Web-Tones

HITECH Meaningful Use: Easy as one, two, three?

Here's what the ONC says is all you have to do to meet the Meaningful Use Requirements and get your EHR incentives:

1. Successfully register for the Medicare EHR Incentive Program;
2. Meet meaningful use criteria using certified EHR technology; and
3. Successfully attest, using CMS' Web-based system, that you have met meaningful use criteria using certified EHR technology.

Of course, meeting these requirements are not quite as straightforward as ONC leads one to believe, despite the fact that ONC has done yeoman's work in providing high quality and enormously useful content, that only gets you so far. As discussed below, eligible professionals (EP) and eligible hospitals (EH) will have to "legally attest" that the requirements have been met. This requires knowledge (and tracking) of the specific regulations that apply. Why? So that when an audit comes EPs and EHs can make a good faith argument that they have attested according to applicable law. Despite the fact that the raw data for attesting legally is contained within your EHR, your EHR software generally provides little or any guidance regarding how to meet the legal requirements. For that you need a different kind of tool and/or a much deeper understanding of the controlling regulations.

Summary of Attestation

How will I attest for the Medicare and Medicaid Incentive Programs? 

Medicare eligible professionals, eligible hospitals and critical access hospitals will have to demonstrate meaningful use through CMS' web-based Registration and Attestation System. In the Medicare & Medicaid EHR Incentive Program Registration and Attestation System, providers will fill in numerators and denominators for the meaningful use objectives and clinical quality measures, indicate if they qualify for exclusions to specific objectives, and legally attest that they have successfully demonstrated meaningful use. A complete EHR system will provide a report of the numerators, denominators and other information. Then you will need to enter that data into our online Attestation System. Providers will qualify for a Medicare EHR incentive payment upon completing a successful online submission through the Attestation System—immediately after you submit your results you will see a summary of your attestation, and whether or not it was successful. The Attestation System for the Medicare EHR Incentive Program will open on April 18, 2011.

For the Medicaid EHR Incentive Program, providers will follow a similar process using their state's Attestation System. Check here to see states' scheduled launch dates for their Medicaid EHR Incentive Programs: http://www.cms.gov/apps/files/statecontacts.pdf.

 

---

Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

HIPAA Criminal Indictments?

The indictment alleges that, on three separate occasions, Dr. Kaye informed one or more agents of a former patient’s employer that the patient was a serious and imminent threat to public safety, despite the patient’s discharge summary having indicated otherwise.  Dr. Kaye was previously reprimanded by the Virginia Board of Medicine, with a fine of $5,000, for the same incident.

via www.privsecblog.com

It's looks like state Attorney Generals may be cranking up the heat on HIPAA violations. With State's starving for revenue, I would not be surprised to see increased civil activity by AG's under the authority granted to them under the HITECH Act.

HHS has yet to announce how it intends to enforce HITECH (e.g. mandatory audits), but some sort of enforcement of privacy & security is mandatory if the U.S. intends to have a 21st century NHIN.

---

Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

 

HIPAA Breach Notification: What's the trigger?

This article addresses the kind of analysis required to decide whether breach notification is triggered under the HITECH Act for a given security incident. The bottom line is that not all security incidents trigger notification but the wicked problem remains how to determine the ones that do?      Section 13402 of the HITECH Act by requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information.The regulations pertaining to breach notification have been codified in 45 CFR 164 Subpart D and went into effect on September 23, 2009. The final breach notification rule is still pending but it was announced "soon" in March 2011.   To read the entire article signup for our free monthly compliance newsletter.

---

Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

The Future is here and it will be unevenly distributed!

“This is the next Macintosh-level of disruption.”

via techcrunch.com

I don't know if this is it, but it possibly could be. There will be the next level of computing disruption that actually disrupts that way the PC did. It will catch us all by surprise. It will create an entirely different paradigm (to use and over used word). It will be built on top of an enormous pre-existing foundation. It will create yet another asymmetry between the the digital haves and have nots.

Click and decide.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

 

 

HIPAA Compliance Software: Who needs it?

The answer to this question in the past was probably no one. Why? Because HIPAA prior to the HITECH Act was a dead letter, a law that was on the books but essentially not enforced Although HHS' enforcement efforts under HITECH has not been very agressive to date (understatement) that is something that is likely to change. The U.S. government will be handing out millions (if not billions) of dollars in EHR incentives and simpy cannot afford to look the other way regarding privacy and security.

Cybersecurity is becoming a big deal in Washington and the recent attacks will likely add fuel to the fire. In short, in the 21st century privacy and security are consumer issues that refuse to go away. The healthcare industry has largely gotten a pass so far, but there is no way that this status quo can be maintained.

