HIPAA Compliance is a Business Decision

A couple of weeks ago, I was talking with a technology vendor who is starting to move into the healthcare space. Their technology isn’t used in the creation or manipulation of patients’ protected health information (PHI), but they do store information on behalf of healthcare organizations that could potentially include PHI. They wanted to know, “Are we required to comply with HIPAA?” Technically – yes. On the other hand, there are hundreds of healthcare organizations and healthcare vendors who act ...

Cybersecurity: Have you hardened your systems?

We perform HIPAA Risk Assessments (Security Risk Analysis) for very small practices to large healthcare organizations, plus business associates that include software, big data, and marketing companies.  We know the focus of the assessment needs to be security; therefore, we run an industry standard (NIST based) scan checking computers for HIPAA compliance.  (NIST stands for National Institute of Standards and Technology) Our findings show that the average covered entity is about 15% compliant and the ...

HIMSS17 – OCR’s Expectations for HIPAA Compliance

Lessons Learned at HIMSS17 The Office for Civil Rights (OCR) made it clear at HIMSS17 - it’s time for the healthcare industry to take action NOW.  Here are the top messages we heard across multiple presentations by HHS (OCR, CMS), FDA, FTC, law firms, and cyber security firms. The following were made very clear to attendees.  Please note, these are not all from HHS, some were heard multiple times from various sources.  The point is, learn and take action.Ignorance of the HIPAA law is no e ...

PHI – Who Really Owns It?

Let's just start off this blog by saying, we're not going to solve the legal question here or today.  However, it is a very important topic to understand.  Here's my feeble attempt to help covered entities (CEs) and business associates (BAs) think about PHI in a new way.PHI at its core is the patient's data.It is to be used to provide healthcare services to the patient and keep them healthy and prevent medical injury or death. The Healthcare industry is supposed to make it readily avail ...

HIPAA Violation leads to jail time

An east Texas man, Joshua Hippler, was sentenced to 18 months in jail for violating HIPAA regulations. Basically, he was trying to sell PHI for personal gain.  He worked in a hospital and obtained PHI that he planned to sell.  The story here is not about Mr. Hippler, it's about you being held accountable for the protection of PHI.  It's important to understand that you can now serve jail time for NOT being HIPAA compliant.Yes, it's true, Hippler had criminal intent, but if you take HIPAA lightly and ...

Third Rock Announces – Custom HIPAA Policies and Procedures

FOR IMMEDIATE RELEASE  Austin, TX, Aug 25, 2016 – Third Rock, provider of HIPAA Worry-Free Compliance™, announced custom, online HIPAA Policies and Procedures as an additional capability of  their compliance management platform, CompassDB™.  This new capability is designed to address common issues associated with policies and procedures found in most healthcare practices; outdated paper documents collecting dust on a bookshelf.The overarching focus of CompassDB™ is to reduce the cost ...

Advocate Health Care Fined $5.5 Million for HIPAA Violations

Advocate Health Care Network, of Illinois, reported three breaches in 2013.  Four desktop computers containing approximately four million patients' ePHI.    The OCR stated "This significant settlement, the largest to-date against a single entity, is a result of the extent and duration of the alleged noncompliance (dating back to the inception of the Security Rule in some instances), the involvement of the State Attorney General in a corresponding investigation, and the large number of individuals wh ...

HIPAA Crossword Puzzle

HIPAA Crossword Puzzle Third Rock We thought it might be good to have you learn more about HIPAA through a challenging crossword puzzle. We hope you enjoy completing the puzzle and learn a little about HIPAA in the process.  You can click the image below to download the PDF version and print it off.Answers Across: 2. PHI 3. backups 5. ice cream 6. HIPAA 8. risk assessment 10. covered entities 12. disaster recovery 15. PII 17. cyber breach 20. cyber security 21. audit 22. lemonade ...

Cyber-breaches: Don’t Lie to Yourself

We've heard many arguments for not addressing your HIPAA compliance by healthcare covered entities. Honestly, it's appalling to think a person that provides care to people doesn't care about protecting that person's personal information to prevent their customer from experiencing emotional and financial suffering and potential ruin.  The first issue for the healthcare covered entity is to understand it's not about the HIPAA audit but about being breached, losing ePHI and then being forced to be audit ...

Steps to Prepare for an OCR HIPAA Audit

We're often asked when helping clients with their HIPAA compliance, "What do we do if we're audited [by the OCR]?"  It is analogous to the old adage about buying a home; location, location, location.  In the HIPAA world, it's document, document, document!You must record your HIPAA compliance efforts, regularly contributing to the "body of evidence" that your practice is on the compliance path and making improvements.  Conversely, if you aren't documenting your efforts and you receive an audit not ...

1 2