HIPAA

All posts tagged HIPAA

The Risk Of Not Paying Attention to HIPAA Violations

by admin on October 30, 2019 No comments

HIPAA, HIPAA violations, HIPAA compliance

By Jacqueline Bain

On October 23, 2019, the U.S. Department of Health and Human Services has imposed a civil money penalty of over $2 million against Jackson Health System in Florida for repeated HIPAA violations.

The HIPAA violations mentioned in the HHS Press Release include:
1-Loss of paper patient records in December 2012;
2-Loss of additional paper patient records in January 2013;
3-A media report containing patient information (a photo shared on social media);
4-Employees accessing the information of one patient without a job related purpose;
5- An employee’s improper access and sale of patient records in 2011.

“OCR’s investigation revealed a HIPAA compliance program that had been in disarray for a number of years,” said OCR Director Roger Severino. The state of the compliance program allowed for the failure of several HIPAA requirements, including provision of timely and accurate HIPAA breach notifications, performance of regular risk assessments, investigation of identified risks, audits of system activity records, and imposing appropriate restrictions on workforce members’ access to patient information. The government’s final determination is available here.

When a HIPAA breach is discovered and reported, the government will often take the time to review a covered entity’s history of compliance or non-compliance. This may include an investigation into prior issues, effectiveness of policies and procedures, and employee issues. Overlooking one suspected breach may result in the imposition of sanctions on any later breach. This is why it’s so important for a healthcare business to understand its HIPAA obligations and take them seriously.

When was the last time your business conducted a security risk assessment to understand its potential risk areas for security breaches? If you’ve never had one, or haven’t had one recently, the time is now to conduct one. “When was your last security risk assessment?” is often the first thing that the government will ask in response to a breach.

Federal fines for noncompliance with HIPAA are based on the level of negligence perceived by the Federal government at the time of the breach. Fines and penalties range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million. Simply put, your healthcare business can’t afford to bury its head and hope that it won’t be hit.

read more
adminThe Risk Of Not Paying Attention to HIPAA Violations

Genetic Testing HIPAA Warning: Legal Considerations

by admin on January 14, 2019 No comments

genetic testing hipaaBy: Jacqueline Bain

You might have recently received a holiday gift of a direct-to-consumer genetic testing kit from Ancestry.com or 23andMe.com (or any other number of companies). So exciting! In our melting pot society, one can’t help but be curious about where they come from and if they are more likely than any other person to be subject to any number of ailments.

Not so fast though! Before you swab yourself and send away your genes for testing, you might consider what you’re exposing yourself to. Direct-to-consumer genetic testing companies, which provide genetic testing directly to consumers without any intervening healthcare provider, are not bound by HIPAA. They are not considered “covered entities”, and therefore not required to use the same protections for genetic information the way a hospital or your doctor would.

read more
adminGenetic Testing HIPAA Warning: Legal Considerations

Time out! Keeping Healthcare Lead Generation in Check

by admin on December 7, 2018 No comments

healthcare lead generationBy: Michael Silverman

There are perfectly compliant ways to engage with healthcare marketers, and then there’s this; here are some of the latest real-life examples:

“DME BRACE CAMPAIGN – $40 to $150 PER LEAD PER BRACE”

“DME DIABETIC LEADS $40 PER LEAD, INSURANCE AND DOC INFO INCLUDED”

“PAIN CREAM/LIDOCANE LEADS FOR SALE, RX INCLUDED”

These marketers are seemingly holding auctions for the sale of federally protected patient health information out to the highest bidder! Couldn’t make this stuff up – if you’re in this industry, a quick gander at your (business) social media platforms will quickly confirm it.

read more
adminTime out! Keeping Healthcare Lead Generation in Check

GDPR Compliance: Has Your Company Prepared for the Heightened Data Privacy Regulations?

by admin on June 6, 2018 No comments

“Protecting someone else’s data protects all of us.” Tim Cook, CEO of Apple

General Data Protection Regulation

By: Shobha Lizaso

We are in the age of electronic data and heightened data privacy. New laws to strengthen individuals’ privacy rights and to strengthen data protection are evolving worldwide. The General Data Protection Regulation (GDPR) establishes protections for the privacy and security of personal data about residents of the European Union. This new law affects US healthcare providers and organizations that provide services to residents of any of the EU countries, that collect data from EU residents or monitors EU residents through the use of cookies and the like, and practitioners involved in medical tourism programs and other clinical activities. GDPR imposes more restrictions on the collection, use, processing, storage, disclosure, and disposition of patient data than HIPAA.

GDPR became effective on May 25, 2018, and there will not be a compliance grace period, so healthcare providers should meet with their healthcare technology attorney to determine whether they are subject to the GDPR, to update their online Terms of Use & Privacy Policies, and to audit internal data handling procedures to prevent any violations.

read more
adminGDPR Compliance: Has Your Company Prepared for the Heightened Data Privacy Regulations?

New HIPAA Guidance for Substance Abuse and Mental Health Information

by admin on January 5, 2018 No comments

HIPAA PHIBy: Dave Davidson

In December 2016, the US Congress passed the 21st Century Cures Act, which, among other things, provided for increased funding for treatment and research of mental health and substance abuse disorders.  That law also required the HHS Office of Civil Rights (OCR) to provide guidance in regards to HIPAA compliance in regards to those types of treatment.  In October 2017, President Donald Trump declared the opioid addiction epidemic to be a public health emergency, which will also result in additional resources being allocated to addressing the crisis.

