Web-Tones

HITECH Ready Business Associate Contract: accept no substitute!

 Why do you even need a Business Associate Agreement? 

HIPAA regulations and the HITECH Act mandate that a Covered Entity establish a written contract with a Business Associate in a number of instances, including whenever a Business Associate "manages" Protected Health Information on behalf of a Covered Entity.  Our Business Associate Agreement Model Contract is a quick, simple solution for both Covered Entities and Business Associates.

Need a HITECH Business Associate Contract? Check out the HSG Store.

Why should you buy our Business Associate Agreement Model Contract? 

• It's HITECH and HIPAA Compliant - The provisions in our model Business Associate Agreement meet the requirements of both HIPAA and the HITECH Act.
• It's QUICK and EASY.  For most small practices/businesses this agreement is a "right out of the box" solution. You can literally just fill in the blanks on the Business Associate Agreement Template, print it out and you're ready to go. 
• You can REUSE IT.  Your business entity/practice can reuse the Business Associate Agreement Template for each and every Business Associate/Covered Entity relationship requiring a Business Associate Agreement.  For full details on limitations of use, please read our Terms of Use.
• Its CUSTOMIZABLE.  Even though the Business Associate Agreement Template was developed to be an "out of the box" solution for small practices and businesses, the supporting annotated documents and user's guide walk you through the contract identifying potential issues and making suitable modifications to the agreement.
• You'll KNOW What You're SIGNING - Sooner or later, someone from another practice or business is going to put their version of a Business Associate Agreement in front of you.  Our annotated agreement and user's guide helps you fully understand what you are committing your organization to when you sign on their dotted line.  Moreover, you will be able to better identify any pitfalls or omissions the "other guys" may have in their agreement.
• You can download it RIGHT NOW! - As soon as you complete your purchase you will receive an e-mail with instructions for downloading your copy of the Business Associate Agreement and supporting documentation.

Here's what you get when you purchase our Business Associate Agreement Model Contract

• The Business Associate Agreement Template - You'll receive a HIPAA/HITECH compliant Business Associate Agreement in both Microsoft Word (.doc) and Adobe (.pdf) formats. The MS Word version is fully editable and is ready for you to simply fill in the appropriate blanks.  The extra .pdf version serves as a handy reference.
• An Annotated Version of the Business Associate Agreement - The Contract annotated in PDF format Contains embedded commentary and references/citations to the HITECH Act and related regulations (.pdf file).
• Business Associate Agreement User's Guide - Contains a step by step analysis of each clause in the Business Associate Agreement Template, with commentary and links to additional information.  It will provide you with insight into the relevant legal issues and will keep stakeholders informed with regard to the essential terms of the agreement.
• The Relevant Sections from the HITECH Act - For you're reference, you will receive Sections 13401, 13402, 13404 and 13408 of the HITECH Act (.pdf files).  
• Supporting Links - The Business Associate Agreement and supporting documents link to the relevant statutory/regulatory authority that underpins each clause in the agreement. 
• A Free Gift - You also receive a complementary copy of The Security Rule under HITECH: a Business Associate’s Perspective in .pdf format. Absolutely Free!

Not provided: Ginseng knives for $19.95.

---

 

Looking for a best of breed HIPAA Compliance Tracking System?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Change is Hard Revisted: The Rider, the Elephant & the Path

Big problems require small solutions. It's not that the end state solution will turn out to be small or trivial, in fact it is likely to be quite encompassing, but rather that the ultimate solution can only be achieved through a series of smaller solutions. In Switch, a book on change when change is hard (read HITECH), Chip and Dan Heath posit three core components of change:

1. the Rider (our rational side);
2. the Elephant (our emotional side); and
   
3. the Path (the context in which the change takes place).
   

All three must be aligned if change, within any difficult context, has any chance of succeeding. The authors summarize their findings as follows:

For things to change, somebody somewhere has to start acting differently. Maybe it's you, maybe it's your team. Picture the person (or people). Each has an emotional Elephant side and a rational Rider side. You've got to reach both. And you've also got to clear the way for them to succeed.

 

 There is very little chance of success if the change agent appeals solely to an individual’s (or a group’s collective) Rider. No matter how compelling intellectually, or how strong the numbers look, appealing to the Rider alone is not sufficient to get the Elephant (our emotions) to move. In order for difficult change to occur we need to move the Elephant. Elephants don’t move easily, and when they do, they tend to go wherever they please.

Unless you move your organization’s Elephant you may likely implement one of several HITECH compliance strategies that is guaranteed to fail. Moving the healthcare Elephant is no small feat—yet another reason that the problem is wicked.  Fear of fines from Big Brother may be a necessary enough incentive for the Rider, but will likely prove woefully insufficient for the Elephant. You have to get the Elephant to want to move, because elephants don’t scare easily.

How do we get the healthcare Elephant to move? Commit to the patient. The patient wants his or her PHI secured. The patient wants you to ensure privacy. The patient wants anywhere / anytime electronic access to his or her PHI. Patients will soon start demanding from the healthcare industry what other industries provide as a matter of course (e.g. the banking industry), and they will get it. Innovative players within a highly competitive marketplace will find a way to deliver on the promise. To the victors go the spoils.

