There are no PHI risk free environments. NONE. OK to most compliance professionals this is common sense, but we all know how uncommon that often is. There is simply no budget big enough and not enough hours in your organization's lifetime to eliminate all risk related to PHI, nor do the regulations call for that. The Security Rule calls for "reasonable and appropriate safeguards" (granted some of the safeguards are totally non-trivial to implement correctly).
Get the basics covered & then
focus on the BIG PAIN points that
are likely to cause you the most
liability.
So what? The so what is that the "best is the enemy of the good." Like some many things in competitive environments, it is the basic "blocking and tackling" that often gets over looked. Get the basics covered and then focus on those high pain point areas that are likely to cause you the most liability. Here are couple of interesting data points from PwC's recent survey:
Of the 11 million people affected by data breaches since September 2009, 55% were affected by data breaches involving business associates. Healthcare organizations have only grazed the surface when it comes to ensuring their business associates can be trusted with PHI. Only 38% perform pre-contract assessments of their business associates and just 26% conduct post-contract compliance assessments.
Of the electronic data breaches reported to OCR, 90% were a result of a lost computer or device, theft, or unauthorized access/disclosure.
Do you think that maybe focusing on business associate and portable/mobile device risk might be a good place to get outstanding ROI on your compliance investment?
Looking for best of breed HIPAA Training?
To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.
If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?
