Web-Tones

Security Rule for BAs Available & Omnibus Rule Ready

 Digital Download 

Omnibus Rule Ready™

Now availble on the HSG Store here.

The most important step for building a “good Security Rule compliance story” is for the business associate to get started. The approach recommended herein is to build the story iteratively over time. Most business associates (large or small) will likely need help in creating the story. Getting started in the wrong direction initially could be far more costly in the long run, since much of the compliance budget may simply be wasted. The framework discussed throughout this document provides a good road map to follow.

 

Announcing an Omnibus Rule Ready Business Associate Contract

  Digital Download

Omnibus Rule Ready™

Now available on the HSG Store here.

View The Content of our Business Associate Contract and realize the full value it contains

Why should you buy our Business Associate Agreement Model Contract? 

HITECH, HIPAA, & Omnibus Rule Compliant – The provisions in our model Business Associate Agreement meet the requirements of the HIPAA, including the Omnibus Rule, and the HITECH Act.

QUICK and EASY – For most small practices/businesses this agreement is a “right out of the box” solution.  You can literally just fill in the blanks on the Business Associate Agreement Template, print it out and you’re ready to go.

 

REUSE IT – Your business entity/practice can reuse the Business Associate Agreement Template for each and every Business Associate/Covered Entity relationship requiring a Business Associate Agreement. 

CUSTOMIZABLE – Even though the Business Associate Agreement Template was developed to be an “out of the box” solution for small practices and businesses, the supporting annotated documents and user’s guide walk you through the contract, identifying potential issues and making suggestions for suitable modifications to the agreement.

KNOW What You’re SIGNING - Sooner or later, someone from another practice or business is going to put their version of a Business Associate Agreement in front of you.  Our annotated agreement and user’s guide helps you fully understand what you are committing your organization to when you sign on their dotted line.  Moreover, you will be able to better identify any pitfalls or omissions the “other guys” may have in their agreement.

Download it NOW! - As soon as you complete your purchase you will receive an e-mail with instructions for downloading your copy of the Business Associate Agreement and supporting documentation.

Here’s what get when you purchase our Business Associate Agreement Model Contract:

Business Associate Agreement Template – You’ll receive a HIPAA/HITECH compliant Business Associate Agreement in both Microsoft Word (.doc) and Adobe (.pdf) formats. The MS Word version is fully editable and is ready for you to simply fill in the appropriate blanks.  The extra .pdf version serves as a handy reference.

Annotated Version of the Business Associate Agreement – A fully annotated PDF version of the Agreement containing embedded commentary and references/citations to the HITECH Act and related regulations (.pdf file).

Business Associate Agreement User’s Guide – Contains a step by step analysis of each clause in the Business Associate Agreement Template, with commentary and links to additional information.  It provides insight into relevant legal issues and will keep you informed with regard to the essential terms of the agreement.

The Relevant Sections from the HITECH Act – Copies of Sections 13401, 13402, 13404 and 13408 of the HITECH Act for your reference (.pdf files).  

Supporting Links – The Business Associate Agreement and supporting documents link to the relevant statutory/regulatory authority that underpins each clause in the agreement. 

FREE WEBINAR: Business Associates: Compliance as Marketplace Differentiator

This webinar explores the same topic covered in this month's article. Business Associates struggling with this issue will learn about what others are doing in the space and can ask questions to thought leaders interacting with the HITECH / HIPAA marketplace daily.

Date: October 11, 2012. 

Time: 2:00 to 3:00 EST. 

To register Click Here. 

To read the article register for our FREE HIPAA / HITECH Newletter. Our archived newsletter articles can be found here.

 

U.S. Gov Recaptures Healthcare Dollars Under ARRA?

Well that didn't take long. I recently posted about automated HITECH / HIPAA enforcement scenarios. These dollars were recovered under ARRA (i.e. which contained the HITECH Act but was much broader). This is NOT a recovery based on HITECH fraud, but the hounds are getting closer to where the dead bodies lie.

What we are seeing is a rise in accountability for U.S. government dollars. Is this the end of crony capitalism? The short anser is NO, but with the U.S. debt "off the charts" the game may be changing. It's a question of surival now. The U.S. government simply can't afford to be (or pretend to be) stupid any longer. It''s going to shake the money tree every chance it gets.

Don't get be wrong, I am not saying this is a bad thing. I don't subscribe to the "free market will take care of everything" school of thought when it comes to regulatory compliance. However, it really doesn't matter what I think, here I am just reporting on events the appear to be occurring somewhat underneath the radar. When the "man want his money" he tends to be persistent about getting it.

Caveat BA and CE.

Good morning to all from Washington, DC. Today OIG posts three reports and provides news about enforcement actions. As always, you can use the links provided to go directly to the new material. ------------------------------------------------------------------------------ Allowability of Recovery Act Costs Claimed by Grace Hill Neighborhood Health Centers, Inc., in St. Louis, MO, for the Period March 27, 2009, Through March 26, 2011  (A-07-11-05022) http://go.usa.gov/ru2e Costs claimed by Grace Hill Neighborhood Health Centers, Inc. (Grace Hill), in St. Louis, Missouri, under an Increased Demand for Services grant were generally allowable pursuant to applicable Federal regulations and the terms of the grant.  The Health Resources and Services Administration awarded this grant to Grace Hill using American Recovery and Reinvestment Act of 2009 funding in support of the Health Center Program.  However, Grace Hill claimed unallowable costs totaling $65,000 for drawdown amounts that were not in accordance with Federal requirements and the terms of the grant and for incorrectly claimed expenditures. ------------------------------------------------------------------------------ Allowability of Recovery Act Costs Claimed by Primary Health Care, Inc., in Des Moines, IA, for the Period June 29, 2009, Through June 28, 2011 (A-07-11-05019) http://go.usa.gov/ruTV Costs claimed by Primary Health Care, Inc. (PHC), in Des Moines, Iowa, under a Capital Improvement Program grant were generally allowable pursuant to applicable Federal regulations and the terms of the grant.  The Health Resources and Services Administration awarded this grant to PHC using American Recovery and Reinvestment Act of 2009 funding in support of the Health Center Program.  However, PHC claimed unallowable costs of $300 and maintained a property management system that did not comply with Federal regulations because it lacked many of the required elements of information necessary to ensure adequate and accurate accountability of Federal resources. ------------------------------------------------------------------------------ Recovery Act Oversight August Report http://go.usa.gov/ruTh OIG's duties under the Inspector General Act of 1978 include oversight over programs funded through the American Recovery and Reinvestment Act of 2009 (Recovery Act). ------------------------------------------------------------------------------ September 20, 2012; U.S. Department of Justice Five Individuals Charged in Detroit for Alleged Roles in $24.7 Million Medicare Fraud Scheme http://go.usa.gov/yWn  ------------------------------------------------------------------------------ September 20, 2012; U.S. Department of Justice Detroit-Area Doctor Charged for Role in Alleged $40 Million Medicare Fraud Scheme http://go.usa.gov/yWn  ------------------------------------------------------------------------------ September 20, 2012; U.S. Attorney; District of New Jersey Fifth New Jersey Health Care Practitioner Pleads Guilty In Cash-For-Patients Scheme http://go.usa.gov/yWn  ------------------------------------------------------------------------------ September 19, 2012; U.S. Department of Justice Hospital Chain HCA Inc. Pays $16.5 Million to Settle False Claims Act Allegations Regarding Chattanooga, Tenn., Hospital http://go.usa.gov/yWn  ------------------------------------------------------------------------------ State Enforcement Actions Updated http://go.usa.gov/pqp ------------------------------------------------------------------------------ That’s all we have for today. If we can be of any further assistance, please send an Email to public.affairs@oig.hhs.gov I hope your week has gone well and you are able to enjoy the upcoming weekend. Marc Wolfson – Office of External Affairs

 

HIPAA Compliance: What to expect from an OCR audit (Part 3)?

This show will continue to explore what you should expect from an OCR audit. We will conclude our review of the HIPAA Privacy Rule and start reviewing what to expect from a HIPAA Security Rule audit. Contrary to popular belief, audits are not these mystical "gotcha" exercises, but rather a methodical walkthrough of the following: 1) the HIPAA Privacy Rule; 2) the HIPAA Security Rule; and 3) the HITECH Breach Notification Rule.

Fri, June 1, 2012 03:00PM

To listen live Click Here.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

HIPAA Compliance: lessons learned from the BCBST settlement?

A summary of the settlement can be found here. You can rest assured that although this is the first settlement under the HITECH Act, you can expect to see many more over the coming months and years, if we can believe the data that indicates that a PHI data breach occurs on average every other day.

We have often argued that Breach Notification is the 800 pound gorilla of the HITECH Act. We believe that the data will continue to show that a covered entity or business associate is far more likely to get fined/sued as a result of a data breach than a random audit.

So what are the takeaways from BCBST?

1. Compliance is a process. BCBST should have performed another security evaluation as a result of operational changes (i.e. moving).
2. Compared to the fine and the cost of breach notification, an investment in encryption technologies would have likely been far less expensive (not to mention the compliance ROI going forward).
3. The fine from OCR was dwarfed by the cost of Breach Notification, a data point that has been validated over and over with respect to other breaches.
4. For the sake of argument, let's assume it was exactly 1 million patient records that were breached. We will use a conservative estimate of notification cost per record of $200 (according the Ponemon Institute the average cost is higher). Doing the math we estimate the the cost of Breach Notification would have been $200M, a staggering number. The actual cost was $17M according to various reports. Now $17M is STILL an order of magnitude greater than the OCR fine of $1.5M, but nowhere near $200M. There is something wrong with this picture. We have long suspected that $200 per record was grossly over stated. At these numbers even a relatively small breach could bankrupt some providers. More work needs to be done in this area to better under the underlying cost factors of notification.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

 

HITECH / HIPAA Newsletter April 2012: Dispelling the Top 10 HIPAA Myths?

The featured article this month is entitled Dispelling the Top Ten (10) Myths of HIPAA/HITECH Compliance.

