Determining the amount of adequate training is not an easy question because the answer is highly dependent on the individual and the organization. Individuals often claim that vendor training provides only the problems, but not the solutions. That is a missed opportunity because if you know the problem and don't have an adequate answer, you're likely to be faced with difficulty responding and potentially encounter an Incident, Breach, or unauthorized disclosure of Protected Health Information ("PHI"). In this article, we describe aspects of what may be considered "good training" and what kind of training we make available so that you can compare across vendors.
You need answers! In our view, if you do not succeed in establishing compliance literacy in your workforce, you are likely going to have an occasional bad day, not to mention being out of compliance with the HIPAA regulations for training and associated documentation. As expressly stated in HHS' Audit Protocol, policies and procedures that have been adopted and activated by covered entities and business associates to meet selected standards are reviewed to determine an organization's implementation specifications of the Privacy, Security, and Breach Notification Rules. Training, by the way, is one of the Privacy Rule Regulations.
If you are audited, one of the things that will be reviewed is your training documentation. Yes, seems this is a small item compared to your Risk Assessment and other Compliance efforts. However, Covered Entities ("CE") and Business Associates ("BA") must train all members of their workforce regarding PHI as it applies and as necessary to perform their jobs. Compliance with Privacy Rule regulation 164.530(b) requires policies and procedures for training and to document which staff member was trained on what topic and when.
From a practical standpoint, when it comes to training, it's not enough to have an understanding of the regulations, but also training should provide the ability to evaluate responses to a variety of situations where PHI may be at risk. Training that provides hypothetical risk situations related to HIPAA regulations that prevent incidents or breaches and/or a Quiz regarding knowledge obtained is a component of quality education.
But is HIPAA a top priority for a CEO's average day? Probably not, unless there is an Incident or a Breach. The same is likely true for other executives in your organization. Aside from the regulation requirement, this is a VERY good reason why a named Compliance Officer should be in each Covered Entity and Business Associate's organization. A Compliance Officer has the responsibility to ensure that policies and procedures are being followed by the workforce to avoid non-compliance. And yes, the Compliance Officer ensures policies for training and the visible, demonstrable evidence for same.
So, how much training is really needed? For the purpose of this article, we will use the HIPAA Training Products contained within our Subscription Plan as training recommendation topics for different categories of workforce members. Again, remember our principal premise is that all workforce members need to become HIPAA literate since you have the 800-pound gorilla of Breach Notification staring you in the face.
Training for Clinicians
Not all staff members need to attend or be educated for every HIPAA training module. We recommend three (3) training sessions for clinicians as listed below:
Privacy Rule Training for Clinicians (coming soon!)
Breach Notification Training for Clinicians (coming soon!)
Why do we recommend specific training for clinicians? Well, I can say as a Registered Nurse, clinicians do not need to understand every aspect of the regulations. What they need to know is how to respond to various threats to PHI or situations where compliance action is required. They need an awareness and a basic understanding of Security, Privacy, and Breach Notification regulations that will enable prevention of risks while managing situations when HIPAA rules are tested.
A particular item of importance is knowing WHO to call when a situation arises. The same is true for Business Associates. You might be surprised at the number of times I have randomly asked clinicians the name of their HIPAA Compliance Officer and they did not know. That's a recipe for a bad day! Try this yourself next time you visit your doctor. Ask the receptionist or the nurse, or any other clinician or workforce member you encounter if they know the name of their Compliance Officer. By the way, this is generally true of organizations both large and small, even those that regularly train their employees.
Foundational Training for Other Staff
The following list of training modules is recommended for other workforce members, including the executive management team.
I have been asked if there is a HIPAA LITE for Business Associates, and the answer is No! Business Associates need to be as aware of the regulations as Covered Entities if they are "touching PHI." That said, we also provide specialized training for Business Associates in situations where their needs differ from Covered Entities (see below).
In addition to the training above, compliance officers should consider taking the following training classes to obtain their certification. We offer a HIPAA Certified Professional ("HCP") certification after taking an exam that covers material from the training modules listed below.
We also recommend that Compliance Officers take advantage of our pre-recorded four-part training series entitled: "Surviving a HIPAA Audit." Subscribers may log in to the Compliance Hub Member website to:
For some, the amount of information may be overwhelming, but just like HIPAA, you bite off a piece of the elephant one at a time.
Specialty Workforce Training
Finally, we recommend that staff who are responsible for items in the list below, and Compliance Officers and/or Executive Officers become knowledgeable on the following topics:
Training for workforce members that are designated as "point persons" for the Patient's Bill of Rights; these are sections 164.520 through 164.528 of the Privacy Rule.
