Western Pennsylvania Healthcare News

Covering healthcare news in the Pittsburgh region and beyond.

Banner Ad

Doing Business with Medical Clients

by

Brian Shrift

Brian Shrift

How the HIPAA Security Rule Affects Your Business

By Brian Shrift, HCISPP

When most business people think about HIPAA, they often write it off as applying only to those in the healthcare industry. However, even if you are not in the healthcare industry yourself, your business could be subject to HIPAA if you work with clients in the healthcare industry or if your clients work with clients in the healthcare industry.

If you work with hospitals, physicians, pharmacies, therapists, dentists, chiropractors or any other business which is considered a “Covered Entity” under HIPAA, you may be considered a “Business Associate” and subject to the HIPAA Security Rule.  In addition, if your clients are considered Business Associates, you may also become a Business Associate, identified in the HIPAA rules as a “downstream vendor.”

If you are a Business Associate, either directly or as a downstream vendor, you must, among other things, comply with the HIPAA Security Rule (the “Security Rule”).  The Security Rule’s primary objectives are to ensure the confidentiality, integrity and availability of protected health information (“PHI”).  In plain English, the law was written to ensure that adequate safeguards are in place to protect patient information from unauthorized access and disclosure, improper alterations or deletions, and to assure it is accessible when needed. [Read more…]

Securing the ‘Security Rule’—Importance of HIPAA Compliance for All Practitioners

by

Brian Shrift

Brian Shrift

By Brain Shrift, HCISPP

Evidence is mounting that the U.S. Department of Health and Human Services is beginning to crack down on medical practitioners who aren’t fully compliant with the HIPAA Security Rule.

That’s potentially bad news for many health care organizations that have taken a less than rigorous approach toward compliance. What does it take to become compliant? First, let’s take a brief look at the rule itself.

The Security Rule’s primary objectives are to ensure the confidentiality, integrity and availability of protected health information (PHI).  In plain English, the law was written to ensure adequate safeguards are put in place to ensure patient data is protected from unauthorized access and disclosure, cannot be improperly altered or deleted, and is always accessible when needed.

The HITECH Act of 2009, which required compliance by Sept. 23, 2013, strengthens the civil and criminal enforcement of the Security Rule.  The Security Rule has been in force since 2006, but with minimal penalties for non-compliance there was little incentive to make the investment in compliance.  With the HITECH Act ushering in penalties up to $1.5 million, noncompliance is a costly risk.

[Read more…]

The Cost of Noncompliance

by

pbs_300dpi(2)HIPAA Security Rule Audits, Breaches on the Rise

By Shawn Piatek for PrecisionBS

One glance at the headlines on seemingly any given day will yield a significant reality of modern society – our private information is always at risk.

During 2014 alone, Sony, Microsoft and the U.S. Dept. of Justice were among organizations that suffered data breaches. Just last month, Anthem Inc., the country’s second largest health insurance company, suffered a massive breach of up to 80 million customer records.  This alarming rise of hacker activity seems to be one of the reasons the U.S. Dept. of Health and Human Services (DHHS) has increased its activities to assure that health care organizations are complying with HIPAA and the HIPAA Security Rule.

Both HIPAA and the HITECH Act are pieces of federal legislation intended to protect the sensitive Protected Health Information (PHI) of patients of all health care providers. The HITECH Act was enacted in 2009 with the aim of reforming and enhancing HIPAA as well as greatly enhancing the penalties for noncompliance with the HIPAA Security Rule.  The HITECH Act also marked the first time Business Associates could be found directly liable for HIPAA violations and empowered DHHS to begin a program for conducting HIPAA audits.

[Read more…]

HIPAA’s Potential Impact on FMLA Certification

by

David J. Lampe

The Family and Medical Leave Act (“FMLA”) entitles eligible employees of covered employers to take unpaid, job-protected leave for certain family and medical reasons. These medical reasons include the “serious health condition” of an employee’s spouse, child, or parent, or the “serious health condition” of the employee that prevents him/her from performing the essential functions of their job.

In order to assess whether a covered individual has a “serious health condition”, an employer can require sufficient medical information to support an employee’s request for FML. However, the Health Insurance Portability and Accountability Act (“HIPAA”) generally restricts a healthcare provider from divulging protected health information (“PHI”) of their patients to third-parties, including employers. This article provides tips for maneuvering through the potential conflicts between these two statutes.

[Read more…]

Hill Group-Hospital Council Highlight Efforts to Meet New and Anticipated HIPAA Requirements

by

Panelists strategically address new federal rules  that strengthen patient privacy protections

By Christina Stacey Brussalis

On May 17, The Hill Group, Inc. partnered with the Hospital Council of Western Pennsylvania to provide an informative panel discussion, HIPAA & HITECH: Navigating an Uncertain Regulatory Environment.  The standing-room only event brought together a distinguished and knowledgeable  panel of healthcare industry leaders that included U.S. Congressman Jason Altmire (PA-4); Highmark chief information security officer Jim Ansell; Bob Barrett of eClinical Works; Vale-U-Health CEO Sue Flynn; John Kalafut, Director of Healthcare Informatics Research and Strategy for MEDRAD, Inc.; and Hill Group consultant Scott Rogerson.

Panelists explored approaches taken by organizations to comply with new and anticipated federal patient privacy and information security mandates and to avoid costly monetary penalties, which have increased dramatically.  Discussion also addressed the future state of Healthcare Information Technology (Health IT), the related security and privacy considerations, and impact on the strategies of healthcare providers, payors, and vendors.

[Read more…]