HIPAA Compliance for Medical Practices
69.7K views | +2 today
Follow
HIPAA Compliance for Medical Practices
HIPAA Compliance and HIPAA Risk management Articles, Tips and Updates for Medical Practices and Physicians
Your new post is loading...
Your new post is loading...
Scoop.it!

HIPAA as an umbrella for county/municipal cybersecurity

HIPAA as an umbrella for county/municipal cybersecurity | HIPAA Compliance for Medical Practices | Scoop.it

Are you a covered entity?

Basing a county/municipal information security (infosec) and cybersecurity framework on HIPAA is a logical choice, especially if you have one or more covered entities (CE) in your organization.

 

How do you know if you have or are a CE? If some department or division within your organization is a health care provider, a health plan or a health care clearinghouse, they are a CE. If you have clinics, doctors, psychologists, clinical social workers, chiropractors, nursing homes or pharmacies, you are a CE [i]. Moreover, many counties have divisions or departments that function as accountable care organizations (ACO), managed care organizations (MCO), health care clearinghouses or health maintenance organizations (HMO). These are all common functions, especially within large county governments.

Are you in compliance?

If anything described above applies to your county or municipal organization, one or more divisions of your organization is a CE and is required to be in compliance with both the HIPAA Security Rule and the HIPAA Privacy Rule.

 

In my experience, most county governments that have covered entities are out of compliance. Where does your organization stand?

 

I suspect what often happens is that executives look at something like information security policy requirements and say:

This has tech words in it. IT handles tech stuff. Therefore, I’ll turn it over to IT to handle.

 

What a huge mistake. An organizational policy dealing with the manner in which information is handled, regardless of whether or not HIPAA regulations apply, requires communication and coordination with legal, HR, IT, information security, risk management, archives, county clerks and other divisions within your organization. It’s not a tech issue; it’s a high-level, interdisciplinary executive function. It is an information governance (IG) issue, and it shouldn’t be handed off to your IT director or CIO to address unilaterally.'

Trust but verify

There are a number of reasons why IT should not be delegated sole responsibility for organizational information security. For one, a successful information security program requires checks, balances, and oversight. Trust but verify! A successful program also requires expert knowledge of departmental business processes that often exceeds the knowledge of the IT staff. Moreover, if your department heads have equivalent status within the organization, it is not appropriate for a CIO or IT director to unilaterally dictate policy to his or her colleagues of equal status. There are far too many IT departments that have adversarial relations with their end users because of their autocratic and often illogical decrees. Information security requires a team approach with executive and board oversight.

Extend HIPAA to your enterprise

If you have covered entities in your organization and have limited or nonexistent enterprise security policies, I would recommend that you consider building your entire enterprise information security policy on the HIPAA Security Rule in order to raise the entire organization up to that level while also getting compliant with federal law.

 

Why? It is highly probable that your organization uses shared facilities, shared IT infrastructure and shared services. Multiple information security levels create a significant management challenge and are certain to cause chaos and confusion. Multiple security stances will lead to security gaps and ultimately to breaches. Keep it simple and operate at the highest standard using generally accepted good practices.

Develop your policy with the HIPAA Security Rule

There are two major components to HIPAA, the Privacy Rule and the Security Rule. For the purpose of this discussion, only the Security Rule matters, but we’ll definitely discuss privacy another day.

The original HIPAA Security Rule document, 45 CFR Parts 160, 162 and 164 Health Insurance Reform: Security Standards; Final Rule, is 49 pages of small print. However, the meat of the document is contained within the final six pages and includes a handy matrix on page 48 (8380 of the federal register).

The security standards in HIPAA are broken down into three sections, each of which has multiple layers and subcomponents:

  • Administrative Safeguards (9 components)
  • Physical Safeguards (4 components)
  • Technical Safeguards (5 components)

 

These three major areas break down into at least 43 separate policy areas where your organization must build safeguards, including risk analysis, contingency planning, backup, passwords, HR sanctions and terminations, disaster recovery, encryption and many more.

 

Using the components in the matrix should enable you and your IG committee to quickly generate a suite of security policies and procedures that, when implemented and enforced, will vastly improve your current information security stance.

 

These are all policy areas that must be addressed as a matter of good practice whether or not you are a covered entity. This is why HIPAA is an excellent starting point for municipal governments that are infosec policy deficient.

Next Steps

1. Find out where your organization stands in terms of information security policies and procedures.

2. Find out whether or not you have covered entities in your organization. Must you comply with HIPAA? Are you compliant?

3. Meet with your IG committee to discuss your findings.

4. If you don’t have an IG committee — start one!

5. Download and review the HIPAA Security Rule. Use it to build your organization’s information security policies.

6. Use either the PDCA (Plan, Do, Check, Act) approach or the DMAIC (Define, Measure, Analyze, Improve, Control) approach to maintaining continuous improvement.

7. Begin building a culture of security in your organization.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.
Scoop.it!

HIPAA: Secure Your Borders

HIPAA: Secure Your Borders | HIPAA Compliance for Medical Practices | Scoop.it

As an Iraq war veteran, I served as a physician with an infantry unit on the streets of Fallujah.

 

During the seizure of the city, we always were reminded by our commanding officers of the importance of protecting our borders.

 

As physicians, I believe we need to be aware and vigilant of protecting our privacy borders.

 

Health Insurance Portability and Accountability Act, better known as HIPAA was passed by Congress in 1996. From that time forward, protecting the borders and not leaking confidential protected health information became a physician’s priority.

 

As a medical student back then, I was warned never to discuss a patient in an elevator or the hospital cafeteria.

 

Easy enough, I presumed.

 

I soon learned however, that just as in Iraq, protecting borders is never an easy task.

 

Since 2009, there have been more than 800 patient data breeches and 29 million patient records affected by HIPAA violations, according to the 2013 Redspin Breach Report.

 

These date breaches can also strain the wallet. Depending on the scale of the breach, fines for HIPAA violations can start at $100 and can go as high as $50,000, capping at $1.5 million annually. Fines aren’t the only consequence practitioners face – a HIPAA violation can break the trust that patients have with their physicians.

 

Smaller practices are at risk as much as large organizations. It becomes harder to keep track of electronic communication within the practice when patients and staff have mobile devices and can be unaware of how easily HIPAA rules can be violated.

 

For example, an employee may think it is harmless to use his smartphone to post a picture or video of a patient. Well-intentioned employees may post or text an interesting physical exam finding. Even something as harmless taking a picture of food may violate HIPPA when the employee does not realize the lunch is sitting on a patient chart.

 

As a doctor working to protect my patients and myself, here are some useful tips to protect your borders and remain HIPPA compliant:

 

  • Prepare Physical borders: setup security alarms, lock offices when unattended, and as a rule shield protected health information from secondary viewers.
  • Administrative borders: designate security responsibilities, train staff to know the consequences of HIPAA breaches, take a monthly review of user activity, have stringent policy enforcement across all roles.
  • Technical border: secure passwords (no writing them on post-it-notes), back up data, regular virus checks, data encryption for anything sent electronically. Use secure technology such as liveClinic to stay HIPPA compliant, yet communicate with your patients virtually.
  • Secure borders with policies: written protocols on authorizing users, documentation of security measures, policies for notifications on breaches, retain records HIPAA records appropriately

 

Technical Dr. Inc.'s insight:

Contact Details :
inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com/tdr

more...
No comment yet.