The regulations require that individuals "sign off" on certain processes pertaining to providing access to a patient's PHI;
Helping a patient amend their PHI;
Distributing the notice of privacy practices, etc.
Training for individuals that handle Privacy Rule requests for authorizations, restrictions, etc.
Training for personnel assigned the responsibility of tracking security incidents.
Training for information technology personnel that are required to audit information systems containing PHI.
Training for personnel that are assigned the responsibility for disposing of PHI.
This is not an exhaustive list. The "final" list of training will depend on your operational environment, the size and complexity of your organization, and the resources you have available, etc. One thing is certain, look for training that provides answers, not just a description of the problems.
HOW TO COMPLY WITH HIPAA
At 3Lions Publishing, Inc. our mission is to provide clients with:
Premium Compliance Products,
Education,
Free Monthly Webinars,
Newsletter Articles on HIPAA and regulatory topics, as well as
"High Touch" LIVE assistance with Products for Risk Assessment and Remediation.
We do NOT charge extra for compliance support like many of our competitors, the cost for your LIVE assistance is included in your Subscription purchase.
A full 360-degree circle of Risk Assessment and Remediation products are provided in 3Lions Publishing Inc.'s
The Subscription Plan includes Expresso®, the Risk Assessment "SaaS" based software, over 30+ compliance and remediation products, and training videos that help Covered Entities and Business Associates understand how to implement the necessary Controls to be in compliance with HIPAA regulations. Our LIVE "High Touch" Assistance helps you "get it done" fast!
Our many Training products describe various aspects of the regulations as well as demonstrations of how to use Expresso and associated compliance tools. As part of the Subscription Plan, we also provide certification for clients seeking designation as a HIPAA Certified Professional ("HCP").
A "Crosswalk" between Expresso Risks and Remediation tools provides easy access to model policies, procedures and tracking mechanisms for compliance.
FREE Monthly newsletters and webinars provide education on topics of regulatory concern. Missed one? Webinars and articles are posted to the HIPAA Survival Guide Store Website for future reference.
So, why are we sharing this information in our Newsletter? Education, Education, Education. Stay tuned not only for Product updates but also for new capabilities and value offered to our elite group of clients. Save time and money with our high quality, bargain Subscription Plan!
Or, take advantage of our FREE 15 day trial of Expresso to complete your Risk Assessment!
Questions? Please call or write using the contact information below.
This article provides guidance regarding what to expect, and what you should do, once a Business Associate has notified you of a breach. By now, you should already have a plan in place that helps you respond to this dreaded predicament. However, we know from experience that many of you don't, and even if you do, read on, you may learn something new.
The approach we take in the article is to use the breach notification process as a backdrop to point out a number of "holes" you may have in your HIPAA/HITECH compliance initiative, ones that you are likely not even aware of.
Tracking Security Incidents?
The term "security incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. An attempt qualifies as an incident.
If you are not rigorously tracking incidents, then you can't possibly know when you have a breach. One of the first questions that an HHS auditor is going ask is "show me the system (i.e. the policies, processes and tracking mechanism) your organization uses to track security incident?" If you can't adequately answer this most basic of questions, you may be in willful neglect land five minutes into the audit.
Ok, so let's assume that for the purpose of this article you, as the covered entity, have a state of the art security incident tracking system in place. What we really want to know is "What kind of tracking system does your business associate have in place?" If the answer is "we don't have a clue," then may the HIPAA gods help you if it turns out that in fact, despite "catching" this incident, there is no business associate system in place at all.
How Do You Know It's a Breach?
In order to determine whether Breach Notification is triggered you need to follow a methodology that is mandated by the Breach Notification Rule ("Rule"). Although the Rule contains a basic methodology that is inherent in its text, it is not presented as such in the regulations. HIPAA/HITECH remain descriptive as opposed to prescriptive. That is, the regulations inform you as to what is required, but have very little (mostly nothing) to say about how you should go about complying.
The methodology consists of a three part analytical framework which we turn our attention to next. Although the framework only consists of three parts, it is significantly more complex than it first appears.
SIgnup for our FREE Newsletter or wait until it appears in the archives to read the rest of the article.
