TriPoint Healthcare Solutions

Advising, Educating, and Operationalizing Privacy and Security in Healthcare

HIPAA Risk Analysis: Exposing 10 Common Myths

by Leave a Comment 

Myths and Facts opposition.A HIPAA Risk Analysis creates an understanding for an organization to know what their current compliance level with HIPAA is and where risks within their compliance program exist.  HOWEVER, a lot of confusion is created when determining how to complete a HIPAA Risk Analysis.  It is important that each Covered Entity and Business Associate understand the risk analysis and ensure the risk analysis is being properly conducted for their specific organization.  Understanding common myths to the risk analysis can help an organization create the risk process and task to complete their risk analysis.
Myth #1 – The Security Risk Analysis is optional for small providers.  FALSE
All providers who are classified as a covered entity or a business associate must complete a HIPAA Risk Analysis in order to comply with the HIPAA Security Rule Section 164.308(a)(1).  The HIPAA Security Rule doesn’t define how often the Risk Analysis must be completed, but rather it must be complete and risks identified must be addressed and corrected.
Myth #2 – By Installing a Certified Electronic Health Record (EHR), the Security Risk Analysis Requirement is Complete. FALSE
Even though the certification process requires that EHRs meet some baseline security requirements, it does not satisfy the entire HIPAA Privacy Rule and HIPAA Security Rule regulations.  The Risks Analysis is intended to look at all practices and process that involved protected health information, electronic, verbal, paper, or other media.  Regardless if the healthcare organization has a certified EHR, an electronic practice management system, or a paper base practice, a risk analysis needs to be completed.
Myth #3 – My EHR vendor took care of everything I need to do about privacy and security and the risk analysis. FALSE
The EHR Vendor may have some of the requirements for compliance under the HIPAA Security rule such as contingency plans for back up and restoration of data; however, the covered entity is responsible for the overall compliance with the HIPAA Privacy and Security regulations.  While an EHR vendor may be able to assist with the process, the covered entity needs to ensure the risk analysis is completed, which evaluates their practices for privacy and security.  Many of times these practices include other sources of protected health information (PHI) outside of the EHR.
Myth #4 – I have to outsource the security risk analysis.  FALSE
The HIPAA Security Rule doesn’t define the process for conducting the HIPAA risk analysis.  There are many tools out there to help and assist with conducting a HIPAA risk analysis, both free and paid services.  It is really the preference of the covered entity or business associate as how the risk analysis will be conducted and if they choose to outsource the process.  Having the knowledge and expertise to conduct a complete and thorough risk analysis is an important aspect of the completion of the risk analysis.
Myth #5 – A checklist will suffice for the risk analysis requirement.  FALSE
A checklist can by useful and helpful as you are conducting a risk analysis; however, it should not be the only tool used when conducting the risk analysis.  Covered entities and business associates need to ensure that policies and procedures are in place; physical, technical, and administrative safeguards are implemented; and that the physical space is reviewed as part of the comprehensive risk analysis.  Think of it as evaluating the policies and procedures, reviewing implemented safeguard (technical, administrative, and physical), understanding the auditing and monitoring processes, and evaluating employee education.
Myth #6 – There is a specific risk analysis method that I must follow.  FALSE
The HIPAA Security Rule doesn’t define a specific methodology for the security risk analysis to be completed.  Allowing the security rule to have scalability to each specific organization, the Office for Civil Rights has only issued guidance on the security risk analysis.  It is up to the specific covered entity or business associate to determine how the risk analysis will be performed and the type of documentation that will exist on the findings.  The only item to keep in mind that it needs to be effective on identifying risk to the PHI that the organization creates, maintains, transmits and stores and well as there needs to be effective and efficient risk management to implement appropriate safeguards to reduce the risks identified.  Additionally, each time that a risk analysis is completed, a formal report should be created including the date, process, and findings.
Myth #7 – My security risk analysis only needs to look at my EHR and the PHI we store in it. FALSE
It is important that the covered entity and business associate review and evaluate every device and system that store, capture, transmit, or modify protected health information.  The review should range from reviewing all computers, laptops, and tablets to all copy machines and smart phones that may access PHI.  Additionally, safeguards need to be in place for all paper that is created, maintained, stored, and destroyed by the covered entity or business associate.
Myth #8 – I only need to do a risk analysis once. FALSE
The HIPAA Security Rule doesn’t define how often a security risk analysis should be conducted; however, in order to comply with the regulations, a covered entity or business associate must continue to review, correct, identify, modify, and update security protections that the organization has.  A policy and procedure should be created to manage the HIPAA risk analysis and risk management process within an organization.  If an organization is receiving Medicare or Medicaid EHR Incentive Program funds, a risk analysis needs to be completed or updated for each EHR reporting period.
Myth #9 – Before I attest for an EHR incentive program, I must fully mitigate all risks identified in the Risk Analysis.  FALSE
The EHR incentive program, also known as Meaningful Use, requires that an eligible provider or eligible hospital correct and/or address any deficiencies identified during the risk analysis during the reporting period or as part of the risk management process.
Myth #10 – Each year, I’ll have to completely redo my security risk analysis.  FALSE
A full security risk analysis should be conducted when you adopt the EHR, do major changes to your systems, or implement new regulations regarding privacy and security.  Each year or when changes to your practice or electronic systems occur, review and update the risk analysis for changes in the risks to your practice.
Conducing a risk analysis can be a challenging process that takes time and resources to complete.  A risk analysis that is properly completed allows an organization to identify risks and fix them before a major security incident or data breach occurs.  Don’t take this requirement lightly, make sure you take the time and complete the risk analysis!  Reviewing the corrective action plans and fines assessed by the federal government, failure to complete a risk analysis is a top finding in the documentation.