This month's article is by guest author John 'J' Trinckes Jr., CISO/EVP/Founding Partner CISSP, CISM, CRISC, C-EH, NSA-IAM/IEM Mulholland Information Security,
LLC.   

Summary: The following are the top ten reasons (or myths) regarding HIPAA/HITECH compliance that we have heard in the healthcare industry over the past couple of years. There is no specific order in which these appear; however, I do attempt to explain the fallacy of these thought processes. 

To read the article subscribe to our FREE HITECH / HIPAA Compliance Newsletter or read it in the archives here.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

HIPAA Compliance: the 80/20 Rule & why you shouldn't major in the minors?

There are no PHI risk free environments. NONE. OK to most compliance professionals this is common sense, but we all know how uncommon that often is. There is simply no budget big enough and not enough hours in your organization's lifetime to eliminate all risk related to PHI, nor do the regulations call for that. The Security Rule calls for "reasonable and appropriate safeguards" (granted some of the safeguards are totally non-trivial to implement correctly).

Get the basics covered & then

focus on the BIG PAIN points that

are likely to cause you the most

liability.

 

So what? The so what is that the "best is the enemy of the good." Like some many things in competitive environments, it is the basic "blocking and tackling" that often gets over looked. Get the basics covered and then focus on those high pain point areas that are likely to cause you the most liability. Here are couple of interesting data points from PwC's recent survey:

Of the 11 million people affected by data breaches since September 2009, 55% were affected by data breaches involving business associates. Healthcare organizations have only grazed the surface when it comes to ensuring their business associates can be trusted with PHI. Only 38% perform pre-contract assessments of their business associates and just 26% conduct post-contract compliance assessments.

Of the electronic data breaches reported to OCR, 90% were a result of a lost computer or device, theft, or unauthorized access/disclosure.

Do you think that maybe focusing on business associate and portable/mobile device risk might be a good place to get outstanding ROI on your compliance investment?

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

Compliance Crisis: Five Strategies Guaranteed to Fail?

The focus of newsletter, webinars, and Radio Show has been on providing a better understanding of HITECH / HIPAA requirements and on providing insights into strategies that will help providers and business associates meet the objectives of the new regulations.

However, it is often just as useful to examine the status quo and to analyze why existing strategies will no longer work.This show will discuss five compliance strategies guaranteed to fail:

1. ostrich;
2. our staff's on top of it;
3. members of our legal team are compliance experts;
4. not invented here--healthcare is so different; and
5. the doc's know best.

 

Listen to internet radio with cleyva on Blog Talk Radio

HIPAA Compliance: How to best prepare for an HHS audit?

When HHS (or KPMG) comes calling for an audit what methodology do you believe is going to be used? Do you think that auditors are going to walk in with nothing more than the raw statutes, regulations, NIST documents, etc. and subsequently proceed to figure out the process as they go? NO. The auditors are going to walk in with what they always walk in with, tools that summarize the relevant legal information in a manner that is well suited for an audit.

The tools that they are going to walk in with are sophisticated and comprehensive checklists, and not (now) the naive approach of the infamous 42 questions. It is not that some (or all) of the 42 questions were not warranted, but rather that the approach is too simplistic. HHS and KPMG are now going to walk with in a much more sophisticated set checklists (but checklists nonetheless).

The point is not that checklists are good or bad, the point is that a simplistic checklist will produce certain results and a more comprehensive checklist will produce a different kind of results. The best way to prepare for an HHS audit is to have your own comprehensive checklist (obviously based on the statutes and regulations) that demonstrates that you are in compliance. That is exactly what our Privacy Rule Checklist does (i.e. with respect to the HIPAA Privacy Rule). It arms your organization for a key part of an HHS audit. 

What other comprehensive checklists would you need? We recommend at least three: 1) Privacy Rule Checklist; 2) a Security Rule Checklist; and 3) a Breach Notification Checklist. Lot of attention has been paid to the latter two with scan attention to the Privacy Rule.

If you are interested in finding out more about HIPAA Compliance Checklists then join us for the following events:

FREE WEBINAR: HIPAA Compliance Checklist Manifesto 

This webinar explores how, in a world that is increasingly becoming more complex, where the volume of knowledge often exceeds an individual's ability to assimilate and communicate it, simple tools such as checklists are having a profound and compelling positive impact on dealing with complexity. In particular, this webinar explores how checklists can be used as HITECH / HIPAA compliance tools. The webinar will continue the discussion started in this Issue's article.

Date: March 8, 2012. 

Time: 2:00 to 3:30 EST. 

To register Click Here.  

HIPAA Survival Guide Radio: Next Show

 

Our weekly radio show covers topics about how the HITECH Act is transforming HIPAA and: 1) exposure to industry thought leaders; 2) analysis of proposed and promulgated HHS/OCR rule making; and 3) a forum for sharing industry best practices. Here's the overview video. To participate via chat you will need to create a FREE Blog Talk Radio account. No account is necessary just to listen. Archived copies of shows will be made available.

This show will walk through the Privacy Rule Checklist in some detail.

Date: March 9, 2012. 

Time: 3:00 to 3:45 EST. 

To listen Click Here.