Source: http://financedocbox.com/Insurance/65922437-Hipaa-training-for-small-providers.html
Timestamp: 2019-12-07 03:44:56
Document Index: 69993776

Matched Legal Cases: ['arty\n20', 'ART 2', 'ART 2', 'arts 164', 'art 164', 'art 164']

HIPAA Training for Small Providers - PDF Free Download
HIPAA Training for Small Providers
Download "HIPAA Training for Small Providers"
1 HIPAA Training for Small Providers Hyla Schreurs, J.D., Supervisory Equal Opportunity Specialist Emily Prehm, J.D., Equal Opportunity Specialist August 31, 2017 DHHS Office for Civil Rights
3 Office for Civil Rights (OCR) Headquarters - Washington, DC Policy and regulations Guidance materials Centralized Case Management Operations and Customer Response Center Regional Offices - Boston, New York City, Philadelphia, Atlanta, Denver, Dallas, Kansas City, San Francisco, Los Angeles, Chicago, Seattle Investigations Technical Assistance Outreach 3
4 Who We Are As the Department's civil rights, conscience and religious freedom, and health privacy rights law enforcement agency, OCR investigates complaints, enforces rights, and promulgates regulations, develops policy and provides technical assistance and public education to ensure understanding of and compliance with nondiscrimination and health information privacy laws. DHHS Office for Civil Rights 4
5 Numbers at a Glance Over 158,293 complaints received to date Over 25,312 cases resolved with corrective action and/or technical assistance 49 settlement agreements that include detailed corrective action plans and monetary settlement amounts 3 civil money penalties Expect to receive 17,000 complaints this year 5
6 Scope: Who is Covered? Limited by HIPAA to: Health care providers who transmit health information electronically in connection with a transaction for which there is a HIPAA standard Health plans Health care clearinghouses Business Associates
7 Business Associates Agents, contractors, and others hired to do the work of, or to work for, the covered entity, and such work requires the use or disclosure of protected health information ( PHI, see next slide). The Privacy Rule requires satisfactory assurance, which usually takes the form of a contract, that a BA will safeguard the PHI, and limit its use and disclosure
8 Requirements for Business Associates BAs must comply with the technical, administrative, and physical safeguard requirements under the Security Rule; liable for Security Rule violations BA must comply with use or disclosure limitations expressed in its contract and those in the Privacy Rule; criminal and civil liabilities attach for violations BA definition expressly includes Health Information Organizations, E-prescribing Gateways, and PHR vendors that provide services to covered entities Subcontractors of a BA are now defined as a BA; clarifying that BA liability flows to all subcontractors 8
9 Scope: What is Covered? Protected Health Information ( PHI ): Individually identifiable health information Transmitted or maintained in any form or medium Held or transmitted by Covered Entities or their Business Associates Not PHI: De-identified information Employment records FERPA records
10 Uses and Disclosures: Key Points No use or disclosure of PHI unless permitted or required by the Privacy Rule. Required Disclosures: To the individual who is the subject of the PHI. To the Secretary of HHS in order to determine compliance. All other uses and disclosures in the Privacy Rule are permissive. Covered Entities may provide greater protections
11 Permissive Uses and Disclosures To the individual or personal representative For treatment, payment, and health care operations (TPO) With the opportunity to agree or object For specific public priorities Incident to Limited data sets As authorized by the individual
12 To Individuals Besides making required disclosures, Covered Entities may also disclose PHI to their patients or enrollees. For example: Health plans may contact their enrollees. Providers may contact or speak with their patients. Covered Entities must treat a personal representative -- person who has authority to make decisions related to health care -- as an individual 12
13 Treatment, Payment, Health Care Operations (TPO) What is treatment? What is payment? What are health care operations? Using and disclosing for TPO Using and disclosing for TPO of another Covered Entity
14 Opportunity to Agree or Object To use PHI in facility directories (name, location, general condition, religious affiliation to clergy) To disclose PHI to persons involved in care or payment for care and for notification purposes. For example: Friends may pick up prescriptions. Hospitals may notify family members of a patient s condition. Covered entities may notify disaster relief agencies
15 Public Priorities Covered Entities may use or disclose PHI without authorization only if the use or disclosure comes within one of the listed exceptions and follows its conditions. Some examples: As required by law For public health activities For judicial and administrative proceedings For specialized government functions
16 Incidental Uses and Disclosures The Privacy Rule permits uses and disclosures incidental to an otherwise permitted use or disclosure, provided minimum necessary and safeguard standards (discussed following) are met. Examples: talking to a patient in a semi-private room; talking to other providers if passers-by are present; waiting-room sign-in sheets; patient charts at bedside. Allows for common practices if reasonably performed
17 Minimum Necessary Standard Covered entities must make reasonable efforts to use, disclose, or request the minimum necessary ( MN ) PHI based on purpose. Exceptions to the MN standard: e.g., disclosure of PHI for the purpose of treatment Covered entities must identify classes of workforce members who need access to PHI to do their jobs. Covered entities must develop criteria to limit disclosures of and requests for PHI to the MN
18 Authorizations Covered Entities must obtain an individual s authorization before using or disclosing PHI for purposes other than: TPO; Where the opportunity to agree or object is required; Specified public priorities. Authorizations must be obtained for marketing (with limited exceptions)
19 Marketing Communications about health-related products and services by covered entity (or business associate) to individuals now marketing and require authorization if paid for by third party Applies to receipt of financial remuneration only; does not include receipt of non-financial benefits Authorization must state that communication is paid for Authorization can be obtained to make subsidized communications generally 19 Scope of authorization need not be limited to single product/service or products/services of one third party
20 Marketing Limited exception for refill reminders (and similar communications) Includes generic equivalents, adherence communications, drug delivery systems Payment must be reasonably related to cost of communication Face to face marketing communications and promotional gifts of nominal value still permitted without authorization 20
21 Sale of PHI Even where disclosure is permitted, covered entity is prohibited from disclosing PHI (without individual authorization) in exchange for remuneration Includes remuneration received directly or indirectly from recipient Not limited to financial remuneration If authorization obtained, authorization must state that disclosure will result in remuneration 21
22 Sale of PHI Exceptions: Treatment & payment Sale of business Remuneration to BA for services rendered Disclosure required by law Providing access or accounting to individual Public health Research, if remuneration limited to cost to prepare and transmit PHI Any other permitted disclosure where only receive reasonable, cost-based fee to prepare and transmit PHI 22
23 Administrative Requirements Covered Entities must: Designate a Privacy Officer; Designate a contact person or office to receive complaints and provide further information; Provide privacy training to all workforce members; Develop and apply sanction policy for workforce members who fail to comply; Implement policies and procedures designed to comply with standards
24 Administrative Requirements (cont.) Covered Entities must: Implement administrative, technical and physical safeguards to protect privacy of PHI; Mitigate any harmful effect of a violation known to the covered entity to the extent practicable; Provide an internal complaint process for individuals; Refrain from intimidating and retaliatory acts; Not require individuals to waive their rights
25 Individual Rights DHHS Office for Civil Rights 25
26 Individual Rights Notice of Privacy Practices Access: inspect and copy Amendment Accounting Alternative communications Request restriction Complaints to Covered Entity and Secretary 26
27 Amendment Amendment: An individual has the right to request that a CE amend PHI about the individual in a DRS as long as the DRS is maintained
28 Accounting Accounting: An individual has the right to receive an accounting of disclosures of PHI made by a CE in the six years or less prior to the request
29 Alternative Communication Alternative Communication A covered health care provider must permit the individual to request and must accommodate reasonable requests to receive communications of PHI by alternative means and at alternative locations. The requirement applies to health plans if the individual clearly states that the disclosure could endanger the individual (b) 29
30 Right to Request Restrictions A covered entity must permit an individual to request that the covered entity restrict uses and disclosures of PHI for treatment, payment, or health care operations purposes, and for disclosures to family and friends (opportunity to agree or object disclosures). Covered entities are not required to agree to the request (unless to a health plan under certain circumstances) (a) 30