Unsure how to complete a HIPAA Risk Analysis, check out TriPoint Healthcare Solutions's Services! 
Danika

HIPAA Risk Analysis is More than a Checklist: 5 Steps to Conduct a Thorough Risk Analysis

by Leave a Comment 

file folder with documents and documents. storage contracts.Even though HIPAA has been around for over a decade, it is making news daily with health data breaches and the upcoming HIPAA audits.  When talking with many healthcare organizations, HIPAA is not and has not been a top priority within the organization.  In fact, many healthcare organizations implemented HIPAA in 2003 and 2005 as required by the compliance dates of the HIPAA Privacy and Security Rule and haven’t done any additional work on compliance. 
With the announcement by the Office of Civil Rights that the Phase 2 HIPAA audits will begin in early 2016, and afterwards a permanent HIPAA Audit program will be established, all healthcare organizations as well as business associates need to evaluate the current level of compliance and understand the risks within the organization.  The best process to take for evaluation of current compliance and risks is conducting a HIPAA risk analysis, as required by the HIPAA Security Rule.
When conducting a HIPAA risk analysis, a checklist of the regulations may be use as a guide, but it is important to understand that a checklist SHOULD NOT be the only item used when conducting a HIPAA Risk Analysis.  A checklist can be a good guide as you evaluate your current level of compliance, but other aspects of HIPAA compliance should also be evaluated during a HIPAA Risk Analysis process.  In addition to a checklist, healthcare organizations should also follow these simple steps to conduct a complete risk analysis:
  • Conduct Physical Walk-throughs – Part of the HIPAA regulations focus on the physical features of an organization. A walk-through should be conducted to determine: how information is being processed, where information may be improperly used, what safeguards are established for electronic equipment, how you are protecting paper records, if people are logging out of computers or systems when they are walking away.  These are some basic areas to review during a walkthrough.  A simple walkthrough checklist can be helpful during the process.
  • Collect Supporting Evidence of Compliance – An organization should collect evidence to support compliance with privacy and security policies and procedures established. For example, if you state that you will conduct information activity review on a bi-monthly basis, an organization will want to ensure that they have evidence of the bi-monthly information activity reviews. 
  • Conduct Workforce Interviews – Workforce members are the first line of defense with safeguarding and protecting PHI. It is important to understand the workforce’s knowledge and comfort with using and protecting PHI throughout the normal course of business.  Ask workforce questions to understand the comfort and adherence to organizational policies and procedures.   
  • Review Unauthorized Uses and Disclosures of PHI (and Data Breaches) – one area of non-compliance can be from the history of data breaches or unauthorized uses and disclosures of PHI. During the risk analysis process, an organization should evaluate the recent issues with the use and disclosure of PHI to trend issues and evaluate if potential risks exist.  For example, if 4 unauthorized disclosures are due to wrong faxes sent, there could be an indication a risk exists with employee education on faxing PHI.  Taking time to review this activity can help trend and understand the issues and potential risks within your organization. 
  • Evaluate Conducting Network Security Testing (Penetration Testing) – while not a requirement, it is a good idea to have penetration testing done to determine if there are security risks within your network infrastructure. Network security testing involves electronically evaluating the current network infrastructure to determine if here are weakness in the network.  Network weakness can lead to unauthorized intrusion and hacking into a network.  Penetration testing will look very different depending on the size and complexity of the network established. 
Regardless of the size of your organization, the foundational step in any HIPAA compliance program is the completion of a HIPAA Risk Analysis.  Why this is not mandated to be conducted on a yearly basis, the organizations that find themselves most comfortable and compliant with the HIPAA regulations conduct a Risk Analysis on a regular basis.  Don’t be the next headline of a large data breach with a monetary fine and corrective action plan.  Conduct a robust HIPAA risk analysis and feel confident with your compliance.
Danika

