Web-Tones

HIPAA Survival Guide August 2018 Newsletter

 

 

  Register here for the FREE HIPAA Survival Guide Newsletter

  

Does your staff have sufficient HIPAA training?

 

Determining the amount of adequate training is not an easy question because the answer is highly dependent on the individual and the organization. Individuals often claim that vendor training provides only the problems, but not the solutions. That is a missed opportunity because if you know the problem and don't have an adequate answer, you're likely to be faced with difficulty responding and potentially encounter an Incident, Breach, or unauthorized disclosure of Protected Health Information ("PHI"). In this article, we describe aspects of what may be considered "good training" and what kind of training we make available so that you can compare across vendors.

 

You need answers! In our view, if you do not succeed in establishing compliance literacy in your workforce, you are likely going to have an occasional bad day, not to mention being out of compliance with the HIPAA regulations for training and associated documentation. As expressly stated in HHS' Audit Protocol, policies and procedures that have been adopted and activated by covered entities and business associates to meet selected standards are reviewed to determine an organization's implementation specifications of the Privacy, Security, and Breach Notification Rules. Training, by the way, is one of the Privacy Rule Regulations. 

If you are audited, one of the things that will be reviewed is your training documentation. Yes, seems this is a small item compared to your Risk Assessment and other Compliance efforts. However, Covered Entities ("CE") and Business Associates ("BA") must train all members of their workforce regarding PHI as it applies and as necessary to perform their jobs. Compliance with Privacy Rule regulation 164.530(b) requires policies and procedures for training and to document which staff member was trained on what topic and when.

 

From a practical standpoint, when it comes to training, it's not enough to have an understanding of the regulations, but also training should provide the ability to evaluate responses to a variety of situations where PHI may be at risk. Training that provides hypothetical risk situations related to HIPAA regulations that prevent incidents or breaches and/or a Quiz regarding knowledge obtained is a component of quality education.

 

But is HIPAA a top priority for a CEO's average day? Probably not, unless there is an Incident or a Breach. The same is likely true for other executives in your organization. Aside from the regulation requirement, this is a VERY good reason why a named Compliance Officer should be in each Covered Entity and Business Associate's organization. A Compliance Officer has the responsibility to ensure that policies and procedures are being followed by the workforce to avoid non-compliance. And yes, the Compliance Officer ensures policies for training and the visible, demonstrable evidence for same.

 

So, how much training is really needed? For the purpose of this article, we will use the HIPAA Training Products contained within our Subscription Plan as training recommendation topics for different categories of workforce members. Again, remember our principal premise is that all workforce members need to become HIPAA literate since you have the 800-pound gorilla of Breach Notification staring you in the face.

 

Training for Clinicians

Not all staff members need to attend or be educated for every HIPAA training module. We recommend three (3) training sessions for clinicians as listed below:

• Security Rule Training for Clinicians
• Privacy Rule Training for Clinicians (coming soon!)
• Breach Notification Training for Clinicians (coming soon!)

Why do we recommend specific training for clinicians? Well, I can say as a Registered Nurse, clinicians do not need to understand every aspect of the regulations. What they need to know is how to respond to various threats to PHI or situations where compliance action is required. They need an awareness and a basic understanding of Security, Privacy, and Breach Notification regulations that will enable prevention of risks while managing situations when HIPAA rules are tested. 

 

A particular item of importance is knowing WHO to call when a situation arises. The same is true for Business Associates. You might be surprised at the number of times I have randomly asked clinicians the name of their HIPAA Compliance Officer and they did not know. That's a recipe for a bad day! Try this yourself next time you visit your doctor. Ask the receptionist or the nurse, or any other clinician or workforce member you encounter if they know the name of their Compliance Officer. By the way, this is generally true of organizations both large and small, even those that regularly train their employees.

 

Foundational Training for Other Staff

The following list of training modules is recommended for other workforce members, including the executive management team. 