31 Right to Request Restrictions Covered entity must agree to individual s request to restrict disclosure of PHI to health plan if: PHI pertains solely to health care for which individual (or person on behalf of individual other than health plan) has paid the covered entity in full out of pocket Disclosure is not required by other law (a) 31
32 Right to Request Restrictions Preamble provides guidance on scope of restriction & other issues Scope of restriction to health plan extends to health care item or service paid for out of pocket Restriction on follow-up care individual must pay out of pocket and request restriction for follow-up care 32 Restriction on downstream providers individual has obligation to request restriction from downstream providers but providers encouraged to assist individual in notifying downstream providers of individual s desire to restrict
33 Right to Request Restrictions Preamble provides guidance on scope of restriction & other issues Can t require individual to restrict all or none of a provider s health care items or services; however, recognize issues with bundled items or services If original form of payment dishonored, must make reasonable efforts to obtain payment prior to billing health plan How to address other legal requirements 33
34 Notice of Privacy Practices An individual has a right to adequate written notice of: uses and disclosures of PHI that may be made by the Covered Entity, and Individual s rights and Covered Entity s legal duties with respect to PHI 34
35 Notice Elements Header specific language in Rule Description of uses and disclosures Individual rights and how to exercise those rights Covered Entity duties and contact name or title & telephone number to receive complaints Effective Date 35
36 Notice of Privacy Practices Content must include: 36 Statements regarding sale of PHI, marketing, and other purposes that require authorization For covered entities engaging in fundraising, statement that individual can opt out of fundraising communications For providers, statement that covered entity must agree to restrict disclosure to health plan if individual pays out of pocket in full for health care service Statement about individual s right to receive breach notifications For plans that underwrite, statement that genetic information may not be used for such purposes
37 Provision of Notice By Direct Treatment Providers First service delivery after compliance date Good faith effort to obtain a written acknowledgment of receipt By Health Plans At compliance date and thereafter at enrollment to new enrollees Every 3 years, must tell enrollees of availability of Notice and how to obtain Health plans may distribute materially revised NPPs: By posting on web site by effective date of change and including in next annual mailing to individuals; or Mailing to individuals within 60 days of material revision By All Covered Entities On request to any person 37
38 Complaints Covered Entity process for individuals to complain concerning Covered Entity s privacy policies or procedures No provisions on how Covered Entity s complaint process must operate other than to document complaints and their disposition Individuals may also complain to OCR 38
39 Access Guidance Issued in two phases in early 2016 Comprehensive Fact Sheet Series of FAQs Scope Form and Format and Manner of Access Timeliness Fees Directing Copy to a Third Party, and Certain Other Topics 39
40 Access Guidance Access Scope Designated record set broadly includes medical, payment, and other records used to make decisions about the individual Doesn t matter how old the PHI is, where it is kept, or where it originated Includes clinical laboratory test reports and underlying information (including genomic information) 40
41 Access Guidance Access Scope (cont.) Very limited exclusions and grounds for denial E.g., psychotherapy notes, information compiled for litigation, records not used to make decisions about individuals (e.g., certain business records) BUT underlying information remains accessible Covered entity may not require individual to provide rationale for request or deny based on rationale offered No denial for failure to pay for health care services Concerns that individual may not understand or be upset by the PHI not sufficient to deny access 41
42 Access Guidance Access Requests for Access Covered entity may require written request Can be electronic Reasonable steps to verify identity BUT cannot create barrier to or unreasonably delay access E.g., cannot require individual to make separate trip to office to request access 42
43 Access Guidance Access Form and Format and Manner of Access Individual has right to copy in form and format requested if readily producible If PHI maintained electronically, at least one type of electronic format must be accessible by individual Depends on capabilities, not willingness Includes requested mode of transmission/transfer of copy Right to copy by (or mail), including unsecure if requested by individual (plus light warning about security risks) Other modes if within capabilities of entity and mode would not present unacceptable security risks to PHI on entity s systems 43
44 Access Guidance Access Timeliness and Fees Access must be provided within 30 days (one 30-day extension permitted) BUT expectation that entities can respond much sooner Limited fees may be charged for copy Reasonable, cost-based fee for labor for copying (and creating summary or explanation, if applicable); costs for supplies and postage No search and retrieval or other costs, even if authorized by State law Entities strongly encouraged to provide free copies Must inform individual in advance of approximate fee 44
45 Access Guidance Calculating Costs for Access Fees: 3 Acceptable Methods 1. Actual costs Actual labor for copying (at reasonable rates, including only the time to create and send a copy in the form, format, and manner requested) Actual postage Supplies (paper, toner, CD, USB drive) 2. Average costs Cost schedule based on average labor costs for standard requests is okay Per page fee acceptable only for paper records (copied or scanned) Applicable supply and postage costs may be added to average labor costs 3. Flat fee for electronic copies of electronic PHI only ($6.50 cap). An alternative to calculating actual or average costs for certain requests Not a cap on all permissible fees 45
46 Access Guidance No Fees Permitted For: Providing access through certified EHR technology (i.e., View, Download, Transmit) Administrative overhead costs for outsourcing access requests to a business associate Viewing and inspecting PHI only 46
47 Access: Designated 3rd Party Third Party Access to an Individual s PHI Individual s right of access includes directing a covered entity to transmit PHI directly to another person, in writing, signed, designating the person and where to send a copy (45 CFR ) Individual may also authorize disclosures to third parties, whereby third parties initiate a request for the PHI on their own behalf if certain conditions are met (45 CFR ) 47
48 Access Guidance New video training module; once completed, you will receive CME or CE credit: Access Guidance available on OCR s website at: 48
49 HIPAA Security Rule Overview
50 Definitions & General Rules Definitions Terms defined in 45 CFR cut across all Admin Simp. Rules Terms defined in 45 CFR specific to the Security Rule General Rules Establishes the requirements covered entities (and business associates) must meet Includes the consideration for a flexibility of approach Defines the required standards and implementation specifications (both required and addressable) Requires the maintenance of security measures implemented to support the reasonable and appropriate protection of electronic protected health information 50
51 HHS Approach to HIPAA Security Standards to assure the confidentiality, integrity, and availability of E-PHI Through reasonable and appropriate safeguards Addressing vulnerabilities identified through analysis and management of risk Appropriate to the size and complexity of the organization and its information systems Technology neutral 51
52 Scope: What is Covered? Electronic Protected Health Information ( E-PHI ): Protected health information Transmitted or maintained in electronic media Not E-PHI: Electronic Transmission Media excludes: Transmissions of paper Transmissions by facsimile Voice by telephone because the information did not exist in electronic form before transmission 52
53 Standards and Implementation Specifications Standards a covered entity (and business associate) must comply with the standards Implementation Specifications Required - a covered entity must implement the specification Addressable - a covered entity must assess whether the specification is reasonable and appropriate in its environment and document its decision to either implement the specification, implement an equivalent alternative, or not implement the specification 53
54 Administrative Safeguards Administrative Safeguards are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity s workforce in relation to the protection of that information. (Definitions - 45 CFR ) 54
55 Physical & Technical Safeguards Physical Safeguards are physical measures, policies, and procedures to protect a covered entity s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. (Definitions - 45 CFR ) Technical Safeguards means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it. (Definitions - 45 CFR ) 55
56 Organizational Requirements Organizational Requirements Contains the standards for business associate contracts and other arrangements Contains the requirements for group health plans Policies and Procedures and Documentation Requirements Requires the implementation of reasonable and appropriate policies and procedures Requires the maintenance of documentation (written or electronic) Establishes the retention, availability, and update conditions for documentation 56
