Archives for January 2015

Are You Prepared to Report a Data Breach? Assuring Collection of the Right Data Elements

January 28, 2015 by Danika Brinda Leave a Comment

As of today, there has been 1170 data breaches reported to Department of Health and Human Services, which have impacted over 40 million individuals. The numbers continue to increase at a rapid pace with a clear concern for data breaches in 2015. The final breach notification rule requires that healthcare organizations conduct a data breach investigation on each and every unauthorized use and disclosure of protected health information to determine if there is a “low probability that the information is compromised.” Four objective questions must be asked and answered EVERYTIME an investigation is completed:

The nature and extent of the PHI involved in the data breach, including the types of identifiers and likelihood of the re-identification
The unauthorized person (people) who used the PHI or whom it was disclosed to
Whether the PHI was viewed, acquired, or re-disclosed
The extent to which the risk to the PHI has been mitigated

With the answers to these questions complete, healthcare organizations can feel confident they have the documentation and burden of proof in place to submit a data breach to the Secretary of the Department of Health and Human Services (DHHS) – WRONG!!! Many more data elements must be collected during the investigation in the event that a data breach needs to be reported to DHHS. The notification submission method for a data breach from the Secretary of DHHS has recently been updated – which has more clear data elements and requirements for reporting. Understanding the data elements that must be reported is the foundation of creating a proper method for investigating and documenting a data breach. With the updated reporting form, covered entities and business associates must be ready to report all these data elements:

Breach Start Date
Breach End Date
Discovery Start Date
Discovery End Date
Approximate Number of People Impacted
Type of Breach (Hacking/IT Incident, Improper Disposal, Loss, Theft, Unauthorized Access/Disclosure)
Location of Breach (Desktop Computer, Electronic Medical Record, Email, Laptop, Network Server, Other Portable Electronic Device, Paper/Films, Other-Must enter a location)
Type of Protected Health Information Involved (Clinical, Demographic, Financial, Other-Must enter a details)
Brief Description of the Breach
Safeguards in Place Prior to Breach (None, Privacy Rule Safeguards, Security Rule Administrative Safeguards, Security Rule Technical Safeguards, Security Rule Physical Safeguards)
Individual Notice Provided Start Date
Individual Notice Provided End Date
If Substitute Notice was required
If Media was notified
Actions taken in response to breach

If you are not collecting all these data points each time you are completing an investigation, you run the risk of not having all the accurate data and potentially have to repeat the investigation. Create a process that assures collection of all required data elements needed for a breach reporting up front so you don’t have to repeat work and run the risk of extending past the 60 day investigation and notification timeline! Don’t get in the habit of doing duplicate work – collect all the data elements up front. If you need a tool – contact TriPoint!

And don’t forget to check out the new and improved Data Breaches Impacting Greater than 500 Individuals website – https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

Data Breach Fun Facts – Since September 1, 2009!

The Make Up of the Data Breach Organizations
- 733 from Healthcare Providers
- 328 from Business Associates
- 104 from Health Plans
- 5 from Healthcare Clearing Houses
Theft and Loss account for 63.5% of Data Breaches
Paper is the top media source for data breaches making up 22.3%
Laptops are the second top medium source making up 21.7%
Largest data breach was in 2011 – 4.9 Million Individuals Impacted

Prepare, Document, and Take Action!

Danika

Don’t Get Run Over by the HIPAA Omnibus!

January 23, 2015 by Danika Brinda Leave a Comment

HIPAA Compliance continues to be a HOT TOPIC in healthcare. Everyday news and information is published about the lack of compliance, the struggles within organizations, data breaches occurring, and the HIPAA audits coming. In 2013, the HIPAA Omnibus Rule was established which had many provisions on the HIPAA Privacy and Security Regulations. With the compliance date of September 23, 2013, many healthcare organizations and business associates have not taken proper steps to get to climb onto the HIPAA Omnibus and assure compliance with the new regulations.