• Privacy Rule Training
• Security Rule Training
• Breach Notification Training
• Social Media Training
• Mobile Devices Training

I have been asked if there is a HIPAA LITE for Business Associates, and the answer is No! Business Associates need to be as aware of the regulations as Covered Entities if they are "touching PHI." That said, we also provide specialized training for Business Associates in situations where their needs differ from Covered Entities (see below).

• Business Associate Training
• Security Rule for Business Associates

 

 

Specific Training for Compliance Officers

In addition to the training above, compliance officers should consider taking the following training classes to obtain their certification. We offer a HIPAA Certified Professional ("HCP") certification after taking an exam that covers material from the training modules listed below.

 

 

Certification Training Modules
1.    Breach Notification 2.    Business Associate 3.    Audit 4.    Breach Notification Audit 5.    Privacy Rule Audit 6.    Security Rule Audit 7.    Documentation*  8.    HITECH Act	9.    Omnibus Rule 10.  Privacy Rule 11.  Security Rule 12.  Risk Assessment 13.  Risk Management 14.  Social Media Best Practices 15.  Mobile Best Practices

 

We also recommend that Compliance Officers take advantage of our pre-recorded four-part training series entitled: "Surviving a HIPAA Audit." Subscribers may log in to the Compliance Hub Member website to:

• Download the HIPAA Handbook: A Definitive Guide of Articles that contains over 400 pages of articles with an index of topics, and
• Saved Webinar Recordings.

For some, the amount of information may be overwhelming, but just like HIPAA, you bite off a piece of the elephant one at a time.

 

Specialty Workforce Training

Finally, we recommend that staff who are responsible for items in the list below, and Compliance Officers and/or Executive Officers become knowledgeable on the following topics:

1. Training for workforce members that are designated as "point persons" for the Patient's Bill of Rights; these are sections 164.520 through 164.528 of the Privacy Rule. 
   • The regulations require that individuals "sign off" on certain processes pertaining to providing access to a patient's PHI; 
   • Helping a patient amend their PHI; 
   • Distributing the notice of privacy practices, etc.
2. Training for individuals that handle Privacy Rule requests for authorizations, restrictions, etc.
3. Training for personnel assigned the responsibility of tracking security incidents.
4. Training for information technology personnel that are required to audit information systems containing PHI.
5. Training for personnel that are assigned the responsibility for disposing of PHI.

This is not an exhaustive list. The "final" list of training will depend on your operational environment, the size and complexity of your organization, and the resources you have available, etc. One thing is certain, look for training that provides answers, not just a description of the problems.

 

HOW TO COMPLY WITH HIPAA

At 3Lions Publishing, Inc. our mission is to provide clients with:

• Premium Compliance Products,
• Education,
• Free Monthly Webinars, 
• Newsletter Articles on HIPAA and regulatory topics, as well as 
• "High Touch" LIVE assistance with Products for Risk Assessment and Remediation. 

We do NOT charge extra for compliance support like many of our competitors, the cost for your LIVE assistance is included in your Subscription purchase. 

A full 360-degree circle of Risk Assessment and Remediation products are provided in 3Lions Publishing Inc.'s 

HIPAA and Expresso Subscription Plan. 

 

The Subscription Plan includes  Expresso®, the Risk Assessment "SaaS" based software, over 30+ compliance and remediation products, and training videos that help Covered Entities and Business Associates understand how to implement the necessary Controls to be in compliance with HIPAA regulations. Our LIVE "High Touch" Assistance helps you "get it done" fast!

 

Our many Training products describe various aspects of the regulations as well as demonstrations of how to use Expresso and associated compliance tools. As part of the Subscription Plan, we also provide certification for clients seeking designation as a HIPAA Certified Professional ("HCP").

 

A "Crosswalk" between Expresso Risks and Remediation tools provides easy access to model policies, procedures and tracking mechanisms for compliance. 