Ready, Set, Data Breach Fun Facts! An Updated Look at Data Breach Stats!

by Leave a Comment 

If you are like me, I love to review the current stats of healthcare data breaches to look at trending or see if there is an area that is more prone to data breaches than others.  I thought I would share some new analysis of data breaches!  This information is based on healthcare data breaches where greater than 500 individuals were impacted.  

Some major highlights from the statistics:

  • A total of 1,293 Data Breaches have been reported since September 2009
  • Paper is still the #1 location (media type) of data breaches - 23% of total breaches involving greater than 500 individuals
  • Theft and Loss make up 59% of types of data breaches
  • Data hacking only makes up 10% of all data breaches where greater than 500 individuals were impacted
  • Business Associates are responsible for 22% of data breaches greater than 500 individuals
  • A total of 143,495,899 individuals have been impacted by data breaches greater than 500 individuals
  • Data breaches involving business associates have impacted 26,399,466 individuals
  • The largest data breach occurred in 2015, Anthem Data Breach, impacting 78,800,000 individuals 

DB By Location





















DB By Type
























DB By BA Involvement




















DB By BA Involvement





















If you don't have a good process in place for data breaches, now is the time to get one established!  It is better to be prepared to report a data breach than struggle when one occurs!  Breach notification is one of the major focuses of Phase 2 HIPAA audits.  


Danika

The data for this analysis is from the HHS Data Breach Portal: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf


Are You Ready?  10 Questions that will Test Your Readiness for a HIPAA Audit.


 by  Leave a Comment 
3d white man with the combination lock and checklist. Isolated render on a white backgroundThe Office for Civil Rights (OCR) announced recently that Phase 2 of the HIPAA audits have begun.  The first round of pre-audit surveys have been delivered to both covered entities and business associates.  If you are not in the first round of the audits, don’t breathe a sigh of relief as it is only the first round and definitely will not be the last.  Based on the recent increase in the data breaches, the OCR is definitely going to identify new risks and vulnerabilities.  The HIPAA audits are causing fear and concern among healthcare organizations.  Now is the time to evaluate your current level of compliance to ensure that you have clearly established policies and procedures, and are following them as defined.  Remember: Documentation is one of the keys to success with HIPAA! 


Take this short quiz to test your readiness for a HIPAA Audit:


    

  1. 

    Do you currently know and/or have a list of all systems that stores, maintains, or transmits protected health information within your organization?
    

    2. 

  2. 

    Has your organization completed a HIPAA Risk Analysis within the last 2 years and do you have your Risk Analysis Report and Risk Mitigation Plan clearly documented?
    

    3. 

  3. 

    Has your organization evaluated and updated your policies and procedures since the final HIPAA Omnibus Rule (HITECH) was published in 2013?
    

    4. 

  4. 

    Do you have a clearly established process for identification of business associates and have current business associate agreements signed and on file?
    

    5. 

  5. 

    Do you have a documented process for your breach investigation within your organization?
    

    6. 

  6. 

    Do you have a process for maintaining burden of proof (administrative Breach Notification Requirement) for all investigated breaches (confirmed or not)?
    

    7. 

  7. 

    Do you currently conduct Information System Activity Review and Log-in Monitoring in the exact manner defined by your policies and procedures?
    

    8. 

  8. 

    Could you produce documentation to support the information system activity review and log-in monitoring, if requested?
    

    9. 

  9. 

    Have you conducted HIPAA training to your workforce members within the past year? Do you have documentation to support the training that was conducted?
    

    10. 

  10. 

    Do you have a detail process for access management (adding users, modifying users, terminating users) in all systems that store, maintain, or transmit PHI?
    

    11. 