A recent study conducted by NueMD in 2014 provided insight into compliance levels with the HIPAA Regulations and the HIPAA Omnibus Rule. Over 1,000 Medical Practices and 160 Billing Companies were surveyed in regards to the current level of compliance with HIPAA and the changes with the HIPAA Omnibus Rule. The results were SHOCKING and EYEOPENING!!!! Check out some key findings:

36% of respondents stated they didn’t know about the HIPAA Omnibus Rule
68% of respondents stated they didn’t know of the HIPAA Audits
23% of respondents stated they had no HIPAA Compliance Plan
54% of respondents stated they didn’t have a Security Officer
45% of respondents stated they didn’t have a Privacy Officer
55% of respondents stated they had no process established for Breach Notification

Based on the findings, it is clear that healthcare organizations need to step up and establish HIPAA Compliance Programs and ensure they are updating their information to include the HIPAA Omnibus Requirements. Jump on the HIPAA Omnibus and ensure that the organization has a joyful ride rather than being ran off the road.

The major components of the HIPAA Omnibus Rule that healthcare organizations AND business associates need to evaluate and implement within their organization are:

Breach Notification
Business Associates Compliance Requirements
Sale of Protected Health Information
Marketing and Protected Health Information
Fundraising and Protected Health Information
Research Authorization Changes
Access to Immunization Data
Electronic copy of Protected Health Information
Access to Deceased Patient’s Records
Genetic Information Nondisclosure Act (ACT)
Restriction of Protected Health Information to Health Plans
Update to the Notice of Privacy Practices

Please note this is not an “end all be all” list of requirements. Each organization needs to assess the regulatory changes and determine how and what applies to their specific organization.

With the HIPAA Delays – healthcare organizations are given the gift of time. Use this time to get aboard the HIPAA Omnibus and assure that you have updated or established all appropriate policies and procedures for your organization. Don’t delay any longer – the time is NOW!

Danika

Source: NueMD Survey Findings: http://www.nuemd.com/hipaa/survey/practice-findings.html

Going from 0 to HIPAA Compliant – Like Climbing Mt. Everest: Small Steps Take You a Long Way

January 15, 2015 by Danika Brinda Leave a Comment

Moving from 0 to HIPAA Compliant can be a lot like climbing Mt. Everest. Starting from the bottom and staring up to try and see the peak of Mt. Everest is challenging just as starting the route to HIPAA compliance can be. When climbing Mt. Everest, nobody sets to climb to the summit in one day. Instead, they prepare themselves for the climb, and they break it up and take it in small steps – with a dream of reaching the summit. The usual course of the climb is:

Ice Fall
Camp 1
Camp 2
Camp 3
Camp 4
Everest Summit (YES)!

Looks easy, right? WRONG! At times, climbers spend 4 – 8 weeks at the different camps trying to acclimate themselves to the altitude and prepare themselves for the next hike up the mountain. The time spent moving between camps takes hours upon hours and can be treacherous and dangerous. But the moment that the climbers walk the last few steps and make it to the summit, all the hard work and dedication pays off. They can finally enjoy the success of the momentous task they just accomplished.

BREATH, EXIST, and ENJOY the moment – because then they remember that they have to climb down AND the only way down – is the way that they came up.

When first reviewing the HIPAA Privacy and Security Regulations, it can be SCARY and OVERWHELMING, similar to climbing Mt. Everest. Between the two regulations, writing policies and procedures and establishing practices for an organization can take weeks, even months. The challenge that HIPAA privacy and security practitioners face is that HIPAA usually is another added task to one’s already full plate, creating an even bigger hurdle in the path to the summit of HIPAA compliance. With all the conflicting priorities and trying to meet so many deadlines, HIPAA tasks usually gets pushed off to the side or left for ‘tomorrow’ to do. How many times has HIPAA come up on your ‘To-Do’ list and got pushed off until tomorrow?

Looking at the requirements under HIPAA – it is easy to see how it can be overwhelming when you are starting from scratch or reviewing what you already have in place (if you are unclear about the HIPAA requirements – contact me).