 

FREE Monthly newsletters and webinars provide education on topics of regulatory concern. Missed one? Webinars and articles are posted to the HIPAA Survival Guide Store Website for future reference.

 

So, why are we sharing this information in our Newsletter? Education, Education, Education. Stay tuned not only for Product updates but also for new capabilities and value offered to our elite group of clients. Save time and money with our high quality, bargain Subscription Plan! 

 

Or, take advantage of our FREE 15 day trial of Expresso to complete your Risk Assessment! 

 

 

Questions? Please call or write using the contact information below.

 

Email:     [email protected]

Phone:   (800) 516-7903    

 

HIPAA Help

 

What is the new LinkedIn GDPR Survival Guide?

What is the HIPAA Survival Guide® Subscription Plan and what does it include?

What is  Expresso® The Risk Assessment Express?

What is The Contingency Framework? 

HIPAA Requirements for Cloud, Social Media, and Mobile including Policies and Procedures

HIPAA Requirements for Breach Notification including Policies and Procedures

HIPAA Requirements for a  Business Associate Agreement including the essential terms of the agreement

How to prepare for a HIPAA Security Rule Audit  

How to prepare for a HIPAA Privacy Rule Audit  

How to prepare for a HIPAA Breach Notification Audit  

How to prepare for a HIPAA Risk Assessment Audit  

 

For HIPAA Help send us an Email at [email protected]

 

 

Included in the HIPAA Survival Guide® Subscription Plan    New Products! Business Partner Vetting HIPAA Handbook: A Definitive Guide Security Rule Training for Clinicians EXPRESSO RELEASE 2.0 Coming Soon!  Expresso® HIPAA Subscription Plan Expresso® Monthly Plan GDPR Compliance Products  Pulse™  The Cloud & HIPAA Training Phishing & Ransomware Training Contingency Framework Cloud, Social Media, and Mobile Checklist Model Mobile Policy  Privacy Rule Checklist  Model Privacy Rule Policy Model Notice of Privacy Practices  Security Rule Checklist  Model Security Rule Policy  Checklists Combo Package  Breach Notification Framework  Breach Notification Policy

Business Associate Agreement  Business Associate-to-Business Associate Agreement  Security Rule for Business Associates  HIPAA Frameworks Combo  HIPAA Certification Training  HIPAA Audit Preparation Training HIPAA Security Rule Audit Preparation Training HIPAA Privacy Rule Audit Preparation Training HIPAA Breach Notification Rule Audit Preparation Training HIPAA Audit Preparation Training Suite HITECH Act Training Security Rule Training Privacy Rule Training Breach Notification Training Business Associates Training HITECH Core Training Combo  Omnibus Rule Training  Mobile Devices Training Social Media Training Risk Assessment Training Risk Management Program Training Agile Compliance Training

 

Protect Your Practice and Your Business

 

Click Here for HIPAA Survival Guide® Subscription Plan Testimonials Take advantage of our Heartbeat™ and Pulse™ offerings with The HIPAA Survival Guide® Subscription Plan With Expresso®

 

 

A Business Associate Just Notified You of a Serious Breach: What now?

 This article provides guidance regarding what to expect, and what you should do, once a Business Associate has notified you of a breach. By now, you should already have a plan in place that helps you respond to this dreaded predicament. However, we know from experience that many of you don't, and even if you do, read on, you may learn something new. 

The approach we take in the article is to use the breach notification process as a backdrop to point out a number of "holes" you may have in your HIPAA/HITECH compliance initiative, ones that you are likely not even aware of.

Tracking Security Incidents? 

The term "security incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. An attempt qualifies as an incident. 

 

If you are not rigorously tracking incidents, then you can't possibly know when you have a breach. One of the first questions that an HHS auditor is going ask is "show me the system (i.e. the policies, processes and tracking mechanism) your organization uses to track security incident?" If you can't adequately answer this most basic of questions, you may be in willful neglect land five minutes into the audit.