So who needs HIPAA Compliance Software? The answer to this question now is all business associates and covered entities. There is simply no way that legacy manual methods of tracking HIPAA Compliance will suffice. Spreadsheets and other documents standing alone will also not get the job done. The bottom line is that HIPAA Compliance Software, like a high quality EHR, will become a cost of doing business. Taking an ostrich approach to the problem will only defer the pain.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

HIPAA Breach Notification: Understanding the Privacy Rule?

Was there an impermissible use or disclosure of unsecured PHI? 

This is one of the fundamental questions that needs to answered before you can determine whether or not Breach Notification has been triggered under the HITECH Act. This question has two component parts: 1) impermissble use or disclosure; and 2) of unsecured PHI. This post deals with the first component.

Essentially, what "impermissible use or disclosure" translates to is the question: "Has the HIPAA Privacy Rule been violated?" as depicted in Flowchart 4.

As you might imagine, this open ended question is difficult to answer and requires a deep understanding of the Rule even to make an educated guess. As with other complex problems, it is often helpful to break it down into smaller pieces. If you can determine that the use or disclosure was valid under the rule, then obviously you are done with the analysis. Breach Notification is NOT triggered if there has been no violation of the Rule. Flowchart 6 depicts this analysis.

 

Of course, this does not get you all the way home, but it does represent how you can begin attacking the problem. 

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAAexperience?

 

 

HIPAA Breach Notification: Substitute Notice to Patients?

Your Breach Notification policy and procedures require that you keep up-to-date contact information on your patients, and you obviously do this as a routine part of your operations in any case. But patients move and travel, and it is likely that if a breach of unsecured PHI occurs not all your contact information will be current. This post outlines the process you should follow. For the regulatory authority click here.

What If You Don’t Have Sufficient Contact Information?

If you do not have sufficient contact information for some or all of the affected individuals, or if some notices are returned as undeliverable, you must provide substitute notice, which should contain all of the types of information required in the notice letter.

How Do You Provide Substitute Notice?

Substitute notice must be provided in a way that is reasonably calculated to reach the affected individuals.

If there are fewer than ten (10) individuals for whom you have insufficient contact information to provide written notice, you may provide notice through an alternate form, such as by telephone or email, or posting a notice on your website. 

If you have insufficient contact information for more than ten (10) individuals, then you must provide substitute notice through either a conspicuous posting for a period of 90 days on the home page of your web site, or print or broadcast media in the geographic areas where the individuals affected by the breach likely reside.   If you use a hyperlink on your website’s home page to direct individuals to the notice, it must be prominent and convey the nature and importance of the information.  In addition, you MUST have a toll-free number active for 90 days where an individual may learn whether his or her unsecured PHI might be included in the notice.

Additional Notice In Urgent Situations

If you determine that your security incident requires urgent notice because of possible imminent misuse of unsecured PHI, you may provide information to individuals by telephone or other means, as appropriate, in addition to the written notice.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAAexperience?

HIPAA Breach Notification: Statutory Requirements?

The requirements for Breach Notification did not exist under HIPAA.  They were promulgated as part of the HITECH Act, specifically section 13402.  HHS subsequently issued regulations pertaining to Breach Notification in 45 CFR 164 (Subpart D). 

Keep in mind that many states have also promulgated breach notification laws which may be more or less stringent, or even different from the HITECH requirements. You can find information about state breach laws here.

 

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAAexperience?

Meaningful Use: Better Patient Outcomes?

June 15, 2011, 9:44 am / ONC Office of Communications

via www.healthit.gov

Here's one family practitioner's testimonial as to why EHRs are an important mission critical part of a practice (for the full interview click on the link above). Sure Dr. Brull is happy to get the EHR incentive dollars, BUT she is much happier that she is providing better care to her patients (and likely sleeps better because of it).

You can't manage want you don't measure and track. In this case, automatic notices made a huge difference in the life of three patients.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAAexperience?

 

 

HIPAA Breach Notification: Notifying Patients?

What Does The Breach Notification Letter Have To Include?

Each Breach Notification letter should be written on your company’s letterhead and contain the company’s contact information.  The letter should be written in plain, easy to read language. 

The notice to the individual should include:

1. Brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
2. A description of the types of unsecured protected health information that were involved in the breach, such as full name, social security number, date of birth, home address, diagnosis, disability code or other types of information;
3. Any steps individuals should take to protect themselves from potential harm resulting from the breach;
4. A brief description of what you are doing to investigate the breach, to mitigate the harm to individuals, and to protect against further breaches;
5. Contact procedures for individuals to ask questions or learn additional     information, which must include a toll-free number, an email address, web site,   or postal address.

If the individual has agreed to receive notice by electronic mail, you may email the letter.  If the individual is deceased, you must send the notice to the last known next of kin or personal representative, if this information was provided. 

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAAexperience?