The Office for Civil Rights Archives

Suze Shaffer February 12, 2019June 29, 2022

As we start this new year we must reflect what we have learned from 2018 in order to make 2019 a success.

The Office for Civil Rights (OCR) has gained momentum in enforcing HIPAA violations. With that said HIPAA is an ongoing process and once is not enough. It is not considered done unless it is documented. At the annual conference this past year, the OCR admitted they are adamant on ensuring your patient’s information is protected. Therefore, you must document your compliance. If you say you did something, they will ask for your documentation. If you do not have documentation, you will be fined.

Companies located in United States are now required to adhere to the General Data Protection Regulation (GDPR) if they market goods and services to citizens of the European Union (EU). You must ensure the security of the data as well as inform visitors to your website how you intend to use their data. This must be clearly written in your privacy notice on website. This is not to be confused with your Notice of Privacy Practices that you give to your patients. If you plan on marketing to visitors from your website, you must offer them a free opt-out option. We could go on in more detail on this subject, but since many medical clinics do not market to international patients, you may contact us for more information.

Here are a few things to review and update as necessary:

Risk analysis and risk management plan, this is your documentation to demonstrate what risks you have (had) and how you have mitigated them or plan to mitigate them.
Replacing or updating any outdated technology, hardware and software require updates from time to time. You can be fined for utilizing outdated hardware/software that is no longer supported by the manufacturer.
Adding a second authentication process for access to ePHI as well as for online personal accounts.
HIPAA training, ensuring your employees understand how to protect your data is also part of this training.
Making sure you have all of the necessary privacy and security policies, procedures, and forms in place. This means reading and dating them to demonstrate they were actually implemented.
Retaining your documentation for the required time limit, including correspondence with patients that are considered to be part of their medical record.
Reviewing your website, determining if your site collects any data and how it is transmitted and stored.

If you see something in your workplace that looks suspicious, tell your HIPAA Compliance Officer, you could be the one to prevent a data breach or stop a data breach from becoming a major breach (over 500 patient records). Keeping data secure is everyone’s business. Being mindful of our surroundings and educating others helps all of us in this crazy world we live in now!

To find out more about how our automated HIPAA compliance platform can help your organization click here:

https://arismedicalsolutions.com/aris-hipaa-service-automated-platform/

Or to schedule a demo click the contact us tab and scroll down.

“Simplifying HIPAA through Automation, Education, and Support”

Suze Shaffer January 7, 2019June 29, 2022

What do you know about HIPAA enforcement?
Just imagine you were investigated by CMS or the OCR, what would they find?
How confident are you in your medical and/or HIPAA documentation?
Do you have the appropriate documentation to protect your organization?

The Office for Civil Rights (OCR) is very serious about ensuring your organization is educating employees on patient rights and securing PHI. During a recent investigation in Florida an organization was fined $100K for each year they could not produce documented HIPAA training. The first year they only had 3 employees! They were fined for five years, $500K. Once you are under investigation, they review ALL of your documentation, not just what they originally requested. You do not want to end up being in the willful and wanton neglect category. This is where the big fines are calculated.

If you have a patient complaint or suffer a data breach, the best advice is to document, document, AND document! OH, did I mention… DOCUMENT? Next, cooperation. If they ask for something, give it to them. Nothing more, nothing less, but give them what they ask for. Show the OCR you are trying to do the right thing. After all, how would you like it if the information that was compromised was yours? Wouldn’t you want the organization to do what they could to stop the breach or prevent another one from happening?

Remember the MD Anderson in Texas fines? They had multiple devices lost containing unencrypted ePHI. They claimed that they were not obligated to encrypt its devices, and stated that the ePHI that was involved was for “research,” and thus was not subject to the HIPAA non-disclosure requirements. They challenged the OCR and the Judge ruled in favor of the OCR and MD anderson was ordered to pay $4,348,000 in civil money penalties. The quote from OCR Director Roger Severino: “OCR is serious about protecting health information privacy and will pursue litigation, if necessary, to hold entities responsible for HIPAA violations”.

At the NIST/OCR conference in Washington DC, the director along with other members of the OCR staff reminded organizations about enforcement. This is NOT going away. Patient information is extremely valuable to criminals. The days of just a slap on the wrist because you didn’t conduct risk assessment, conduct HIPAA training, or you can’t prove your HIPAA compliance is over. Every organization that has anything to do with patient information must get on board and understand HIPAA. There is NO certificate to prove you are HIPAA compliant, the proof is in your documentation. So I ask one more time… How well do you trust your HIPAA documentation?

To find out more about how our automated HIPAA compliance platform can help your organization click here:

https://arismedicalsolutions.com/aris-hipaa-service-automated-platform/

Or to schedule a demo click the contact us tab and scroll down.

“Simplifying HIPAA through Automation, Education, and Support”

Tag: The Office for Civil Rights

Do you have all of your HIPAA training documented?