 

Ok, so let's assume that for the purpose of this article you, as the covered entity, have a state of the art security incident tracking system in place. What we really want to know is "What kind of tracking system does your business associate have in place?" If the answer is "we don't have a clue," then may the HIPAA gods help you if it turns out that in fact, despite "catching" this incident, there is no business associate system in place at all.  

How Do You Know It's a Breach?

 In order to determine whether Breach Notification is triggered you need to follow a methodology that is mandated by the Breach Notification Rule ("Rule"). Although the Rule contains a basic methodology that is inherent in its text, it is not presented as such in the regulations. HIPAA/HITECH remain descriptive as opposed to prescriptive. That is, the regulations inform you as to what is required, but have very little (mostly nothing) to say about how you should go about complying. 

The methodology consists of a three part analytical framework which we turn our attention to next. Although the framework only consists of three parts, it is significantly more complex than it first appears.

SIgnup for our FREE Newsletter or wait until it appears in the archives to read the rest of the article.

 

HIPAA Cloud, Social Media, and Mobile Checklist Available & Omnibus Rule Ready

We are pleased to announce that our HIPAA Cloud, Social Media, and Mobile Checklist is now Omnibus Rule Ready™.

Omnibus Rule Ready™

Our HIPAA Cloud, Social Media, and Mobile Checklist ("CSMM") under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that allow you to make sense out of this new and quickly evolving terrain. The healthcare industry is adopting Cloud, Social Media, and Mobile technologies at an unprecedented rate. Although these enabling technologies collectively help drive the point of care anywhere vision and productivity, they also present unique and unanticipated compliance challenges. Our Checklist is intended as a knowledge transfer vehicle that allows you to derive the CSMM compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant sections of the CSMM, highlighting the policies, processes and tracking mechanisms required at a granular level.

Our Checklist is comprised of Checklist Items that have the following components:

1) a policy statement that reflects an organization's intentions:  the what;

2) a definition of a process by which the policy is implemented:  the how; and

3) suggested tracking mechanism(s) for capturing process results:  the measurement.

What is a Policy?

 The word “policy” can be used in so many ways that it bears some exploration, especially for our purposes (i.e. as it pertains to HIPAA regulatory compliance). We often talk of “developing a policy,” or of “implementing a policy” or of “carrying out a policy.” For example, 45 CFR §164.530 (i) states as follows:

Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part.

Notice that a distinction is made between policies versus procedures. In general, we can think of a “policy” as a purposeful set of decisions or actions usually in response to a problem that has arisen. From a compliance perspective, a policy is a set of statements, including decisions and actions, regarding what an organization intends to do with respect to meeting its regulatory requirements (e.g. see our Breach Notification Policy). A policy indicates what an organization intends to do and is often also used as a communications vehicle of said intent.

Our Checklist contains a the following policies: Cloud, Social Media and Mobile; each of which can be used out-of-the-box or customized to meet your organization's specific requirements. However, our Checklist contains much more than mere policy statements. A policy is a necessary, but insufficient, component of a compliance initiative.

What is a Process?

 A process is a repeatable series of steps that must be accomplished over time. From a HIPAA regulatory compliance perspective, processes are how policies get implemented. Policies without processes are nothing more than empty promises and will not prevent serious compliance liability. HHS is going to want to see evidence not only of policies but of processes as well. Every Checklist Item contains process suggestions that will enable you to quickly "stand-up" your CSMM Compliance initiative. 

What is a Tracking Mechanism?

 A tracking mechanism is a way to keep track of process results. For example, QuickBooks is a tracking mechanism for accounting data and processes. You must be able to track the results of your compliance processes if you hope to provide visible demonstrable evidence that you are meeting your regulatory requirements. 

Other components included in our Checklist?