57 Compliance Challenges DHHS Office for Civil Rights 57
58 Lack of Business Associate Agreements HIPAA generally requires that covered entities and business associates enter into agreements with their business associates to ensure that the business associates will appropriately safeguard protected health information. See 45 C.F.R (b). Examples of Potential Business Associates: A collections agency providing debt collection services to a health care provider which involves access to protected health information. An independent medical transcriptionist that provides transcription services to a physician. A subcontractor providing remote backup services of PHI data for an IT contractor-business associate of a health care provider. DHHS Office for Civil Rights 58
59 Incomplete or Inaccurate Risk Analysis Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ephi) held by the [organization]. See 45 C.F.R (a)(1)(ii)(A). Organizations frequently underestimate the proliferation of ephi within their environments. When conducting a risk analysis, an organization must identify all of the ephi created, maintained, received or transmitted by the organization. Examples: Applications like EHR, billing systems; documents and spreadsheets; database systems and web servers; fax servers, backup servers; etc.); Cloud based servers; Medical Devices Messaging Apps ( , texting, ftp); Media DHHS Office for Civil Rights 59
60 The Risk Analysis Process: Key Activities Required by the Security Rule Inventory to determine where ephi is stored Evaluate probability and criticality of potential risks Adopt reasonable and appropriate security safeguards based on results of risk analysis Implement/Modify security safeguards to reduce risk to a reasonable and appropriate level Document safeguards and rationale Evaluate effectiveness of measures in place Maintain continuous security protections Repeat DHHS Office for Civil Rights 60
61 Failure to Manage Identified Risk The Risk Management Standard requires the [implementation of] security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with [the Security Rule]. See 45 C.F.R (a)(1)(ii)(B). Investigations conducted by OCR regarding several instances of breaches uncovered that risks attributable to a reported breach had been previously identified as part of a risk analysis, but that the breaching organization failed to act on its risk analysis and implement appropriate security measures. In some instances, encryption was included as part of a remediation plan; however, activities to implement encryption were not carried out or were not implemented within a reasonable timeframe as established in a remediation plan. DHHS Office for Civil Rights 61
62 Risk Analysis Guidance ce.html OCR Activity Update
63 Lack of Transmission Security When electronically transmitting ephi, a mechanism to encrypt the ephi must be implemented whenever deemed appropriate. See 45 C.F.R (e)(2)(ii). Applications for which encryption should be considered when transmitting ephi may include: Texting Application sessions File transmissions (e.g., ftp) Remote backups Remote access and support sessions (e.g., VPN) DHHS Office for Civil Rights 63
64 Lack of Appropriate Auditing The HIPAA Rules require the [implementation] of hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. See 45 C.F.R (b). Once audit mechanisms are put into place on appropriate information systems, procedures must be implemented to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. See 45 C.F.R (a)(1)(ii)(D). Activities which could warrant additional investigation: Access to PHI during non-business hours or during time off Access to an abnormally high number of records containing PHI Access to PHI of persons for which media interest exists Access to PHI of employees Failed log-in attempts DHHS Office for Civil Rights 64
65 No Patching of Software The use of unpatched or unsupported software on systems which access ephi could introduce additional risk into an environment. Continued use of such systems must be included within an organization's risk analysis and appropriate mitigation strategies implemented to reduce risk to a reasonable and appropriate level. In addition to operating systems, EMR/PM systems, and office productivity software, software which should be monitored for patches and vendor endof-life for support include: Router and firewall firmware Anti-virus and anti-malware software Multimedia and runtime environments (e.g., Adobe Flash, Java, etc.) DHHS Office for Civil Rights 65
66 Insider Threat Organizations must [i]mplement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information and to prevent those workforce members who do not have access from obtaining access to electronic protected health information, as part of its Workforce Security plan. See 45 C.F.R (a)(3). Appropriate workforce screening procedures could be included as part of an organization s Workforce Clearance process (e.g., background and OIG LEIE checks). See 45 C.F.R (a)(3)(ii)(B). Termination Procedures should be in place to ensure that access to PHI is revoked as part of an organization s workforce exit or separation process. See 45 C.F.R (a)(3)(ii)(C). DHHS Office for Civil Rights 66
67 Disposal When an organization disposes of electronic media which may contain ephi, it must implement policies and procedures to ensure that proper and secure disposal processes are used. See 45 C.F.R (d)(2)(i). The implemented disposal procedures must ensure that [e]lectronic media have been cleared, purged, or destroyed consistent with NIST Special Publication : Guidelines for Media Sanitization, such that the PHI cannot be retrieved. Electronic media and devices identified for disposal should be disposed of in a timely manner to avoid accidental improper disposal. Organizations must ensure that all electronic devices and media containing PHI are disposed of securely; including non-computer devices such as copier systems and medical devices. DHHS Office for Civil Rights 67
68 Insufficient Backup and Contingency Planning Organizations must ensure that adequate contingency plans (including data backup and disaster recovery plans) are in place and would be effective when implemented in the event of an actual disaster or emergency situation. See 45 C.F.R (a)(7). Leveraging the resources of cloud vendors may aid an organization with its contingency planning regarding certain applications or computer systems, but may not encompass all that is required for an effective contingency plan. As reasonable and appropriate, organizations must periodically test their contingency plans and revise such plans as necessary when the results of the contingency exercise identify deficiencies. See 45 C.F.R (a)(7)(ii)(D). DHHS Office for Civil Rights 68
69 Mobile Device Security /mobiledevices OCR Activity Update
70 Security Rule Resources The Security Rule Security Rule History Security Rule Guidance and Notices NIST Toolkit FAQs OCR Activity Update
71 Cloud Guidance OCR released guidance clarifying that a CSP is a business associate and therefore required to comply with applicable HIPAA regulations when the CSP creates, receives, maintains or transmits identifiable health information (referred to in HIPAA as electronic protected health information or ephi) on behalf of a covered entity or business associate. When a CSP stores and/or processes ephi for a covered entity or business associate, that CSP is a business associate under HIPAA, even if the CSP stores the ephi in encrypted form and does not have the key. CSPs are not likely to be considered conduits, because their services typically involve storage of ephi on more than a temporary basis
72 Ransomware Guidance OCR recently released guidance on ransomware. The new guidance reinforces activities required by HIPAA that can help organizations prevent, detect, contain, and respond to threats. 72
73 Cybersecurity Newsletters February 2016 March 2016 April 2016 May 2016 June 2016 September 2016 October 2016 November 2016 December 2016 January 2017 February 2017 April 2017 Ransomware, Tech Support Scam, New BBB Scam Tracker Keeping PHI safe, Malware and Medical Devices New Cyber Threats and Attacks on the Healthcare Sector Is Your Business Associate Prepared for a Security Incident What s in Your Third-Party Application Software Cyber Threat Information Sharing Mining More than Gold (FTP) What Type of Authentication is Right for you? Understanding DoS and DDoS Attacks Audit Controls Reporting and Monitoring Cyber Threats Man-in-the-Middle Attacks and HTTPS Inspection Products DHHS Office for Civil Rights 73
74 Breach Notification Rule 74
75 Breach Notification Provisions applicability definitions notification to individuals notification to media notification to Secretary/OCR notification by business associates law enforcement delay administrative requirements and burden of proof
76 Definition of Breach The acquisition, access, use, or disclosure of PHI which compromises the security or privacy of the PHI Impermissible use/disclosure of (unsecured) PHI presumed to require notification, unless CE/BA can demonstrate low probability that PHI has been compromised based on a risk assessment No Harm standard (removed with Omnibus) 76
77 Exceptions to the definition of breach Unintentional acquisition, access, or use of PHI by workforce member or person acting under the authority of a CE or BA if done in good faith and in the scope of authority and there is no further impermissible use or disclosure of the PHI. Inadvertent disclosure by a person authorized to access PHI to another person authorized to access PHI at the same CE or BA or OHCA and the information received is not further impermissibly used or disclosed by the recipient. CE or BA have a good faith reason to believe the unauthorized recipient could not reasonably have been able to retain the information.