Our HIPAA Cloud, Social Media, and Mobile Checklist ("CSMM") under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that allow you to make sense out of this new and quickly evolving terrain. The healthcare industry is adopting Cloud, Social Media, and Mobile technologies at an unprecedented rate. Although these enabling technologies collectively help drive the point of care anywhere vision and productivity, they also present unique and unanticipated compliance challenges. Our Checklist is intended as a knowledge transfer vehicle that allows you to derive the CSMM compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant sections of the CSMM, highlighting the policies, processes and tracking mechanisms required at a granular level.
Our Checklist is comprised of Checklist Items that have the following components:
1) a policy statement that reflects an organization's intentions: the what;
2) a definition of a process by which the policy is implemented: the how; and
3) suggested tracking mechanism(s) for capturing process results: the measurement.
What is a Policy?
The word “policy” can be used in so many ways that it bears some exploration, especially for our purposes (i.e. as it pertains to HIPAA regulatory compliance). We often talk of “developing a policy,” or of “implementing a policy” or of “carrying out a policy.” For example, 45 CFR §164.530 (i) states as follows:
Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part.
Notice that a distinction is made between policies versus procedures. In general, we can think of a “policy” as a purposeful set of decisions or actions usually in response to a problem that has arisen. From a compliance perspective, a policy is a set of statements, including decisions and actions, regarding what an organization intends to do with respect to meeting its regulatory requirements (e.g. see our Breach Notification Policy). A policy indicates what an organization intends to do and is often also used as a communications vehicle of said intent.
Our Checklist contains a the following policies: Cloud, Social Media and Mobile; each of which can be used out-of-the-box or customized to meet your organization's specific requirements. However, ourChecklist contains much more than mere policy statements. A policy is a necessary, but insufficient, component of a compliance initiative.
What is a Process?
A process is a repeatable series of steps that must be accomplished over time. From a HIPAA regulatory compliance perspective, processes are how policies get implemented. Policies without processes are nothing more than empty promises and will not prevent serious compliance liability. HHS is going to want to see evidence not only of policies but of processes as well. Every Checklist Item contains process suggestions that will enable you to quickly "stand-up" your CSMM Compliance initiative.
What is a Tracking Mechanism?
A tracking mechanism is a way to keep track of process results. For example, QuickBooks is a tracking mechanism for accounting data and processes. You must be able to track the results of your compliance processes if you hope to provide visible demonstrable evidence that you are meeting your regulatory requirements.
Other components included in our Checklist?
Component
Description
Model Cloud Computing Policy
Comprised of Cloud policy statements included in the individual Checklist Items with some global clauses added.
Model Social Media Policy
Comprised of Social Media policy statements included in the individual Checklist Items with some global clauses added.
Model Mobile Policy
Comprised of Mobile policy statements included in the individual Checklist Items with some global clauses added.
H2 Compliance Scorecard
H2 Compliance Scorecard for the Checklist. The Scorecard can be used as an internal tracking system to log an organization’s CSMM compliance improvement initiative over time.
Customize It!
Our CSMM Checklist under HITECH was developed in a manner that lends itself readily to customization in order to meet the unique requirements of Your Organization.
HHS has just launched a Mobile Device Compliance website. Watch the videos to get some basic insights regarding the compliance issues that mobile devices represent. Although HHS deserves kudos for providing an excellent information site, covered entities and business associate better understand that HHS is also sending an "enforcement message" through these nicely done videos.
Don't expect to become an expert by watching these videos and perusing this site. As with most things that HHS does with respect to HITECH/HIPAA compliance, the advice given is descriptive and not prescriptive. If you want the latter you will need to look elsewhere.
Our HIPAA Cloud, Social Media, and Mobile Checklist ("CSMM") under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that allow you to make sense out of this new and quickly evolving terrain. The healthcare industry is adopting Cloud, Social Media, and Mobile technologies at an unprecedented rate. Although these enabling technologies collectively help drive the point of care anywhere vision and productivity, they also present unique and unanticipated compliance challenges. Our Checklist is intended as a knowledge transfer vehicle that allows you to derive the CSMM compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant sections of the CSMM, highlighting the policies, processes and tracking mechanisms required at a granular level.
Our Checklist is comprised of Checklist Items that have the following components:
1) a policy statement that reflects an organization's intentions: the what;
2) a definition of a process by which the policy is implemented: the how; and
3) suggested tracking mechanism(s) for capturing process results: the measurement.
What is a Policy?
The word “policy” can be used in so many ways that it bears some exploration, especially for our purposes (i.e. as it pertains to HIPAA regulatory compliance). We often talk of “developing a policy,” or of “implementing a policy” or of “carrying out a policy.” For example, 45 CFR §164.530 (i) states as follows:
Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part.