If you answered NO to ANY of the above questions, your organization may not be properly prepared in the event that a HIPAA audits comes your way.  The good news – you have time to fix it!  Start now – don’t wait!  HIPAA compliance doesn’t have to be a barrier to providing good patient care and customer service.  If you take the time and operationalize HIPAA to meet your organization’s needs, you can have a successful HIPAA compliance program without impacting patient care and customer service.  In fact, you may just enhance patient care and customer service with a complete HIPAA compliance program. 


If you need help getting ready for a HIPAA audit or need assistance with analyzing your current level of compliance, don’t be afraid to reach out for help!  Check out the list of TriPoint Healthcare Solutions’ Services to help you with HIPAA Compliance!!


Danika


Disclaimer: The above questions are not intended to be a complete evaluation of HIPAA compliance or to determine if completely prepared for a HIPAA audit.  It is a tool to evaluate if your organization needs to spend more time focusing on HIPAA compliance to prepare in the event of an audit.  It is recommended to be used a simple evaluation to determine if you have concerns regarding your current compliance level with HIPAA.  It is not considered legal advice or complete compliance evaluation. 


Friday the 13th HIPAA-Stitions: Demystifying the Myths


 by  Leave a Comment 
Sheet with the inscription Friday 13 and red spotsFriday the 13th comes around on average 2-3 times per year.  In 2015, Friday the 13th will visit us 3 different times.  Friday the 13th is thought to be one of the most unlucky days of the year – plaguing us with many different superstitions that cause fear among people.  From the masked Jason chasing people down an empty, dark street to the crazy doll, Chucky, that comes to life and attacks, the dread of the 13th of the month has created angst and fear to society! 


Just like all the superstitions and fears we face on Friday the 13th, HIPAA is full off different myths and fears created among the healthcare community.  Healthcare organizations fear HIPAA as it is going to cause issues and destruction among their organization.  Different interpretations and analysis of the HIPAA requirements has created confusions and fears among the healthcare community. 


In honor of Friday the 13th – Lets Demystify 13 of Today’s HIPAA-Stitions


    

  1. HIPAA prohibits me from taking care of patients and releasing information for continuity of care.
    2. 



HIPAA allows the sharing of patient information for the purpose of treatment, payment, and healthcare operations (TPO).  If a provider needs to release patient information to help in the continuity of care, that is an acceptable disclosure under the HIPAA regulations.  It is smart to check with state requirements on the protection of patient information as some states do requirement a signed authorization for any use or disclosure of patient information. 


    

  1. The HIPAA Security Risk Analysis only needs to be completed one time. 
    2. 



The HIPAA regulations actually do not define what the frequency of the HIPAA risk analysis needs to be.  Built to be scalable, the HIPAA security rule allows the covered entity or business associate to define the frequency; however, do it one time and never again is not an acceptable practice and leaves the organization vulnerable to non-compliance and risks to PHI.


    

  1. Texting is considered a way of communicating about patients and has no concerns with HIPAA compliance.
    2. 



Normal SMS texting is not a secure means of communications with protected health information.  In fact, texting using normal SMS format is quite risky to the healthcare organization.  If a healthcare organization is going to allow texting as a means of communications regarding patients (think about this before saying yes), a secure solution for texting should be implemented as well as a policy and procedure for effective management of texting with patient information.  Think about not only how to manage the data as it is in transmission from device to device, but also how you will manage the devices and the information that may be stored on the device.  


    

  1. HIPAA prohibits me from sending patient reminders about appointments and leaving messages on phones.
    2. 



The HIPAA privacy rule allow for all providers to communicate with their patients regarding their health care, which includes reminders about appointments. This includes communicating with patients at their homes, whether through the mail or by phone. The HIPAA regulations do not prohibit a provider from leaving messages for patients on their voicemail; however, it does require that the covered entity provides adequate safeguards to the privacy of a patient, which may include getting agreement from the patient to leave a voicemail at a specific number or send information regarding care to a specific address. 


    

  1. Since the EHR we use is a cloud based EHR, I don’t have to worry about having a written contingency plan in place.
    2. 



Using a cloud based, EHR may eliminate an organization’s need to manage the backup process for the EHR system; however, it doesn’t completely eliminate the need to create and implement a contingency plan.  The contingency plan is intended to cover so much more than how the information is backed up, such as how the organization will work in emergency mode, what systems are most vital to the day to day operations or the organization, and how recovery of data will occur.  Another aspect to think about is the EHR may only be one of the systems that stores and maintains patient information.  If you have other systems or are storing information regarding patients in other electronic locations, it is important to have a plan in place on how that information is being backed up and restored in the case of an emergency. 