78 1. Unintentional acquisition, access, or use examples A billing employee receives and opens an about a patient that was mistakenly sent to her by a nurse at the same facility. The billing employee alerts the nurse and deletes the . This would not be considered a breach, as the acquisition of the PHI was unintentional, done in good faith and within the employee s scope of authority. A nurse for a covered entity who is authorized to view patient records, decides to access the records of her ex-boyfriend, who is not her patient. The nurse was not acting within her scope of authority because her ex-boyfriend was not her patient, the access was intentional and not done in good faith. The exception would not apply.
79 2. Good faith belief that information was not retained - examples A health plan sends EOBs to the wrong individuals, some of the EOBs are returned by the post office as undeliverable and have not been opened. The covered entity can assume that the PHI of the individuals contained in the unopened, returned EOBs was not breached. A nurse mistakenly hands the discharge papers of Patient A to Patient B. However, before Patient B has a chance to look at the papers, the nurse realizes her error and immediately retrieves the paperwork from Patient B. Here, if the nurse can conclude Patient B did not look at Patient A s information, this would not constitute a breach.
80 Breach Checklist for Covered Entities Has there been an impermissible use or disclosure of PHI? Perform risk assessment - determine and document at least: Nature & extent of PHI involved Who received/accessed the information Potential that PHI was actually acquired or viewed Extent to which risk to the data has been mitigated Determine if the incident falls under any of the exceptions to the definition of breach
81 Notification obligation only applies to Unsecured PHI Unsecured PHI is PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals. Acceptable methods of securing PHI are encryption and destruction. Loss or compromise of PHI that has been encrypted or properly destroyed does not trigger the duty to notify or report.
82 Notification to Individuals A covered entity must notify each affected individual following the discovery of a breach of unsecured PHI. The obligation to notify applies to those breaches that the covered entity knows about or should have known about if exercising reasonable diligence.
83 Known or should have known Standard Means that covered entities can be liable for failing to provide notice to individuals in situations where they did not know of a breach but would have known if they exercised reasonable diligence. Employees of a covered entity are considered agents of the organization and any knowledge an employee has will be attributed to the covered entity (except where the employee is the person committing the breach). Because of this standard, covered entities need to have reasonable systems in place to discover breaches including training of staff on prompt reporting of any known breaches.
84 Timeliness of Notification Notice must be provided to the individual without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. 60 days is an outer limit, if the covered entity has completed its risk assessment and confirmed the breach within 20 days, it should send the notifications immediately instead of waiting until day 60.
85 Content of Notification The notification must contain, to the extent possible: Description of what happened and dates, if known Description of the types of unsecured PHI involved in the breach Any steps individuals should take to protect themselves Description of what the covered entity is doing to investigate and mitigate harm Contact information for individuals to learn more which must include a toll-free telephone number, address, website, or postal address
86 Methods of Notification to Individuals Written notice to last known address or by if agreed to by the individual. If the individual is deceased, notification may be sent to the next of kin or personal representative of the individual if the CE knows the individual is deceased and has contact information for the next of kin or personal representative. Notification may be provided in one or more mailings as information becomes available. In urgent situations, notice may be provided by telephone or other means in addition to written notice.
87 Substitute Individual Notification Where there is insufficient or out of date contact information, a substitute form of individual notice reasonably calculated to reach the individual may be provided such as or telephone If the individual is deceased and there is insufficient contact information, no substitute notification is required
88 Substitute Individual Notification for 10 or more persons If the covered entity does not have sufficient contact information for ten or more affected individuals, the following applies: Conspicuous posting for 90 days on home page of covered entity s website or posting in print or broadcast media where affected individuals may reside; and Include a toll-free number that remains active for at least 90 days where individuals can learn whether they were affected by the breach. The posting must include the same information as the written notice to individuals.
89 Notification to the Media For a breach involving more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that state or jurisdiction in addition to written notice to individuals. Must be done without unreasonable delay, no later than 60 calendar days after discovery of breach. Content of the notification to media is the same as that which was given to individuals.
90 Examples of Notification to Media If a laptop that contains unsecured PHI of more than 500 residents of a particular city is stolen, the covered entity would need to notify a major television station or daily newspaper serving that city or entire state. If the stolen laptop contained the unsecured PHI of 200 residents from State A, 200 residents of State B, and 200 residents of State C, no reporting to the media would be required since there were not 500 or more residents affected from any one state. In this case, however, the covered entity would still be required to report the breach to the Secretary.
91 Notification to the Secretary If a breach involves 500 or more individuals, the covered entity must report the breach to the Secretary at the same time it notifies affected individuals. If a breach involves less than 500 individuals, the covered entity will make an annual reporting of all such breaches discovered in a calendar year to the Secretary (no later than 60 days after the end of each calendar year, providing notification for breaches discovered during the preceding calendar year). Reporting by covered entities will be done via OCR s website. This data is collected for reporting to Congress and notification to the Regions.
92 Business Associates Business associates must notify covered entities of breaches without unreasonable delay and in no case later than 60 days. Breaches are treated as discovered on the first day that the breach is known or by exercising reasonable diligence would have been known to the BA. The content of the notification from the BA to the CE must include, to the extent possible, the identification of the affected individuals and as much information that is known to the BA which the CE would be required to include in its notice to the individual.
93 Law Enforcement Delay If law enforcement makes a written statement to a covered entity or business associate that notification or posting of a breach would impede a criminal investigation, the covered entity must delay notification until the time specified by law enforcement. If the requested delay by law enforcement is oral, the covered entity must document the oral request and delay notification for no longer than 30 days from the date of the request.