In connection with both the new law and the President’s declaration, OCR published its HIPAA guidance in December 2017.  The guidance is intended to clarify how and when protected health information (PHI) can be shared in regards to patients in substance abuse and mental health treatment.  According to OCR Director Roger Severino, “HHS is using every tool at its disposal to help communities devastated by opioids, including educating families and doctors on how they can share information to help save the lives of loved ones.”

read more
adminNew HIPAA Guidance for Substance Abuse and Mental Health Information

Healthcare Trade Secrets: How to Protect Your Practice’s Trade Secrets

by admin on November 8, 2016 No comments

dreamstimemaximum_51887081-flipBy: Shobha Lizaso

“Prevention is better than cure” is a maxim that has reigned in the healthcare industry for thousands of years; however, this phrase echoes through the halls of the legal profession as well.

Healthcare practices often neglect to appreciate the value of their confidential information as assets and the need to protect these assets. Although HIPAA and HITECH compliance aids in maintaining the confidentiality of patient records, it does not protect a provider’s trade secrets.

Trade secrets of a healthcare practice may include any of the following: patient lists, financial information, contract rates, contract terms client lists, collection rates, marketing tactics, pricing/discount information, and methods of doing business. If leaked, this information may be used by competitors to secure advantages over a healthcare practice. For example, patient lists could be used to solicit a practice’s patients or contract rates and terms can be used by a competitor to undercut the rates of a practice.

read more
adminHealthcare Trade Secrets: How to Protect Your Practice’s Trade Secrets

HIPAA Compliance: Docs, You’ve Been Hacked. What’s Next?

by admin on August 11, 2016 No comments

HIPAABy: Jacqueline Bain

Healthcare providers have heard the HIPAA disaster stories: a laptop containing patient information is left on the counter at the coffee shop; a thumb drive with patient files goes missing; a rogue employee accesses patient information she has no business accessing; hackers get into a practice’s server and hold the patient information for ransom.

HIPAA is a federal law designed for safe disclosure of patient’s protected health information.  The news headlines showcase giant penalties for violations.  However, Florida healthcare providers should also know that Florida has its own consumer protection statute, called the Florida Information Protection Act.  So while you’re busy worrying about your HIPAA exposure in any of these situations, remember that there is potential State exposure as well.

So what should a healthcare provider do if it believes there has been a hack or some other unauthorized disclosure?  Responses vary based on the situation presented, but below is a good jumping off point:

read more
adminHIPAA Compliance: Docs, You’ve Been Hacked. What’s Next?

Out of Network VOB Process Hits a Speedbump

by admin on June 15, 2016 No comments

VOBBy: Urgent Medical Billing, Guest Contributor

The verification process is an important step in the billing cycle. When done correctly the patient’s “VOB” will allow a healthcare provider to quickly determine if they can accept the patient for treatment or not. A good verification will tell a provider the general information about a patient’s insurance policy such as the deductible, the co-insurance and the out of pocket maximum. A very good verification will also include accreditation requirements, information on who would receive the payment for services, correct claims addresses for professional and facility charges and more. The quicker a verification is done, the sooner a patient can be brought into treatment. Speed and accuracy is the name of the game when it comes to insurance verification and United Healthcare, until very recently, was one of the quickest policies for an Insurance Verification Specialist to work with. 

read more
adminOut of Network VOB Process Hits a Speedbump

What is FIPA and How Is FIPA Different From HIPAA?

by admin on March 15, 2016 2 comments

By: Jackie Bain

FIPA is the Florida Information Protection Act of 2014.  It became elective on July 1, 2014.  Many people consider FIPA to be Florida’s state law counterpart to the Federal Government’s Health Information Protection and Administration Act of 1996 (“HIPAA).  However, FIPA is, in many respects, more far reaching than HIPAA.  Those who transact business in the State of Florida are well-served to be knowledgeable about FIPA.

FIPA affects more than just health care providers and those in the healthcare industry.  Under FIPA, any business that acquires, stores, maintains or uses personal information must take reasonable measures to safeguard that information.  “Personal information” includes the use of a person’s first and last name (or first initial and last name) in conjunction with his or her social security number, driver’s license or other government identification number, bank account number, credit or debit card number and password or pin, medical history, or health insurance policy number.  A convenience store that might have access to a person’s name and credit card number is just as accountable under FIPA as a hospital who might store that person’s medical history and insurance information.

read more
adminWhat is FIPA and How Is FIPA Different From HIPAA?

Physician Communications: Considerations for Using Text Messages and Social Media

by admin on March 6, 2015 No comments

doctors textingBy: Jackie Bain

It is becoming easier and easier for physicians to communicate with each other and their patients.  And although open communication is generally thought of as positive, the medical profession should proceed with caution.  Patients and consulting physicians rely heavily on their communications with their treating physicians.  Thus, communications which do not require the thought of focus that a physician would otherwise give to a situation may result in disaster. While there are many potential ways a physician might use text messaging and social media both professionally and personally, we will focus generally on physician interactions with other physicians, and physician interactions with patients.

To start, physicians should be aware that, in 2011, the American Medical Association issued guidelines in its Code of Ethics for physicians who use social media:

read more
adminPhysician Communications: Considerations for Using Text Messages and Social Media