Source: https://www.cchipaa.com/Blog/TabId/32669/PostId/6993/key-facts-about-hipaa-compliance-what-you-need-to-know-part-4.aspx
Timestamp: 2019-09-22 02:31:19
Document Index: 270379849

Matched Legal Cases: ['art 4', '§ 164', 'art 1', 'art 3', 'art 5', 'art 2']

HIPAA Compliance Blog | Key Facts About HIPAA Compliance – What Y
Key Facts About HIPAA Compliance – What You Need to Know – Part 4 in HIPAA.
Tagged With: compliance, HIPAA, key facts
Our series is designed to explain best practices about HIPAA compliance, HIPAA settlements, and the various requirements an organization must have in place under the HIPAA Security and Privacy Rules.
The Need for Contingency Plans and Testing
The HIPAA Security Rule, under CFR § 164.308 for Administrative Safeguards, states the requirement to establish and implement, as needed, Contingency Plan policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, or natural disaster) that can damage systems which contain electronic protected health information. Regardless of the size of your organization, a plan must be in place.
The requirements also call for the implementation of procedures for periodic testing and revision of the contingency plan.
What Must Be Covered in the Contingency Plan?
The plan does not need to be overly elaborate, but it must be functional. It should be clear and concise as to what to do in the event of an information systems failure, whether caused by natural or man-made disasters.
Here are some areas that must be covered in the plan:
It is vitally important to maintain an asset inventory of all software and hardware that can access and store ePHI.
Define all routine operations and preventive measures.
Define data backup and recovery procedures.
Determine who is alerted when a disaster occurs, and how the plan is invoked.
Describe how to shut down all information systems in the event of a potential or active disaster.
Describe how to access backup ePHI data in the event of an emergency. This is especially important if your organization provides critical health care services on a 24/7 basis.
Routinely test the plan.
Our goal at Colington is to help keep your organization one step ahead in making sure those tasked with implementing a Contingency Plan understand the requirements.
Have a question about HIPAA compliance? Let us know online or by calling us at (800) 733-6379, and we would be pleased to discuss it with you and perhaps also address it in this series.
Key Facts About HIPAA Compliance – What You Need to Know – Part 1
Individuals’ Rights Under HIPAA to Access Their Health Information
Recently, the Director of the Office for Civil Rights (OCR), Roger Severino, made an announcement at the 28th Annual HIPAA Summit in Washington, D.C. The announcement was regarding the possibility of compliance reviews in the wake of numerous complaints about Covered Entities not complying with specific requirements for an individual’s right to access their own health information.
To further that point, OCR partnered with the HHS Office of the National Coordinator for Health Information Technology to create fact sheets and videos to inform patients about their rights under HIPAA.
What Are Some of Those Rights?
If you are a Covered Entity, you must know, understand, and comply with these patient rights:
Under the Privacy Rule, Covered Entities must usually provide a person with their own protected health information (PHI) if they request this information. (Exceptions are explained in the Privacy Rule.) The PHI would be located in one of the Covered Entity’s “designated record sets” for that person.
This rule also gives the requesting person the right to view and/or acquire a copy of their own PHI. The Covered Entity must also provide a copy of the person’s PHI to an outside person or entity of the person’s own choosing.
The Covered Entity is required to give access to this information in whole or in part as requested. (Certain types of access to a person’s PHI can be declined, as explained below.) This access must be given within 30 calendar days after receiving the person’s PHI request.
The Privacy Rule allows a Covered Entity to charge a reasonable fee for providing a person with a copy of their own PHI upon request. The requestor may also agree to get a summation of their own PHI rather than an actual copy.
Our goal at Colington is to help keep your organization in full compliance of the law. We will help you make sure that those who are tasked with maintaining and sharing health care records understand all of the requirements associated with patient rights.
In our next part of this series, we will provide more of these rights. We want your organization or medical practice to stay in the loop of the latest federal governmental rules so that you can retain your excellent reputation and your outstanding bottom line – without incurring unnecessary fines.
If you would like to know more about HIPAA compliance, or if you have any questions about how you can stay in line with the rules and avoid penalties, contact us today. We would be pleased to discuss it with you and perhaps also address it in this series.
Call us toll-free at (800) 733-6379 to partner with our team in maintaining full HIPAA compliance. We look forward to hearing from you.
