021, but I am sure you are like the rest of us and glad to see 2020 in the rear-view mirror.

As we move into this new year, we need to look ahead and learn from what has happened in the past. Last month we informed you about many HIPAA violations that the Office for Civil Rights (OCR) had investigated. Most of these violations could have been prevented. In fact, I was talking with a colleague that owns an audit log monitoring system and he informed me that during the pandemic they saw a 90% increase in snooping into patient records of the same last name. Fortunately for his clients, this was immediately stopped, and the employee(s) were sanctioned. This made me want to remind you of a few requirements under HIPAA.

 

  • 164.308(a)(1)(ii)(c) Sanction Policy – is a “required” standard under the HIPAA Security Rule. Employers are required by law to apply sanctions against employees who violate HIPAA, otherwise the employer could be fined.

 

  • 164.308(a)(1)(ii)(d) Information System Activity Review – is another required standard. Which requires procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. A security incident can be best described as the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

 

  • 164.312(b) Audit Controls – is yet another required standard that states you must implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information (ePHI). This standard goes hand in hand with Information System Activity Review.

 

What does this mean to you?

First, you must understand what is considered “normal” usage within your software/hardware that contains ePHI. Then you must monitor your systems for abnormal behavior. This is a HUGE time-consuming task and unless you are monitoring every employee, 24/7 you may miss something. We highly recommend utilizing a third party to do this for you. The company we work with has interfaces with over 60 EHRs and is fully automated. If they do not have an interface, they will create one, or show you how to upload the logs in a matter of minutes instead of hours. No more looking over lengthy audit log reports. You simply receive an alert when there is abnormal activity. Best of all, this protects your patient data and your practice from fines and penalties. If you would like to learn more about this service, use the contact us page.

 

If you need assistance with HIPAA Risk Management or guidance with your HIPAA Compliance, contact us at 877.659.2467 or complete the contact us form.

HIPAA Fines assessed to small practices

We find this difficult to talk about especially during these trying times. However, we feel it is important for all practices to know that HIPAA violations and fines have not disappeared during this pandemic.

Investigations take a long time and many practices think since they have not heard of small practices being fined that they are immune. Unfortunately, that is not true. Fines are smaller, but even the “small” fines hurt small practices. Could you afford $25K or $50K in fines?

The latest fine of $25K for ongoing HIPAA violations could have been more but the statute of limitations is 6 years. It was reported that they had failed to implement security rule policies and procedures, failed to provide their employees with security awareness and training, and they failed to conduct a thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI they held.

To read the full resolution agreement click here:

https://www.hhs.gov/sites/default/files/metro-signed-agreement.pdf

We understand that after you conduct the HIPAA risk analysis, the hard work begins. Implementing your HIPAA policies and procedures and documenting your risk management plan are difficult and there never seems to be enough hours in the day to complete this task. This is a MUST. If you do not have the time, then you need to hire someone or a company to do this for you.

If you would like more information, contact us at 877.659.2467 or complete the contact us form.

 

“Simplifying HIPAA through Partnership, Education, and Support”

Have you “Googled” yourself lately?

 

By Aris Medical Solutions

 

Modern technology is both amazing and scary! Do you know what is being said about you or your organization? In today’s world we must keep up with what is being said on the World Wide Web (WWW) to make sure what the world sees and reads is not Fake News! It also helps you to uncover any broken links to your website that may frustrate potential new patients from actually finding you.

It is a proven fact that before a person buys nearly anything, they “Google” it. This includes finding services as well as looking for a new physician. Do you want to increase your patient visits? Are you being found? Is the information that is out there correct? We suggest searching for your name, practice name, address, and phone numbers to see what is listed. Also check the websites that rate physicians.

Do you have any social media sites? Did you know that someone else can create one for you? These are called “unofficial” sites in Facebook. Patients could be checking in and writing negative comments about your practice and you may not even know about it. That is why it is so important to keep an watchful eye! However, be very careful how you respond. Patients have the right to tell the world about themselves but healthcare providers do not!

Before you venture into any marketing campaigns, make sure you are not violating any privacy laws. If you decide to hire a marketing company or reputation management service; insist on a company that is well versed in the medical arena. Special HIPAA regulations are required in marketing and we have heard some practices being charged with HIPAA violations due to their service provider. Also, remember to check your state laws as well!

For more information on how Aris Medical Solutions can help your organization with HIPAA Compliance and Protecting your Practice call 877.659.2467 or click here to contact us.

“Protecting Organizations through Partnership, Education, and Support”

©2021 Aris Medical Solutions – HIPAA Risk Management | HIPAA Compliance Consultants | All Rights Reserved | Terms and Conditions | Privacy Policy
The content and images on this website is owned by Aris Medical Solutions and their owners. Do not copy any content or images without our consent.
Powered by Bandwise LLC