    

  1. As long as we have passwords in place to get into our systems with patient information, the information is considered secure.
    2. 



A common misunderstanding of the application of passwords is that they make a system secure when implemented – but they don’t.  Passwords do provide an appropriate safeguard and a layer of security to patient information; however, the protection is only as good as the password.  To help better manage the use of passwords, strong passwords should be implemented on any systems that provide access to patient information.  Strong passwords should be a minimum of 8 characters in length and use uppercase letter, lowercase letters, numbers and systems – 3 of the 4 is the minimum recommendation.  Remember that the only true way to make information secure is to encryption the information or destroy the information using appropriate means.


    

  1. My business associate states they are HIPAA compliant so there is no need to worry about the protection of the information shared with them.
    2. 



No organization is out there certifying healthcare organizations as “HIPAA Compliant.”  Any third party organization that is stating that they are HIPAA complaint most likely means that they have created an internal program to meet the requirements of the HIPAA regulations as they apply to business associates.  It is best practices that covered entities as business associates about the safeguards used to protect the information they are sharing and what makes them “HIPAA Compliant.”


    

  1. I don’t have an electronic health record; therefore, the HIPAA security rule doesn’t apply to me.
    2. 



HIPAA doesn’t distinguish between systems where information is stored on where the security rule applies and doesn’t apply.  Rather HIPAA focuses on the media type of the information – electronic, paper, and oral.  The security rule applies specifically to all electronic protected health information, which is PHI that is created, received, maintained or transmitted in electronic form.  An electronic health record is only one source of electronic protected health information. 


    

  1. Meaningful use changed requirements for the HIPAA risk analysis.
    2. 



The meaningful use requirements didn’t actually change any of the requirements that HIPAA mandates – it actually points directly to the HIPAA requirements for the conducting of the HIPAA risk analysis for protecting patient information.  The only ‘change’ is that if you are participating in the meaningful use program, a HIPAA risk analysis must be conducted or updated for each year that you attest for meaningful use.


    

  1. Every unauthorized use and disclosure of patient information is considered a data breach.
    2. 



In order to determine if a breach occurred from an unauthorized use or disclosure of information, an investigation must be completed by the covered entity or business associate to determine the risk to the patient information.  Per the Omnibus Rule of 2013, an unauthorized use or disclosure of health information is not considered a breach if there is low probability that the information has been compromised. 


    

  1. Since the patient won’t sign my Notice of Privacy Practices, I am not allowed to treat that patient.
    2. 



A patient refusing to sign the notice of privacy practice acknowledgement doesn’t prohibit the provider to take care of the patient.  The regulations state that the covered entity should make reasonable effort to get an acknowledgement of the notice of privacy practices signed.  By signing the acknowledgement, the patient is only documenting that they have been given or offered a copy of the notice of privacy practice, which explains how the organization will use and safeguard their protected health information. 


    

  1. The HIPAA regulations prohibit Provider/Patient e-mail communication 
    2. 



The HIPAA regulations do not prohibit provider from communicating with patients through e-mail.  The regulations actually state that if the provider is going to communicate with patients through e-mail, proper safeguards should be implemented to protect the information.  Additionally, the Omnibus Rule states that e-mail can be sent to a patient without encryption as long as the patient agrees to it and is aware of the risks to the information. 


    

  1. Since I fully implemented a HIPAA compliance program, data breaches will not occur at my organization.
    2. 



Just because an organization implements a full HIPAA compliance program and addresses all areas of potential risk to their organization, there is no guarantee that a data breach is not going to occur.  With the sophistication of recent data attacks and human interaction, there is always going to be a risk that a data breach can occur.  The best scenario is having a fully implemented HIPAA compliance program and assure adequate training to workforce members.  Reducing and managing potential risks is the best avenue to take – no organization is without some risk.  


When evaluating HIPPA and operationalizing it to ‘fit’ a specific organization, HIPAA doesn’t have to be feared!  Overcome the common HIPAA-Stitions and being successful with HIPAA compliance can be a goal reached by all organizations – large and small.  Don’t fear HIPAA as we fear Friday the 13th, instead take it on full speed and don’t look back until you met the appropriate level of compliance.


Danika




			



		



		

		
Recent Posts


		

		


Connect With Us

			
TriPoint Healthcare Solutions

dbrinda@tripointhealthcaresolutions.com

Phone: 612.325.9742

Fax: 763.322.5027