94 HIPAA Breach Highlights September 2009 through July 31, 2017 Approximately 2,017 reports involving a breach of PHI affecting 500 or more individuals Theft and Loss are 48% of large breaches Hacking/IT now account for 17% of incidents Laptops and other portable storage devices account for 26% of large breaches Paper records are 21% of large breaches Individuals affected are approximately 174,974,489 Approximately 293,288 reports of breaches of PHI affecting fewer than 500 individuals 94
95 HIPAA Breach Highlights 500+ Breaches by Type of Breach as of July 31, 2017 Improper Disposal 3% Other 5% Unknown 1% Hacking/IT 17% Theft 40% Unauthorized Access/Disclosur e 27% Loss 8% 95
96 HIPAA Breach Highlights 500+ Breaches by Location of Breach as of July 31, 2017 EMR 6% Other 10% Paper Records 21% Portable Electronic Device 9% 10% Network Server 17% Laptop 17% Desktop Computer 10% 96
97 What Happens When HHS/OCR Receives a Breach Report OCR posts breaches affecting 500+ individuals on OCR website (after verification of report) Public can search and sort posted breaches OCR opens investigations into breaches affecting 500+ individuals, and into a number of smaller breaches Investigations involve looking at: Underlying cause of the breach Actions taken to respond to the breach (including compliance with breach notification requirements) and prevent future incidents Entity s compliance prior to breach 97
98 Breach Notification Breach reporting - DHHS Office for Civil Rights 98
99 Enforcement DHHS Office for Civil Rights 99
100 Complaint Process Complaint Intake & Review Possible Criminal Violation Possible Privacy or Security Rule Violation DOJ DOJ declines case & refers back to OCR Investigation Accepted by DOJ Resolution OCR finds no violation OCR obtains voluntary compliance, corrective action, or other agreement Resolution Resolution The violation did not occur after April 14, 2003 Entity is not covered by the Privacy Rule Complaint was not filed within 180 days and an extension was not granted The incident described in the complaint does not DHHS violate Office the for Civil Privacy RightsRule OCR issues formal finding of violation
101 Enforcement Process OCR reviews the information, or evidence, that it gathers in each case. If the evidence indicates that the covered entity was not in compliance, OCR will attempt to resolve the case with the covered entity by obtaining: Voluntary compliance; Corrective action; and/or Resolution agreement. DHHS Office for Civil Rights 101
102 Enforcement Process Letter of Opportunity with Resolution Agreement and Corrective Action Plan Notice of Proposed Determination Entity may request a hearing before Administrative Law Judge Notice of Final Determination DHHS Office for Civil Rights 102
103 Recent Enforcement Actions Children s Medical Center of Dallas Multiple lost or stolen mobile devices with unsecured ephi Failure to timely implement appropriate risk management $3,200,000 Civil Money Penalty MAPFRE Life Insurance Company of Puerto Rico Stolen USB storage device containing the ephi of 2,209 Lack of appropriate risk analysis and management, including lack of encryption $2,200,000 Settlement with Corrective Action Plan DHHS Office for Civil Rights 103
104 Recent Enforcement Actions The New York and Presbyterian Hospital Patients complained of impermissible disclosure of PHI to ABC film crew Did not obtain patient authorization $2,200,000 Resolution Agreement/Corrective Action Plan University of Missouri Medical Center Breach report - stolen laptop with unsecured PHI Use of generic username and password on network drive Identified risks to PHI as early as 2005 but did not significantly manage $2,750,000 Resolution Agreement and Corrective Action Plan Conduct risk analysis and develop risk management plan Implement unique user identification Update policies and procedures DHHS Office for Civil Rights 104
105 Recent Enforcement Actions Advocate Health Care 3 breach reports Lost/stolen computers with unsecured PHI of approx. 4 million Unauthorized third party access to BA s network $5,550,000 Resolution Agreement with Corrective Action Plan Modify existing risk analysis Develop and implement risk management plan Process for evaluating environmental and operational changes Revise policies and training Oregon Health & Science Center Breach reports 2 stolen laptops and unencrypted thumb drive Storage of ephi on cloud server without a business associate agreement $2,700,000 Resolution Agreement with Corrective Action Plan Conduct risk analysis and risk management Encryption program Revise policies and staff training DHHS Office for Civil Rights 105
106 General Enforcement Highlights In most cases, entities able to demonstrate satisfactory compliance through voluntary cooperation and corrective action In some cases though, nature or scope of indicated noncompliance warrants additional enforcement action Resolution Agreements/Corrective Action Plans 47 settlement agreements that include detailed corrective action plans and monetary settlement amounts 3 civil money penalties As of April 30,
107 Corrective Action Corrective Actions May Include: Updating risk analysis and risk management plans Updating policies and procedures Training of workforce Implementing specific technical or other safeguards Mitigation CAPs may include monitoring 107
108 Good Practices Some Good Practices: Review all vendor and contractor relationships to ensure BAAs are in place as appropriate and address breach/security incident obligations Risk analysis and risk management should be integrated into business processes; conducted regularly and when new technologies and business operations are planned Dispose of PHI on media and paper that has been identified for disposal in a timely manner Incorporate lessons learned from incidents into the overall security management process Provide training specific to organization and job responsibilities and on regular basis; reinforce workforce members critical role in protecting privacy and security 108
109 Questions? Hyla Schreurs, J.D., Supervisory Equal Opportunity Specialist Emily Prehm, J.D., Equal Opportunity Specialist U.S. Department of Health and Human Services Office for Civil Rights 1961 Stout Street, Room Denver, CO DHHS Office for Civil Rights 109
HIPAA Update. Jamie Sorley U.S. Department of Health and Human Services Office for Civil Rights
HIPAA Update Jamie Sorley U.S. Department of Health and Human Services Office for Civil Rights New Mexico Health Information Management Association Conference April 11, 2014 Albuquerque, NM Recent Enforcement
To: Our Clients and Friends January 25, 2013
Life Sciences and Health Care Client Service Group To: Our Clients and Friends January 25, 2013 Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health
OCR Phase II Audit Protocol Breach Notification. HIPAA COW Spring Conference 2017 Page 1 Boerner Consulting, LLC
Audit Type Section Key Activity Established Performance Criteria Audit Inquiry 12 Samples Requested Breach 164.414(a) Administrative 164.414(a) 164.414(a) 5 Inquiry of Mgmt Requirements Administrative
HIPAA Training. HOPE Health Facility Administrators June 2013 Isaac Willett and Jason Schnabel
HIPAA Training HOPE Health Facility Administrators June 2013 Isaac Willett and Jason Schnabel Agenda HIPAA basics HITECH highlights Questions and discussion HIPAA Basics Legal Basics Health Insurance Portability
AFTER THE OMNIBUS RULE 1 Agenda Omnibus Rule Business Associates (BAs) Agreement Breach Notification Change Breach Reporting Requirements (Federal and State) Notification to Care1st Health Plan Member
Legal and Privacy Implications of the HIPAA Final Omnibus Rule
Legal and Privacy Implications of the HIPAA Final Omnibus Rule February 19, 2013 Pillsbury Winthrop Shaw Pittman LLP Faculty Gerry Hinkley Partner Pillsbury Winthrop Shaw Pittman LLP Deven McGraw Director,
New. To comply with HIPAA notice requirements, all Providence covered entities shall follow, at a minimum, the specifications described below.
Subject: Protected Health Information Breach Notification Policy Department: Enterprise Risk Management Services Executive Sponsor: SVP/Chief Risk Officer Approved by: Rod Hochman, MD President/CEO Policy
ARE YOU HIP WITH HIPAA?
ARE YOU HIP WITH HIPAA? Scott C. Thompson 214.651.5075 scott.thompson@haynesboone.com February 11, 2016 HIPAA SECURITY WHY SHOULD I CARE? Health plan fined $1.2 million for HIPAA breach. Health plan fined
HIPAA: Final Omnibus Rule is Here Arizona Society for Healthcare Risk Managers November 15, 2013
HIPAA: Final Omnibus Rule is Here Arizona Society for Healthcare Risk Managers November 15, 2013 Pat Henrikson, Banner Health HIPAA Compliance Program Director, Chief Privacy Officer Agenda Background
HIPAA OMNIBUS RULE. The rule makes it easier for parents and others to give permission to share proof of a child s immunization with a school
ASPPR The omnibus rule greatly enhances a patient s privacy protections, provides individuals new rights to their health information, and strengthens the government s ability to enforce the law. The changes
"HIPAA RULES AND COMPLIANCE"
PRESENTER'S GUIDE "HIPAA RULES AND COMPLIANCE" Training for HIPAA REGULATIONS Quality Safety and Health Products, for Today...and Tomorrow OUTLINE OF MAJOR PROGRAM POINTS OUTLINE OF MAJOR PROGRAM POINTS
This document provides an overview of the Health Insurance Portability and Accountability Act (HIPAA) compliance requirements. It covers the relevant legislation, required procedures, and ways that your
Omnibus Components. Not in Omnibus. HIPAA/HITECH Omnibus Final Rule
Office of the Secretary Office for Civil Rights () HIPAA/HITECH Omnibus Final Rule April 12, 2013 HHS Office for Civil Rights Omnibus Components Final Rule on HITECH Privacy, Security, & Enforcement Provisions
HIPAA Omnibus Rule. Critical Changes for Providers Presented by Susan A. Miller, JD. Hosted by
HIPAA Omnibus Rule Critical Changes for Providers Presented by Susan A. Miller, JD Hosted by agenda What the Omnibus Rule includes + Effective and Compliance Dates Security Breach Notification Enforcement
HIPAA AND YOU 2017 G E R A L D E MELTZER, MD MSHA
HIPAA AND YOU 2017 G E R A L D E MELTZER, MD MSHA ALLISON SHUREN, J D, MSN Financial Disclosure Gerald Meltzer is a consultant for imedicware Allison Shuren co-chairs the Life Sciences and Healthcare Regulatory
2016 Business Associate Workforce Member HIPAA Training Handbook
2016 Business Associate Workforce Member HIPAA Training Handbook Using the Training Handbook The material in this handbook is designed to deliver required initial, and/or annual HIPAA training for all
H E A L T H C A R E L A W U P D A T E
L O U I S V I L L E. K Y S E P T E M B E R 2 0 0 9 H E A L T H C A R E L A W U P D A T E L E X I N G T O N. K Y B O W L I N G G R E E N. K Y N E W A L B A N Y. I N N A S H V I L L E. T N M E M P H I S.
