The first OCR fine for 2017 was issued to Presence Health for delay in notifying 836 patients of a breach experienced in 2013. Presence Health met the requirement of notifying HHS of the breach within 60 days after the end of the calendar year in which the breach is discovered (notification took place January 31, 2014).
There have been many articles written about the need to investigate a potential breach, and establish what happened, how it happened and do a thorough job in getting as complete as possible, the names of all individual affected by the breach so that notification can take place. What you don't want to do is forget the breach notification rule that states that for a breach of any size, patients must be notified "without unreasonable delay, but in no case longer than 60 days." Certainly, there are a few exceptions like law enforcement delay and other rare situations, but the rule is clear.
The fine is significant enough, but remember that along with the OCR fine, generally comes a corrective action plan (CAP). In this particular case, there was a requirement to revise existing policies and procedures related to the Breach Notification rule. Training materials would also need to be updated and provided to appropriate workforce members with documentation of the date the training was provided. Evidence of compliance with the CAP is always required.
A couple of key takeaways include noting that the OCR will investigate all breaches and that it generally takes a good bit of time for the OCR to make their determination based on information requested and provided. The fine, if infractions are identified will follow and the CAP will take resources and an investment on the facility's part. Breaches and their impact are significant and the financial costs associated with them run deep.
Read the full article here
HIPAA Compliance audits are scheduled to resume later this year with an anticipated 1,200 to be conducted between 2014 and 2015. The word is that 800 covered entities will be audited and 400 will be completed for business associates. The interesting twist is that covered entities will be asked to provide names of their business associates and it is anticipated that the selection may come from this submission.
The initial round of audits was referred to as "friendly" audits, conducted by KPMG, a contractor for the OCR. This round will be manned by OCR staffers who, as we speak, are being trained for this mission. Important for all interested parties to keep in mind that the funding for this project will come from fines assessed based on organizations who have failed to prepare properly for HIPAA compliance.
Since over 25 million dollars in penalties have been assessed thus far due to "willful neglect," meaning disregard for attempting to comply with the requirements of the final rule, it can be reasonably expected that OCR auditors will be swift to levy fines for those who have failed to take steps to prepare.
We've been given ample time to prepare. After all the HITECH Act of 2009 laid the foundation for business associate compliance and the Final Rule was published in January 2013. So for all the procrastinators out there, the clock is ticking at a heightened pace and you cannot delay any longer. Get the facts, scale up or down to the size of your organization and just get it done!
At the AHIMA convention October 26-30, 2013, much of my time was spent on HIPAA privacy and security. No surprises there, right? It has become pretty clear by now, that this is a major focus area for me. After 2 full days in the privacy and security institute, which was fantastic, by the way, and another 3 days making the rounds in the privacy and security education tracks, there were a couple of observations that were a bit concerning.
UNDERSTANDING HIPAA COMPLIANCE REQUIREMENTS: By now, HHS has made it abundantly clear what is required to both covered entities and business associates. If you have followed HIPAA breach news at all in enforcement efforts, you know that fines are being assessed. What's more, the OCR promises to audit business associates from this point forward now that they are included under HIPAA Omnibus. We have seen varying degrees of preparedness by business associates ranging from statements about their platform compliance to those who say, "Well, we have never experienced a breach," to those who think their business associate agreement is all that is needed. Really - are you sure about that? If there are no policies in place or education for your staff to understand incident reporting requirements, how do you really know if you've ever had a breach?
MANY BUSINESS ASSOCIATES ARE NOT PREPARED: With the HITECH act of 2009, we knew about the extensions of HIPAA to business associates and should have been fully prepared since or before that time. We have had access to the HIPAA audit protocol since the summer of 2012. This is an absolute roadmap to a solid compliance strategy. It is not difficult to understand exactly what is needed for compliance, yet many business associates continue to fall short. Here is a case to consider that should give you considerable pause: If a business associate hires an employee and provides that individual with a desktop computer or laptop to do their work, and the employee a year later, suddenly disappears without a trace from the workforce with said computer that likely contains PHI (it happens all the time, folks), is that a breach? Does that business associate know how to reasonably account for the potential PHI on that system? Without policies and procedures, a breach notification response team, and reporting processes through the required 4-step risk assessment, will the covered entity even be notified?
COVERED ENTITIES ARE UNCLEAR ON DUE DILIGENCE: There is an expectation of due diligence steps to be undertaken by covered entities in ensuring their business associate partners have taken appropriate steps towards compliance. This is one of the single most important steps healthcare organizations and individual providers should be taking to protect their patients' PHI. The new guidance from AHIMA clearly mentions the value and importance of this key step in the process. Yet, still today, this is not happening on nearly a wide enough scale.
KEY TASKS TO DO (yesterday) NOW:
Business Associates -
1. Do not delay in preparing to comply with all regulations under HIPAA
2. Get your policies and procedures documented (privacy, security, breach notification)
3. Train ALL workforce members and document that training has taken place. Hold them accountable for what they have learned.
4. Update your BAAs - this is particularly important for those who hire independent contractors.
5. Conduct your comprehensive security risk analysis. Yes you do have to do one, regardless of the size of your organization and it must be documented.
Covered Entities/Providers -
1. Make a list of ALL business associates.
2. Make sure that they have signed your updated business associate agreement - even if it is not due yet, proactively get these completed.
3. Ensure that you know where the work you are outsourcing is being performed.
4. Ask for evidence-based proof of compliance (excerpts from policies, copy of BAA, risk analysis, etc.).
5. Ask for the name of your business associates' privacy officer - get their name and contact information and establish open dialogue about their compliance efforts today!
Compliance does not have to be expensive or burdensome, but it is required. Failure to comply with HIPAA can lead to an automatic willful neglect penalty. With over 12 million patients impacted by business associate breaches since 2009, there is clearly much room for improvement in practices along with baseline requirements of the law. If you want more information on how we can help, contact us here.
A new day and a new adventure begins. In working with MTSOs for a number of years, and with the requirements of HITECH making the headlines, I have decided to start something new and provide a number of services and solutions for business associates and covered entities in efficiently achieving compliance in the area of privacy and security. Privacy Officer Services officially begins today.
This new business is designed to support business associates and covered entities in the development of their customized policies and procedures for privacy and security, to assist with completing their required security risk analysis and a number of other services like employee training, education, monthly updates, quarterly updates for the business website, and weekly updates in news in and around privacy and security as well as technical developments. There are many more and there is a unique solution for every healthcare organization.
My goal is to help these business associates achieve the HITECH requirements in a cost-effective manner so that their current staff can continue on with the business at hand in delivering on-time services and provide the customer experience their clients expect.
By outsourcing their privacy officer reponsibilities to me, they will gain efficiencies in a number of ways like having a knowledgeable resource available every day without having to add to their employee count. Having someone who can attend meetings, and present to potential and existing clients on their privacy solutions can be a huge advantage in the world where we see and hear about costly security breaches nearly every day.
It's a new world filled with legal requirements and challenges for business associates and covered entities - this is a way to check a very important responsibility off the "must-do" list and put this into the hands of someone they know and can trust to provide the right solution today.