Component	Description
Model Cloud Computing Policy	Comprised of Cloud policy statements included in the individual Checklist Items with some global clauses added.
Model Social Media Policy	Comprised of Social Media policy statements included in the individual Checklist Items with some global clauses added.
Model Mobile Policy	Comprised of Mobile policy statements included in the individual Checklist Items with some global clauses added.
H2 Compliance Scorecard	H2 Compliance Scorecard for the Checklist. The Scorecard can be used as an internal tracking system to log an organization’s CSMM compliance improvement initiative over time.

Customize It!

Our CSMM Checklist under HITECH was developed in a manner that lends itself readily to customization in order to meet the unique requirements of Your Organization.

HITECH/HIPAA: 2013 will be the year of Mobile Compliance!

HHS has just launched a Mobile Device Compliance website. Watch the videos to get some basic insights regarding the compliance issues that mobile devices represent. Although HHS deserves kudos for providing an excellent information site, covered entities and business associate better understand that HHS is also sending an "enforcement message" through these nicely done videos.

Don't expect to become an expert by watching these videos and perusing this site. As with most things that HHS does with respect to HITECH/HIPAA compliance, the advice given is descriptive and not prescriptive. If you want the latter you will need to look elsewhere.

HIPAA Cloud, Social Media, and Mobile Checklist under HITECH

Digital Download

Now available on the HSG Store.

 

Our HIPAA Cloud, Social Media, and Mobile Checklist ("CSMM") under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that allow you to make sense out of this new and quickly evolving terrain. The healthcare industry is adopting Cloud, Social Media, and Mobile technologies at an unprecedented rate. Although these enabling technologies collectively help drive the point of care anywhere vision and productivity, they also present unique and unanticipated compliance challenges. Our Checklist is intended as a knowledge transfer vehicle that allows you to derive the CSMM compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant sections of the CSMM, highlighting the policies, processes and tracking mechanisms required at a granular level.

Our Checklist is comprised of Checklist Items that have the following components:

1) a policy statement that reflects an organization's intentions:  the what;

2) a definition of a process by which the policy is implemented:  the how; and

3) suggested tracking mechanism(s) for capturing process results:  the measurement.

What is a Policy?

 The word “policy” can be used in so many ways that it bears some exploration, especially for our purposes (i.e. as it pertains to HIPAA regulatory compliance). We often talk of “developing a policy,” or of “implementing a policy” or of “carrying out a policy.” For example, 45 CFR §164.530 (i) states as follows:

Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part.

Notice that a distinction is made between policies versus procedures. In general, we can think of a “policy” as a purposeful set of decisions or actions usually in response to a problem that has arisen. From a compliance perspective, a policy is a set of statements, including decisions and actions, regarding what an organization intends to do with respect to meeting its regulatory requirements (e.g. see our Breach Notification Policy). A policy indicates what an organization intends to do and is often also used as a communications vehicle of said intent.

Our Checklist contains a the following policies: Cloud, Social Media and Mobile; each of which can be used out-of-the-box or customized to meet your organization's specific requirements. However, our Checklist contains much more than mere policy statements. A policy is a necessary, but insufficient, component of a compliance initiative.

What is a Process?

 A process is a repeatable series of steps that must be accomplished over time. From a HIPAA regulatory compliance perspective, processes are how policies get implemented. Policies without processes are nothing more than empty promises and will not prevent serious compliance liability. HHS is going to want to see evidence not only of policies but of processes as well. Every Checklist Item contains process suggestions that will enable you to quickly "stand-up" your CSMM Compliance initiative. 

What is a Tracking Mechanism?

 A tracking mechanism is a way to keep track of process results. For example, QuickBooks is a tracking mechanism for accounting data and processes. You must be able to track the results of your compliance processes if you hope to provide visible demonstrable evidence that you are meeting your regulatory requirements. 

Other components included in our Checklist?