MEMORANDUM. Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know
1801 California Street Suite 4900 Denver, CO 80202 303-830-1776 Facsimile 303-894-9239 MEMORANDUM To: Adam Finkel, Assistant Director, Government Relations, NCRA From: Mel Gates Date: December 23, 2013
Hayden W. Shurgar HIPAA: Privacy, Security, Enforcement, HITECH, and HIPAA Omnibus Final Rule
Hayden W. Shurgar HIPAA: Privacy, Security, Enforcement, HITECH, and HIPAA Omnibus Final Rule 1 IMPORTANCE OF STAFF TRAINING HIPAA staff training is a key, required element in a covered entity's HIPAA
NOTIFICATION OF PRIVACY AND SECURITY BREACHES
NOTIFICATION OF PRIVACY AND SECURITY BREACHES Overview The UT Health Science Center at San Antonio (Health Science Center) is required to report all breaches of protected health information and personally
503 SURVIVING A HIPAA BREACH INVESTIGATION
503 SURVIVING A HIPAA BREACH INVESTIGATION Presented by Nicole Hughes Waid, Esq. Mark J. Swearingen, Esq. Celeste H. Davis, Esq. Regional Manager 1 Surviving a HIPAA Breach Investigation: Enforcement Presented
Coping with, and Taking Advantage of, HIPAA s New Rules!! Deven McGraw Director, Health Privacy Project April 19, 2013!
Coping with, and Taking Advantage of, HIPAA s New Rules!!! Deven McGraw Director, Health Privacy Project April 19, 2013! Status of Federal Privacy Regulations! Omnibus Rule (Data Breach, Enforcement, HITECH,
Presenting a live 90-minute webinar with interactive Q&A Omnibus HIPAA Rule: Impact on Covered Entities Complying with New Requirements, Managing Risk and Responding to a Data Breach TUESDAY, MARCH 12,
HIPAA & The Medical Practice Requirements for Privacy, Security and Breach Notification Gina L. Campanella, JD, MHA, CHA Founder & Principal, Campanella Law Office Of Counsel, The Beinhaker Law Firm BEINHAKER,
HIPAA, 42 CFR PART 2, AND MEDICAID COMPLIANCE STANDARDS POLICIES AND PROCEDURES
SALISH BHO HIPAA, 42 CFR PART 2, AND MEDICAID COMPLIANCE STANDARDS POLICIES AND PROCEDURES Policy Name: BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date:
Management Alert Final HIPAA Regulations Issued
Management Alert Final HIPAA Regulations Issued After much anticipation, the Department of Health and Human Services (HHS) has issued its omnibus set of final regulations modifying and clarifying the privacy,
Fifth National HIPAA Summit West Privacy and Security under the HITECH Act W. Reece Hirsch Paul T. Smith, Partner, Partner, Hooper, Lundy & Bookman 1 Developments The Health Information Technology for
HIPAA: Impact on Corporate Compliance
HIPAA: Impact on Corporate Compliance AAPC HEALTHCON April 2014 Stacy Harper, JD, MHSA, CPC Disclaimer The information provided is for educational purposes only and is not intended to be considered legal
8/14/2013. HIPAA Privacy & Security 2013 Omnibus Final Rule update. Highlights from Final Rules January 25, 2013
HIPAA Privacy & Security 2013 Omnibus Final Rule update Dan Taylor, Infinisource Copyright 2013 All rights reserved. Highlights from Final Rules January 25, 2013 Made business associates directly liable
Saturday, April 28 Medical Ethics: HIPAA Privacy and Security Rules
Saturday, April 28 Medical Ethics: HIPAA Privacy and Security Rules Gina Campanella, JD HIPAA & The Medical Practice Requirements for Privacy, Security and Breach Notification Gina L. Campanella, Esq.
True or False? HIPAA Update: Avoiding Penalties. Preliminaries. Kim C. Stanger IHCA (7/15)
Protected Health Info HIPAA Update: Avoiding Penalties IHCA (7/15) Preliminaries This presentation is similar to any other legal education materials designed to provide general information on pertinent
The Guild for Exceptional Children HIPAA Breach Notification Policy and Procedure
The Guild for Exceptional Children HIPAA Breach Notification Policy and Procedure Purpose To provide for notification in the case of breaches of Unsecured Protected Health Information ( Unsecured PHI )
HIPAA Basic Training for Health & Welfare Plan Administrators
2010 Human Resources Seminar HIPAA Basic Training for Health & Welfare Plan Administrators Norbert F. Kugele What We re going to Cover Important basic concepts Who needs to worry about HIPAA? Complying
HIPAA in the Digital Age. Anisa Kelley and Rachel Procopio Maryan Rawls Law Group Fairfax, Virginia
HIPAA in the Digital Age Anisa Kelley and Rachel Procopio Maryan Rawls Law Group Fairfax, Virginia Virginia MGMA reminds attendees that the program is not intended to provide legal advice and advises participants
Changes to HIPAA Privacy and Security Rules
Changes to HIPAA Privacy and Security Rules STEPHEN P. POSTALAKIS BLAUGRUND, HERBERT AND MARTIN 300 WEST WILSON BRIDGE ROAD, SUITE 100 WORTHINGTON, OHIO 43085 SPP@BHMLAW.COM PERSONNEL COUNCIL FRANKLIN
HIPAA PRIVACY REQUIREMENTS. Dana L. Thrasher Robert S. Ellerbrock, III Constangy, Brooks & Smith, LLP
HIPAA PRIVACY REQUIREMENTS Dana L. Thrasher Robert S. Ellerbrock, III Constangy, Brooks & Smith, LLP dthrasher@constangy.com (205) 226-5464 1 Reasons for HIPAA Privacy Rules Perceived need for protection
HITECH and HIPAA: Highlights for Health Departments. Aimee Wall UNC School of Government
HITECH and HIPAA: Highlights for Health Departments Aimee Wall UNC School of Government When Congress enacted sweeping legislation in February designed to stimulate the nation s economy, it incorporated
[Name of Organization] HIPAA Incident/Breach Investigation Procedure 4
Addendum II [Name of Organization] HIPAA Incident/Breach Investigation Procedure 4 I. Purpose To distinguish between (1) cases in which our HIPAA policy was not correctly followed but such violation did
The wait is over HHS releases final omnibus HIPAA privacy and security regulations
The wait is over HHS releases final omnibus HIPAA privacy and security regulations The Department of Health and Human Services (HHS) published long-anticipated (and longoverdue) omnibus regulations under
45 CFR Part 164. Interim Final Rule Breach Notification for Unsecured Protected Health Information
45 CFR Part 164 Interim Final Rule Breach Notification for Unsecured Protected Health Information Full Preamble and Rule at http://edocket.access.gpo.gov/2009/pdf/e9-20169.pdf The Interim Final Rule also
HIPAA COMPLIANCE ROADMAP AND CHECKLIST FOR BUSINESS ASSOCIATES The Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment
Determining Whether You Are a Business Associate
The HIPAApotamus in the Room: When Lawyers and Law Firms are Subject to HIPAA Enforcement, And How to Comply with the Law by Leslie R. Isaacman, J.D., M.B.A. The Omnibus Final Rule 1 of the Health Information
Highlights of the Omnibus HIPAA/HITECH Final Rule Health Law Whitepaper Katherine M. Layman 215.665.2746 klayman@cozen.com Gregory M. Fliszar 215.665.7276 gfliszar@cozen.com Judy Wang Mayer 215.665.4737
HHS, Office for Civil Rights. IAPP October 11, 2012
HHS, Office for Civil Rights IAPP October 11, 2012 Enforce federal civil rights laws and the HIPAA Privacy and Security Rules HQ and 10 Regional Offices Region IX has jurisdiction over covered entities
Getting a Grip on HIPAA
Getting a Grip on HIPAA Privacy and Security of Health Information in the Post-HITECH Age Jean C. Hemphill hemphill@ballardspahr.com 215.864.8539 Edward I. Leeds leeds@ballardspahr.com 215.864.8419 Amy
HIPAA Privacy and Security Rules HIPAA Compliance Bootcamp (5/16) This presentation is similar to any other legal education materials designed to provide general information on pertinent legal topics.