Notice that a distinction is made between policies versus procedures. In general, we can think of a “policy” as a purposeful set of decisions or actions usually in response to a problem that has arisen. From a compliance perspective, a policy is a set of statements, including decisions and actions, regarding what an organization intends to do with respect to meeting its regulatory requirements (e.g. see our Breach Notification Policy). A policy indicates what an organization intends to do and is often also used as a communications vehicle of said intent.
Our Checklist contains a the following policies: Cloud, Social Media and Mobile; each of which can be used out-of-the-box or customized to meet your organization's specific requirements. However, ourChecklist contains much more than mere policy statements. A policy is a necessary, but insufficient, component of a compliance initiative.
What is a Process?
A process is a repeatable series of steps that must be accomplished over time. From a HIPAA regulatory compliance perspective, processes are how policies get implemented. Policies without processes are nothing more than empty promises and will not prevent serious compliance liability. HHS is going to want to see evidence not only of policies but of processes as well. Every Checklist Item contains process suggestions that will enable you to quickly "stand-up" your CSMM Compliance initiative.
What is a Tracking Mechanism?
A tracking mechanism is a way to keep track of process results. For example, QuickBooks is a tracking mechanism for accounting data and processes. You must be able to track the results of your compliance processes if you hope to provide visible demonstrable evidence that you are meeting your regulatory requirements.
Other components included in our Checklist?
Component
Description
Model Cloud Policy
Comprised of Cloud policy statements included in the individual Checklist Items with some global clauses added.
Model Social Media Policy
Comprised of Social Media policy statements included in the individual Checklist Items with some global clauses added.
Model Mobile Policy
Comprised of Mobile policy statements included in the individual Checklist Items with some global clauses added.
H2 Compliance Scorecard
H2 Compliance Scorecard for the Checklist. The Scorecard can be used as an internal tracking system to log an organization’s CSMM compliance improvement initiative over time.
Customize It!
Our CSMM Checklist under HITECH was developed in a manner that lends itself readily to customization in order to meet the unique requirements of Your Organization.
This webinar explores the same subject matter as this month's news article. The next several HIPAA Survival Guide Radio Shows will do likewise. Obviously this is a topic that has gotten the attention of the industry. Our objective is to demystify what you can expect from an audit by clearly exposing what a HITECH / HIPAA audit must be based on, according to the relevant statutes and regulations.
If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?
Under Section 13411 of the HITECH Act, the Secretary "shall provide for periodic audits" to ensure compliance with the Act. It is the Office of Civil Rights ("OCR") that has the actual authority (under the Secretary) for HIPAA audits and enforcement actions. In 2011, OCR contracted with KPMG to develop an audit methodology and to conduct 150 audits. These audits are well underway. This article discusses what you should expect from an OCR audit.
You can subscribe to our FREE HITECH / HIPAA Compliance Newsletter here.
This show explored what you should expect from an OCR audit. It concluded our segments on the HIPAA Privacy Rule and started on the Administrative Safeguards of the HIPAA Security Rule.
Also, please join us at the following event (see below to register):
FREE WEBINAR: HIPAA Compliance: what to expect from an OCR audit?
This webinar explores the same subject matter as this month's news article. The next several HIPAA Survival Guide Radio Shows will do likewise. Obviously this is a topic that has gotten the attention of the industry. Our objective is to demystify what you can expect from an audit by clearly exposing what a HITECH / HIPAA audit must be based on, according to the relevant statutes and regulations.
We refuse to continue writing about the data breach du jour. There are simply many in the healthcare industry that prefer the Ostrich Strategy than making meaningful progress. Unfortunately, there is nothing (short of death and being replaced by the young turks that understand the world has changed) that can force these old timers to change. They still hang on to myth that it's cheaper to pay the HIPAA fines than to comply (a rude awakening awaits), despite the disruption occurring all around them.
There is now an emerging consensus
that there is NO WAY that privacy &
security gets left at the roadside as
the Healthcare industry moves to the
21st century.
There is now an emerging consensus that there is no way privacy and security gets left at the roadside as the healthcare industry moves to the 21 Century. If you want some insights into the creative destruction of medicine and the end of the "doctor as God" complex than watch this video.
If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?
Our HIPAA Privacy Rule Checklist under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that will allow you to make sense out of this new terrain. It is intended as a knowledge transfer vehicle that allows you to derive the HIPAA Privacy Rule compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant statutory/regulatory sections of the HIPAA Privacy Rule, highlighting the policies, processes and tracking mechanisms required at a granular level.