---

 

Looking for a best of breed HIPAA Compliance Tracking System?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Change is Hard: EHR Implementations, Compliance Touch Points & Chaos Theory

We understand that this blog has introduced concepts (e.g. wicked problems and agile methodologies) that may be foreign to healthcare providers. There are several reasons why we have felt compelled to do so: 1) we are bona fide geeks and can't help ourselves; and 2) more importantly, we believe that maybe (just maybe) some of our readers might benefit from our lessons learned (the hard way) in other industries.

In past lives we have had the opportunity to wear many hats. We lived through (and manged to survive) the dot com bubble bursting, the migration from mainframes to PC's, and the rise of the Internet. All of this before changing careers in mid life to law and nursing respectively. During that time we witnessed more failed technology projects than we care to remember. In fact, we wrote a book about our adventures in technology called Silicon-Stories.

The key "take away" is that most technology projects fail because of people and process challenges that have very little to do with the underlying technologies and almost everything to do with the kind of social complexity that we often write about (i.e. which lies at the heart of wicked problems). An EHR implementation includes so much more than technology that to call it a technology project is itself is a misnomer. An EHR implementations is more aptly described as a change project.

This post will first illustrate why change of this magnitude is inherently chaotic. There are simply no cookbooks, no maps, no videos, no books, no webinars, no conferences and certainly no newsletters that are capable of providing a step by step approach applicable to all providers or even most. Each solution will be different than the next because each organization is different.

We understand that an industry whose very foundation rests on the scientific method will have a difficult time accepting the fact that heuristics is the best we can do. In fact, for many within healthcare it is clearly anathema to suggest that sufficient study of the problem will not only lead to poor results, it will lead right off the cliff to certain failure. The "form a committee to form a committee to study the problem" will lead to death by a thousand cuts. We have seen this movie before and it doesn't have a happy ending.

In short, to solve a wicked problem you must fail fast in order to succeed. Why? Because problems this complex can't even be defined, let alone solved, without a better understanding of where we are today as compared to where we need to be. To solve a wicked problem you must act more and study less. That is the point that Lee Iacocca made when he took a chainsaw to the Mustang. Get busy doing! Break some ground!


Read more..

---

 

Looking for a best of breed HIPAA Compliance Software?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Business Associates: That was then, this is now

Until the  HITECH Act was enacted into law on February 17, 2009, as part of  ARRA, a  business associate's ("BA") compliance with  HIPAA's Regulations was mandated only as part of the contract (see  164.504(e)(1) ) with its respective  Covered Entity ("CE"). Under HITECH a BA is "directly on the hook" (i.e. via statutory authority) for complying with the following sections of the  HIPAA Security Rule("SR"):

 

1. Administrative Safeguards (see §164.308 );
2. Physical Safeguards (see §164.310 );
3. Technical Safeguards (see §164.312 ); and
4. Policies and Procedures and Documentation Requirements(see §164.316 ).

 

 BA compliance with the required sections of the SR were to go into effect one year post the enactment of HITECH, however, HHS (circa February 2010) delayed the compliance effective date for BAs, apparently to provide a little more breathing room to the impacted entities (see HITECH Effective Dates One Year Out).

In addition to the sections enumerated above, HITECH Section 13401states as follows:

The additional requirements of this title that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.

In short, a BA must comply with the enumerated sections above in the same way a CE is required to comply, and must also comply with any additional HITECH security requirements imposed upon a CE (e.g.Breach Notification). Finally, any additional HITECH security requirements must be incorporated into the contract between the respective parties. There is still some debate regarding this latter requirement, but the conservative approach is to review existing BA agreements and to add a HITECH Act addendum to eliminate the guessing game.

Read more..

 

---

 

Looking for a best of breed HIPAA Compliance Tracking System?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Attacking the HIPAA Security Rule: Hug the Monster

Tthe subtitle of Part III is: "Attacking the HIPAA Security Rule: Hug the Monster." We are using military metaphors because the Security Rule presents a completely different challenge than the Privacy Rule. It appears at first glance (and second, third, fourth glances as well) as a "military like" specification for cyber security. We would not be surprised if in fact that was where the substance of the rule originated.

There has not been much attention paid to the Security Rule for several reasons: 1) few providers have implemented EHRs; and 2) the previous HIPAA enforcement regime was essentially a paper tiger. The HITECH Act changes all that, providers now have very little choice other than to "hug the monster." The latter is a military term that means (more or less) when your survival is literally on the line you have to confront and acknowledge this reality before you can take meaningful steps to deal with it.



The Security Rule is so complex and daunting that we have decided to dedicate two featured articles to it in order to adequately provide the necessary foundation. There is likely no more significant public policy issue regarding the success of the proposed U.S. National Health Information Infrastructure than protecting the privacy and the security of the data contained within it.

This issue introduces the concept of a number of organizational frameworks that will be required in order to effectively cope with your EHR/HITECH/HIPAA initiatives. The framework concept was first introduced in this podcast that we did in collaboration with the World Health Congress.

We hope to add more multimedia content going forward. We understand that individuals vary in the manner by which they process and assimilate information. Often, the most clarity comes from seeing material presented via alternative forms.

We like to use "mind maps" for this reason, but also want to experiment with other tools. The HITECH Act and the HIPAA regulations are challenging, not only to understand, but to apply effectively. The HIPAA Security Rule is perhaps the canonical example of the complexity involved.

Read More ...

---

Looking for a best of breed HIPAA Compliance Software?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?