Source: http://store.hipaasurvivalguide.com/hipaa-newsletter-august-2015-archive.html
Timestamp: 2017-09-19 11:34:49
Document Index: 132931111

Matched Legal Cases: ['§164', '§164', '§164', '§164', '§164', '§164', '§164']

HIPAA Newsletter August 2015 Archive - HSG Store
HIPAA Newsletter August 2015 Archive
August 2015 Issue 69
August Webinar: Launch your HIPAA Initiative in 10 Steps
Description: This webinar will discuss how to gain significant traction in your HIPAA compliance initiative in 10 easy to follow steps.
Thu, Aug 20, 2015 2:00 PM - 3:30 PM EDT
Launch your HIPAA Initiative in 10 Steps
1. Designate a HIPAA Privacy Officer and Security Officer (Track = "Foundation")
1.1. Present candidates with the necessary credentials or candidates willing to obtain the necessary credentials to the executive team.
2.2. Make changes to the policies based on executive team feedback.
2.3. Allow the executive team to review the FINAL policies.
2.4. Distribute the policies to the entire organization and ensure that each individual indicates that he/she has read and understood the policy by signing his/her name in the signature block.
2.5. Scan signed policies and store them in the Organization's Compliance Repository
2.6. Distribute policies to new Workforce Members as required.
2.7. Once a year review the policies with the executive team to ensure continued applicability.
3. Training & Awareness (Track = "Foundation")
3.1. Introduce the training program to executive team and get buyin
3.4.2. Each class discusses the training and provides feedback to the Core Training Team.
3.4.3. Any individual that does not make 70% or better on an exam must go through the training again and retake the exam.
3.4.4. The Core Training Team may want to produce several variations of each test to make test re-takes meaningful.
4. Compliance Repository (Track = "Foundation")
4.1. Review with the executive team where the Compliance Repository should be stored and maintained. An in-house Intranet/Wiki (secured obviously on a need to know basis) is a perfect place for it. A "network share" would work just as well. If you are tempted to store on it on the Cloud then it better be on your own private cloud or you will need a Business Associate Agreement with your cloud provider (e.g. Microsoft, Amazon, etc.).
4.2. Your electronic Compliance Repository is the equivalent of your "old 3-ring binder" only much more effective. Here you can clearly determine what the latest version of a policy is (i.e. a single version of the "truth"). However, your Compliance Repository also stores your written processes and also process results (e.g. your training tracking spreadsheet, your security incidents, your patients and Workforce Member's signed policies). In other words your Compliance Repository is where you store your Visible, Demonstrable, Evidence of compliance (i.e. proof that your organization is complying with your policies and processes).
4.3. Create the Root folder/page ("Folder") and call it Compliance Repository (or something to that effect).
4.3.1. Under the Root create a directory for "Policies and Procedures"-we suggest that you further breakdown this folder in to subject matter domains such as:
4.3.1.1. Privacy Rule
4.3.1.2. Security Rule
4.3.1.3. Breach Notification Rule
4.3.1.4. Cloud
4.3.1.5. Social
4.3.1.6. Mobile
4.3.1.7. Disaster Recovery
4.3.1.8. Risk Assessments
4.3.1.9. Risk Management
4.3.1.10. Patient requests under the Patients' Bill of Rights ("PBR")-§§164.520 through §§164.528
4.3.1.10.1. Notice of Privacy Practices §164.520
4.3.1.10.2. Rights to Request Restrictions §164.522
4.3.1.10.3. Rights to Access PHI §164.524
4.3.1.10.4. Rights to Amend PHI §164.526
4.3.1.10.5. Rights for an Accounting of Disclosures for PHI §164.528
4.3.1.11. Etc.
4.3.2. Under the Root create a Folder for Business Associates-further break down this Folder into one Sub-Folder for each Business Associates.
4.3.3. Under the Root create a Folder for Sub-Contractors-further break down this Folder into one Sub-Folder per Sub-Contractor.
4.3.4. Under the Root create a Folder for Workforce Members-further break down this Folder into one Sub-Folder per Member.
4.3.5. Under the Root create a Folder for Training-further break down this Folder into types of Training.
4.3.6. Under the Root create a Folder for Security Incidents-further breakdown this Folder into one Sub-Folder per incident with a date attached to the Sub-Folder name.
4.3.7. Create additional Folder and Sub-Folders under the Root as required.
4.3.8. Ensure that the Compliance Repository gets backed up on a daily basis and is otherwise protected from a Disaster Recovery perspective like you would protect PHI.
5. Risk Assessment (Track = "Foundation")
5.2.6. Determine the level of Risk associated with Threat/Vulnerability pairs.
5.2.7. Identify new/modified Security Controls and finalize documentation.
6.3. Get "Satisfactory Assurances" from your Business Associate that they are comply with the HIPAA Rules in a manner required by the HITECH
Act and corresponding regulations, and by the BAA.
6.4.3. Have a Breach Notification Communication plan thirty days after executive/renewal of the BAA in all cases where the Business Associate.
"stores and maintains" ePHI on your behalf.
7.5. Follow-up with Breach Notification Training if you have not already accomplished this objective in another Sprint.
7.6. Ensure that everyone takes and passes the Breach Notification Training exam.
8. Patient's Bill of Rights (Track = "Essential")
8.1. Notice of Privacy Practices ("NOPP")-review/revise processes for distributing, updating and revising your NOPP as required
8.1.1. Walk In-in person visits.
8.2. Access to PHI
8.3. Amendment to PHI
8.4. Accounting for Disclosures
9.1. Ensure that your Organization understands the changes to the right to access of PHI introduced by the HITECH Act Section 13405(e)
(i.e. with respect to the use of an EHR), and the changes introduced by the Omnibus Rule
(i.e. with respect to any electronic PHI including, but not limited to, documents in the following format: MS Word, Excel, PDF, etc.).
9.2. Ensure that you adequately train Workforce members that have responsibility for fulfilling PHI access requests:
9.2.1. Job titles must reflect this responsibility
9.5. Store the Patient Request Log and the Access Request Form in the Compliance Repository
10. Patients' Bill of Rights: PHI Amendments (Track="Essential")
10.2. Ensure that you adequately train Workforce members that have responsibility for fulfilling PHI amendment requests:
10.2.1. Job titles must reflect this responsibility