ACC Compliance and Ethics Committee Presentation February 19, 2013
ACC Compliance and Ethics Committee Presentation February 19, 2013 Melinda G. Murray Associate General Counsel, Holy Cross Hospital and Jill M. Girardeau Partner, Womble Carlyle Sandridge & Rice, LLP HIPAA
LEGAL ISSUES IN HEALTH IT SECURITY
LEGAL ISSUES IN HEALTH IT SECURITY Webinar Hosted by Uluro, a Product of Transformations, Inc. March 28, 2013 Presented by: Kathie McDonald-McClure, Esq. Wyatt, Tarrant & Combs, LLP 500 West Jefferson
CLIENT UPDATE. HIPAA s Final Rule: The Impact on Covered Entities, Business Associates and Subcontractors
CLIENT UPDATE February 20, 2013 HIPAA s Final Rule: The Impact on Covered Entities, Business Associates and Subcontractors On January 25, 2013, the U.S. Department of Health and Human Services ( DHHS )
The Impact of Final Omnibus HIPAA/HITECH Rules. Presented by Eileen Coyne Clark Niki McCoy September 19, 2013
The Impact of Final Omnibus HIPAA/HITECH Rules Presented by Eileen Coyne Clark Niki McCoy September 19, 2013 0 Disclaimer The material in this presentation is not meant to be construed as legal advice
1 Security 101 for Covered Entities
Individuals Right under HIPAA to Access their Health Information 45 CFR
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 Individuals Right under HIPAA to Access their Health Information 45 CFR 164.524 Newly Released FAQs on Access
HIPAA Compliance Under the Magnifying Glass
HIPAA Compliance Under the Magnifying Glass July 30, 2013 Stacy Harper, JD, MHSA, CPC A Webinar Provided by Presenter Stacy Harper Lathrop & Gage, LLP sharper@lathropgage.com 913-451-5125 The information
x Major revision of existing policy Reaffirmation of existing policy
Name of Policy: Reporting of Security Breach of Protected Health Information including Personal Health Information Policy Number: 3364-90-15 Approving Officer: Executive Vice President of Clinical Affairs
Conduct of covered entity or business associate. Did not know and, by exercising reasonable diligence, would not have known of the violation
HIPAA UPDATE: WHY AND HOW YOU MUST COMPLY 1 In January 2013, the Department of Health and Human Services ( HHS ) issued its long-awaited Omnibus Rule 2 implementing regulations required by the HITECH Act
OMNIBUS RULE ARRIVES
AFTER THE OMNIBUS RULE 1 Agenda Omnibus Rule is here Business Associates (BAs) Agreement Breach Notification Change Breach Reporting Requirements (Federal and State) Notification to Care1st Health Plan
HHS.gov Health Information Privacy Individuals Right under HIPAA to Access their Health Information 45 CFR 164.524 Newly Released FAQs on Access Guidance Click Here! Introduction Providing individuals
March 1. HIPAA Privacy Policy
March 1 HIPAA Privacy Policy 2016 1 PRIVACY POLICY STATEMENT Purpose: The following privacy policy is adopted by the Florida College System Risk Management Consortium (FCSRMC) Health Program and its member
HIPAA Privacy Overview Benefit Advisors Network Stacy H. Barrow sbarrow@marbarlaw.com February 8, 2017 2017 Marathas Barrow Weatherhead Lent LLP. All Rights Reserved. 1 Overview of Presentation HIPAA Overview
Breach Policy. Applicable Standards from the HITRUST Common Security Framework. Applicable Standards from the HIPAA Security Rule
Breach Policy To provide guidance for breach notification when impressive or unauthorized access, acquisition, use and/or disclosure of the ephi occurs. Breach notification will be carried out in compliance
ARRA s Amendments to HIPAA Privacy & Security Rules
ARRA s Amendments to HIPAA Privacy & Security Rules Georgina L. O Hara Jessica R. Bernanke April 29, 2009 www.morganlewis.com Amended HIPAA Privacy and Security Rules HIPAA Amendments are in The Health
HIPAA Privacy and Security Rules: Overview and Update HIPAA. Health Insurance Portability and Accountability Act ( HIPAA )
HIPAA Privacy and Security Rules: Overview and Update HIPAA IHCA Convention (7/16) This presentation is similar to any other legal education materials designed to provide general information on pertinent
The HHS Breach Final Rule Is Out What s Next?
The HHS Breach Final Rule Is Out What s Next? Webinar September 16, 2009 Practical Tools for Seminar Learning Copyright 2009 American Health Information Management Association. All rights reserved. Disclaimer
HIPAA THE NEW RULES. Highlights of the major changes under the Omnibus Rule
HIPAA THE NEW RULES Highlights of the major changes under the Omnibus Rule AUTHOR Gamelah Palagonia, Founder CIPM, CIPP/IT, CIPP/US, CIPP/G, ARM, RPLU+ PRIVACY PROFESSIONALS LLC gpalagonia@privacyprofessionals.com
ICAHN Presentation. Final Omnibus Rule and Security Risk Analysis. July 26, David Ginsberg
ICAHN Presentation Final Omnibus Rule and Security Risk Analysis July 26, 2013 David Ginsberg PrivaPlan Associates, Inc. PrivaPlan Associates, Inc. is the leading authority in HIPAA Privacy and Security
Auditing for HIPAA Compliance: Evaluating security and privacy compliance in an organization that provides health insurance benefits to employees
Auditing for HIPAA Compliance: Evaluating security and privacy compliance in an organization that provides health insurance benefits to employees San Antonio IIA: I HEART AUDIT CONFERENCE February 24,
Georgia Health Information Network, Inc. Georgia ConnectedCare Policies
Georgia Health Information Network, Inc. Georgia ConnectedCare Policies Version History Effective Date: August 28, 2013 Revision Date: August 2014 Originating Work Unit: Health Information Technology Health
Individuals Right under HIPAA to Access their Health Information 45 CFR 164.524 Introduction Providing individuals with easy access to their health information empowers them to be more in control of decisions
The HIPAA Omnibus Rule NOTE: Make sure your computer speakers are turned ON. Audio will be streaming through your speakers. If you do not have computer speakers, call the ACCMA at 510-654-5383 for alternatives.
HEALTH & HUMAN SERVICES OFFICE FOR CIVIL RIGHTS HIPAA COMPLIANCE AUDITS. What do I need to know?