Component	Description
Model Cloud Policy	Comprised of Cloud policy statements included in the individual Checklist Items with some global clauses added.
Model Social Media Policy	Comprised of Social Media policy statements included in the individual Checklist Items with some global clauses added.
Model Mobile Policy	Comprised of Mobile policy statements included in the individual Checklist Items with some global clauses added.
H2 Compliance Scorecard	H2 Compliance Scorecard for the Checklist. The Scorecard can be used as an internal tracking system to log an organization’s CSMM compliance improvement initiative over time.

Customize It!

Our CSMM Checklist under HITECH was developed in a manner that lends itself readily to customization in order to meet the unique requirements of Your Organization.

FREE WEBINAR: What to expect from an OCR audit?

This webinar explores the same subject matter as this month's news article. The next several HIPAA Survival Guide Radio Shows will do likewise. Obviously this is a topic that has gotten the attention of the industry. Our objective is to demystify what you can expect from an audit by clearly exposing what a HITECH / HIPAA audit must be based on, according to the relevant statutes and regulations. 

Date: June 21, 2012. 

Time: 2:00 to 3:00 EST. 

To register Click Here.  

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

HITECH / HIPAA Newsletter June 2012 Now Available

The featured article this month is entitled HIPAA Compliance: what to expect from an OCR audit?.

Under Section  13411 of the HITECH Act, the Secretary "shall provide for periodic audits" to ensure compliance with the Act. It is the Office of Civil Rights ("OCR") that has the actual authority (under the Secretary) for HIPAA audits and enforcement actions. In 2011, OCR contracted with KPMG to develop an audit methodology and to conduct 150 audits. These audits are well underway. This article discusses what you should expect from an OCR audit.

You can subscribe to our FREE HITECH / HIPAA Compliance Newsletter here.

 

HSG Radio Archive: What to expect from an OCR audit (Part 3)?

This show explored what you should expect from an OCR audit. It concluded our segments on the HIPAA Privacy Rule and started on the Administrative Safeguards of the HIPAA Security Rule.

Listen to internet radio with cleyva on Blog Talk Radio

Also, please join us at the following event (see below to register):

FREE WEBINAR: HIPAA Compliance: what to expect from an OCR audit?

This webinar explores the same subject matter as this month's news article. The next several HIPAA Survival Guide Radio Shows will do likewise. Obviously this is a topic that has gotten the attention of the industry. Our objective is to demystify what you can expect from an audit by clearly exposing what a HITECH / HIPAA audit must be based on, according to the relevant statutes and regulations.

Date: June 21, 2012. 

Time: 2:00 to 3:00 EST. 

To register Click Here.  

 

No Disruption in the Healthcare Industry without Privacy & Security?

We refuse to continue writing about the data breach du jour. There are simply many in the healthcare industry that prefer the Ostrich Strategy than making meaningful progress. Unfortunately, there is nothing (short of death and being replaced by the young turks that understand the world has changed) that can force these old timers to change. They still hang on to myth that it's cheaper to pay the HIPAA fines than to comply (a rude awakening awaits), despite the disruption occurring all around them.

 

There is now an emerging consensus

that there is NO WAY that privacy & 

security gets left at the roadside as

the Healthcare industry moves to the

21st century.

 

There is now an emerging consensus that there is no way privacy and security gets left at the roadside as the healthcare industry moves to the 21 Century. If you want some insights into the creative destruction of medicine and the end of the "doctor as God" complex than watch this video.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

HIPAA Privacy Rule Checklist Product Overview Video

Our HIPAA Privacy Rule Checklist under HITECH ("Checklist") is intended to deliver guidance, including suggested policies, processes, and tracking mechanisms that will allow you to make sense out of this new terrain. It is intended as a knowledge transfer vehicle that allows you to derive the HIPAA Privacy Rule compliance solution that works best within your organization. Our Checklist will “walk you through” the relevant statutory/regulatory sections of the HIPAA Privacy Rule, highlighting the policies, processes and tracking mechanisms required at a granular level.