Data Breach – Page 26 – RISC Management and Consulting

In a world of inflated and confusing job titles, a “privacy and security officer” is neither pretentious nor inconsequential – for health care providers, such an officer is crucial.

All health care providers have HIPAA-mandated responsibilities to ensure the adequate protection of individually identifiable health information and are required to officially designate both a Privacy and Security officer.

Among the provisions of the Health Insurance Portability and Accountability Act of 1996, commonly referred to as HIPAA, are specific requirements for handling patients’ health information in all its forms: Electronic, paper and oral.

These rules govern how pharmacies, physicians offices, clinics, life insurers, hospitals, dentists, and all their business partners – including billing agencies, information system providers and even employers — handle patient information designated as Protected Health Information (PHI).

It’s an onerous task ensuring patient privacy and so important that the law requires covered providers to designate both a privacy officer and a security officer on their staff.

Here are some of the responsibilities of a good HIPAA privacy and security officer:

Documents why and where security measures exist, how they were created and how they are monitored.
Keeps essential records regarding a health care provider’s or business associate’s policies in the event of a HIPAA audit or other audit of electronic health records, or a security survey from a business partner.
Compares current security measures to industry standards in safeguarding patient health information.
Develops an action plan for addressing risks and vulnerabilities. In many cases, basic security measures can be highly effective and affordable. Look for “low hanging fruit”, but ensure that a well-documented, consistently updated, and management-accountable project plan is in place to address all gaps and periodic requirements. HIPAA has a significant quantity of periodic requirements!
Develops written policies and procedures about how your organization protects patient’s, or member’s privacy and security, and keeps those records up to date.
Trains your staff on proper handling of all forms of PHI.
Communicates with patients and members and responds to requests and complaints. The Officers should regularly review the Notice of Privacy Practices (NPP), and update it as required, for example, the recent Omnibus Rule required every Covered Entity to update their NPP. The Officers must also be the primary points of contact for patient or member complaints, OCR communications, and questions from members of the organizations workforce.

Privacy and security officers can, and should, do much more, too, including working with your vendors and monitoring business associate compliance, monitoring rule changes and applying for incentive programs.

Please contact RISC Management if you need assistance filling an interim gap, getting a new Privacy or Security Officer up to speed, or assessing a business associate or your own practices. www.RISCsecurity.com 800.648.4358

When a thief broke into “Breaking Bad” star Bryan Cranston’s car earlier this year and took his iPad and a script from the show’s coming season, the media seized on the potential secrets that had been leaked.

For health care providers, secret leaking can have far more serious consequences than making the news on “Entertainment Tonight” or bad TV ratings; violating patients’ rights to privacy can mean literally millions of dollars in fines.

A Massachusetts medical care provider was ordered last fall to pay the federal government $1.5 million to settle potential violations of the Privacy and Security Rules of 1996’s Health Insurance Portability and Accountability Act (HIPAA).

The case began when a laptop with unencrypted, protected health information – including prescriptions and clinical data – was stolen.

In announcing the settlement, the Department of Health and Human Services stated that Massachusetts medical care provider had “failed to take necessary steps to comply with requirements of the HIPAA Privacy and Security Rule, such as conducting a thorough analysis of the risk to the confidentiality of electronic protected health information (ePHI) maintained on portable devices, implementing security measures sufficient to ensure the confidentiality of ePHI that [the firm] created, maintained and transmitted using portable devices, adopting and implementing policies and procedures to restrict access to ePHI to authorized users of portable devices, and adopting and implementing policies and procedures to address security incident identification, reporting, and response.”

Proper security protocols can ensure your firm protects the privacy of your patients and stays on the good side of the Department of Health and Human Services.

Have questions or concerns? RISC Management and Consulting can help. Contact us today.