Take a new philosophy on HIPAA Compliance and Commit to 3 tasks daily. Think of the movement towards HIPAA compliance as your movement toward the different camps that the climbers make it to as they take the challenge of climbing Mt. Everest. This may sound silly or a little ‘too easy’ but when you take a complicated task and break it down to small daily tasks, it seems a little more achievable and not so overwhelming.

A Sample Week of HIPAA Tasks (Privacy Rule):

Monday	1. Update Notice of Privacy Practices 2. Update process for Notice Signatures 3. Update P&P on Notice of Privacy Practices
Tuesday	1. Review P&P on Uses and Disclosures of Protected Health Information 2. Observe processes for releasing health information 3. Evaluate documentation received for disclosures of health information
Wednesday	1. Review recent Request for Amendments of Medical Record Documentation 2. Evaluate and Update Amendment Policy and procedure 3. Assure Amendment Request form is adequate are being process timely
Thursday	1. Review all accounting of disclosure (AOD) requests 2. Evaluate and update AOD policy and procedure 3. Assure AOD Request form is adequate and requests are being process timely
Friday	1. Evaluate areas that need re-training and education on practices reviewed this week 2. Create a training plan for workforce members 3. Evaluate and Update HIPAA Training Policy and Procedure

The one important item to remember is – YOU CAN’T GET IT DONE IN A DAY! To truly evaluate your level of HIPAA compliance, create and implement privacy and security practices within your organization, and effectively train your workforce – you need to dedicate time and effort to the project. And remember, once you get it all done – it is not time to sit back, relax and never worry again. It is the time for evaluation and assurance that what has been established for HIPAA compliance with what is being practiced within your organization – similar to climbing back down Mt. Everest.

Remember the famous Spanish saying “Poco a Poco se va lejos” (Little by Little, One Goes a Long Way). Small steps can make all the difference in the successful creation, evaluation, and execution of a solid and complete HIPAA Compliance Program!

Danika

HAPPY NEW YEAR – HIPAA Style!

January 2, 2015 by Danika Brinda Leave a Comment

2014 was an epic year for healthcare data breaches. From hacking into systems, breaking into healthcare organizations, theft of portable media, and improper destruction of paper records, the healthcare sector saw the largest data breach increase in 2014. With 2015 just starting out, predictions are that healthcare organizations will see another increase in the number of data breaches. While nothing can completely eliminate the risk to a healthcare organization regarding a data breach, simple steps can be put into place to manage and oversee the privacy and security protections established by healthcare organizations. By taking some simple steps with the new year, healthcare organizations can proactively manage their privacy and security programs, and deter the potential data breach from occurring. Follow the Happy New Year steps and your organization will be well on its way to effective and efficient privacy and security management of protected health information!

H – Have a strong breach investigation process defined and implemented

A – Assure regular staff training and updates on privacy and security

P – Pay attention to who has access to what information (Minimum Necessary)

P – Proactive reviews of audit logs for software that maintains protected health information

Y – Yearly risk assessment and risk management

N – Narrow access of protected health information to only get access to what is needed

E – Evaluation of privacy and security safeguards implemented to assure they are working effectively

W – Watch how people are working to determine how they are protecting health information

Y – Yearly review of business associates and the contracts that are established

E – Evaluate the use of encryption in the organization and document why, if encryption was not chosen

A – Adequate apply proper security patches and malicious software updates

R – Regular review of all HIPAA Privacy and security policies and procedures

Healthcare organizations should no longer ignore or overlook their compliance with the HIPAA regulations. In order to prevent data breaches and protect patient information, it is important that a detailed HIPAA Governance program be established. With the start of a fresh new year, it is time to re-write the HIPAA story and manage how patient information is protected!

Danika

Archives for January 2015

Are You Prepared to Report a Data Breach? Assuring Collection of the Right Data Elements

Don’t Get Run Over by the HIPAA Omnibus!

Going from 0 to HIPAA Compliant – Like Climbing Mt. Everest: Small Steps Take You a Long Way

HAPPY NEW YEAR – HIPAA Style!

Recent Posts

Connect With Us