Key Facts About HIPAA Compliance – What You Need to Know – Part 3
With more emphasis by the Office for Civil Rights (OCR) on specific requirements for an individual’s right to access their personal health information (PHI), the Key Facts series continues to provide you more information on this topic.
Remember, patients’ rights to access their health information must be a priority along with appropriate, required, timely follow-up.
Every person has the right to access his or her own PHI in a “designated record set.” This refers to a collection of records that are maintained by or for a covered entity, encompassing the:
Medical and billing documentation about a person as maintained by or for a covered health care provider;
Enrollment, payment, claims, and case management information as maintained by or for a health plan; or
Other documentation that is used, whether fully or partially, by or for the covered entity in order to make decisions about people. This includes records regarding the person who is requesting the access.
The documentation, or “record,” refers to any item, collection, or group of information that includes a person’s PHI. It is maintained, collected, used, or disseminated by or for a covered entity.
Persons have the right to access a wide range of health information about themselves. This information may be maintained by or for covered entities, which include:
Medical laboratory test results
Medical images, such as X-rays
Wellness and disease management program files
Information that may be used to make decisions about people
However, when responding to a request for a person’s health information, a covered entity is not required to assemble new information that does not already exist in the designated record set.
Our goal at Colington is to help keep your organization one step ahead. We can help you make sure that those tasked as the custodians of records understand all the requirements associated with patient rights. In our next part, we will explain more of these rights to you.
Have a question about HIPAA compliance? Let us know and we would be pleased to discuss it with you and perhaps also address it in this series. Feel free to call us at (800) 733-6379 if you have any questions about keeping your own medical practice in line with all of the latest laws and regulations.
Key Facts About HIPAA Compliance – What You Need to Know – Part 5
Whether it is a man-made or natural disaster emergency, there will be occasions when organizations will need to provide services and support during these situations.
The HIPAA Privacy Rule already allows for certain permitted disclosures of protected health information (PHI) without patient authorized. These permitted disclosures will still apply in emergency situations.
Should the President declare an emergency or disaster and the Secretary of HHS declares a public health emergency, the Secretary may waive sanctions and penalties against a covered hospital that does not comply with certain provisions of the Privacy Rule. These waivers are limited in scope, situationally applied, in place only for limited periods of time, and the Privacy Rule still remains in effect.
What Type of PHI can be Disclosure?
An organization is permitted, but not required, to use and disclose PHI, without an individual’s authorization, for the following purposes or situations:
Public Interest and Benefit Activities; and
What is important to know, is healthcare practitioners may rely on professional ethics and the best interest of the patient in deciding which of these permissive uses and disclosures to make.
Our goal at Colington is to help keep your organization one step ahead in making sure those tasked with implementing a Contingency Plan understands the requirements.
Key Facts About HIPAA Compliance – What You Need to Know – Part 2
Individuals’ Rights to Access Health Information Under HIPAA
With more emphasis by the Office for Civil Rights (OCR) on specific requirements for an individual’s right to access their own health information, our Key Facts series continues to provide you more information on this topic.
Remember, patients’ rights to access their health information must be a priority along with appropriate and timely follow-up as required.
Make sure your workforce understands these requirements.
If you are a Covered Entity, you must know and understand these patient rights:
The HIPAA Privacy Rule enables covered entities to require patients to put their health-information request in writing. It also requires that the person’s identity be verified.
However, a covered entity cannot impose unreasonable requirements to a person requesting access to their health information, and this entity also cannot create an unreasonable delay to this access.
For example, a physician cannot require a health-information requestor to:
Physically come to the physician’s office to request access and provide identification if the patient simply wants the medical records sent to their home address on file.
Request access via a web portal. Not everyone has access to the internet.
Send the request via mail. This can cause unreasonable delays in obtaining access.
Therefore, a covered entity cannot require any of the above of individuals, but the entity may allow individuals to request their own health information in any of those three ways (in person, portal, or mail-in request). Covered entities are encouraged to offer patients several ways in which they can request access of their health information.
Our goal at Colington is to help keep your organization one step ahead in making sure those tasked as the custodians of medical records understand all of the requirements associated with patient rights. In our next article, we will explain more of these rights.
Have a question about HIPAA compliance? Let us know and we would be pleased to discuss it with you and perhaps also address it in this series. You can also reach us at (800) 733-6379 today.