HEALTH & HUMAN SERVICES OFFICE FOR CIVIL RIGHTS HIPAA COMPLIANCE AUDITS What do I need to know? INITIAL AUDITS PERFORMED IN 2016 Covered Entities Business associates AUDIT PURPOSE: SUPPORT IMPROVED COMPLIANCE
HIPAA PRIVACY POLICY AND PROCEDURES FOR PROTECTED HEALTH INFORMATION THE APPLICABLE WELFARE BENEFITS PLANS OF MICHIGAN CATHOLIC CONFERENCE
HIPAA PRIVACY POLICY AND PROCEDURES FOR PROTECTED HEALTH INFORMATION THE APPLICABLE WELFARE BENEFITS PLANS OF MICHIGAN CATHOLIC CONFERENCE Policy Preamble This privacy policy ( Policy ) is designed to
HIPAA Privacy, Breach, & Security Rules
HIPAA Privacy, Breach, & Security Rules An Eagle Associates Presentation Eagle Associates, Inc. www.eagleassociates.net info@eagleassociates.net P.O. Box 1356 Ann Arbor, MI 48106 800-777-2337 Eagle Associates,
Regenstrief Center for Healthcare Engineering HIPAA Compliance Policy
Regenstrief Center for Healthcare Engineering HIPAA Compliance Policy Revised December 6, 2017 Table of Contents Statement of Policy 3 Reason for Policy 3 HIPAA Liaison 3 Individuals and Entities Affected
HIPAA Privacy and Security Breaches 10 Things To Know
HEALTHCON 2016 HIPAA Privacy and Security Breaches 10 Things To Know Orlando April 11, 2016 Presented by Paul R. Hales, J.D. April 11, 2016 HIPAA Breaches 10 Things To Know presented by Paul R. Hales,
Interim Date: July 21, 2015 Revised: July 1, 2015
HIPAA/HITECH Page 1 of 7 Effective Date: September 23, 2009 Interim Date: July 21, 2015 Revised: July 1, 2015 Approved by: James E. K. Hildreth, Ph.D., M.D. President and Chief Executive Officer Subject:
HITECH Poses Important Challenges... Are You Compliant?
Presents a Webinar HITECH Poses Important Challenges... Are You Compliant? A program for Clinic and Hospital Administrators, Risk Managers, and other interested staff. Joint Sponsor Kansas Hospital Association
Changes to HIPAA Under the Omnibus Final Rule
Changes to HIPAA Under the Omnibus Final Rule Kimberly J. Kannensohn and Nathan A. Kottkamp, McGuireWoods 1 The Long-Awaited HIPAA Final Rule On Jan. 17, 2013, the Department of Health and Human Services
Long-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates
Long-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates November 7, 2013 Brad M. Rostolsky Partner Reed Smith LLP brostolsky@reedsmith.com Nancy
Preparing for a HIPAA Audit & Hot Topics in Health Care Reform
Preparing for a HIPAA Audit & Hot Topics in Health Care Reform 2013 San Francisco Mid-Sized Retirement & Healthcare Plan Management Conference March 17-20, 2013 Elizabeth Loh, Esq. Copyright Trucker Huss,
Visit our Practice Group blog: www.workplaceprivacycounsel.com What Does The New Omnibus HIPAA/HITECH Final Rule Really Mean For Employers And Their Service Providers? Philip L. Gordon, Esq. Littler Mendelson,
GUIDANCE ON HIPAA & CLOUD COMPUTING http://www.hhs.gov/hipaa/for-professionals/special-topics/cloudcomputing/index.html January 26, 2017 Health Care Cloud Coalition Deven McGraw, Deputy Director, Health
An Overview of the Impact of the American Recovery and Reinvestment Act of 2009 on the HIPAA Medical Privacy and Security Rules
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. An Overview of the Impact of the American Recovery and Reinvestment Act of 2009 on the HIPAA Medical Privacy and Security Rules Alden J. Bianchi Updated
The HIPAA/HITECH Final Rule: Time to Get More Serious About Compliance. Patricia A. Markus, Esq.
The HIPAA/HITECH Final Rule: Time to Get More Serious About Compliance I. INTRODUCTION Patricia A. Markus, Esq. AHLA Hospitals and Health Systems Law Institute February 13, 2013 On January 17, 2013, the
The Privacy Rule. Health insurance Portability & Accountability Act
The Privacy Rule Health insurance Portability & Accountability Act Enacted on August 21, 1996 to amend the Internal Revenue Code of 1986 To improve portability and continuity of health insurance coverage
GUIDE TO THE OMNIBUS HIPAA RULE: What You Need to Know and Do
GUIDE TO THE OMNIBUS HIPAA RULE: What You Need to Know and Do By D Arcy Guerin Gue, Phoenix Health Systems, a division of Medsphere Systems Corporation With Steven J. Fox, Post & Schell Originally commissioned
HIPAA HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT HIPAA OMNIBUS FINAL RULE HITECH GINA TERMINOLOGY OMNIBUS FINAL RULE Issued January 23, 2013 Effective March 26, 2013 Modified HIPAA privacy and security
HIPAA. What s New & What Do I Have To Do? Presented by Leslie Canham, CDA, RDA, CSP (Certified Speaking Professional)
HIPAA Infection Control OSHA Dental Practice Act HIPAA What s New & What Do I Have To Do? Presented by Leslie Canham, CDA, RDA, CSP (Certified Speaking Professional) In the dental field since 1972, Leslie
AROC 2015 HIPAA PRIVACY AND SECURITY RULES
AROC 2015 HIPAA PRIVACY AND SECURITY RULES Presented by: Robert A. Paster, Esq. Brach Eichler L.L.C. 101 Eisenhower Parkway Roseland, NJ 07068 973-403-3144 rpaster@bracheichler.com www.bracheichler.com
NPRM: Modifications to the HIPAA Privacy, Security, and Enforcement Rules under HITECH
NPRM: Modifications to the HIPAA Privacy, Security, and Enforcement Rules under HITECH Speakers Lisa A. Gallagher, BSEE, CISM, CPHIMS Senior Director, Privacy and Security HIMSS lgallagher@himss.org Amy
HIPAA Breach Notice Rules New notice requirements for HIPAA covered entities when there is a breach of Protected Health Information (PHI)
HIPAA Breach Notice Rules New notice requirements for HIPAA covered entities when there is a breach of Protected Health Information (PHI) On August 24, 2009, the Department of Health and Human Services
HIPAA Data Breach ITPC
HIPAA Data Breach Objectives Overview of Omnibus Rule - Data Breach Suspected Breach - Investigation Audit Risk Assessment Corrective Action Plan Written Notification Elements NYS Rules on Data Breach
IAPP Privacy Academy September 30 October 2, 2013 HEALTHCARE BREACH TRIAGE Theodore P. Augustinos EDWARDS WILDMAN PALMER LLP Kenneth P. Mortensen CVS/CAREMARK 2013 Edwards Wildman Palmer LLP & Edwards
MONTCLAIR STATE UNIVERSITY HIPAA PRIVACY POLICY. Approved by the Montclair State University Board of Trustees on April 3, 2014
MONTCLAIR STATE UNIVERSITY HIPAA PRIVACY POLICY Approved by the Montclair State University Board of Trustees on April 3, 2014 Table of Contents Page I. PURPOSE... 1 II. WHO IS SUBJECT TO THIS POLICY...
HIPAA Enforcement Under the HITECH Act; The Gloves Come Off
HIPAA Enforcement Under the HITECH Act; The Gloves Come Off Leeann Habte, Esq. Michael Scarano, Esq. December 6, 2011 Attorney Advertising Prior results do not guarantee a similar outcome Models used are
February Page 1 of 2013 11 Health Law Diagnosis HHS Releases Final HITECH Omnibus Rule After waiting over two years from the publication of the Notice of Proposed Rulemaking to implement provisions of
Key Legal Issues in EMR, EMR Subsidy and HIPAA and Privacy Click Issues to edit Master title style
Key Legal Issues in EMR, EMR Subsidy and HIPAA and Privacy Click Issues to edit Master title style July 27, 2016 www.mcguirewoods.com Introductions Holly Carnell McGuireWoods LLP hcarnell@mcguirewoods.com