Road Map to HIPAA Compliance
Overview:
The webinar will explain the process for covered entities and business associates to initially come into HIPAA compliance and to stay compliant. It will demonstrate the following: who should be involved in the compliance effort; how to assess the degree of compliance at the beginning of the process through a gap analysis; the steps to achieve compliance, including risk analysis, development of policies and other documents, and required training; how to assess whether compliance was reached; and how to ensure that the entity remains compliant, including what to do if a HIPAA violation occurs.
Why should you attend: The majority of the DHHS civil money penalties and settlements in lieu thereof involve, sometimes with other violations, failure to perform a written risk analysis, failure to develop required policies, and failure to conduct adequate HIPAA training. These penalties usually are in the seven-figure range.
Failure to conduct a written risk analysis, adopt required policies, or conduct required training qualifies as "willful neglect," which carries the highest civil money penalty ("CMP") and which penalty cannot be waived by DHHS as can violations due to a reasonable cause.
DHHS entered into a settlement with Massachusetts General Hospital for $1 million for a breach involving leaving paper PHI records on a subway. The sanction was because Massachusetts General had not trained its workforce on proper security for PHI taken offsite and did not have a work-at-home policy. Significantly, HIPAA does not even mention working at home, much less specifically require such a policy.
Another civil money penalty, this time for $4.3 million, involved failure to provide patients their HIPAA right of access to their medical records.
Thus, having a good process to ensure compliance with all of HIPAA's requirements, both stated and implied ones, is crucial to protecting patients and avoiding HIPAA's severe penalties.
Areas Covered in the Session:
- Identify who should be involved in the process
- Conduct a gap analysis
- Conduct a written risk analysis
- Assemble a good team
- Identify assets
- Identify risks
- Quantify risks
- Select reasonable, appropriate, and cost effective security measures
- Test and revise security measures
- Appoint key personnel
- Identify and adopt required policies and procedures
- Identify the need for and conduct required training
- Identify the need for and adopt other required documents, such as business associate agreements, consents, authorizations, notices of privacy practices, and the like
- Ensure that patient rights are properly afforded
- Periodically audit the state of your compliance and make required adjustments
- Questions and answers
Who Will Benefit:
- HIPAA Compliance Officers
- HIPAA Security Officers
- HIPAA Privacy Officers
- CFOs
- CIOs
- Business Office Managers
- Medical Records Personnel
- Billing Services