Know about Compliance Webinar

Compliance with HIPAA regulations is more important than ever. With standards updated subsequently because of the HITECH Rule in 2009, there are more precautions to take into consideration, in addition to greater consequences for non-compliance than ever before. These updates apply not only primarily to Covered Entities, as was documented in the original HIPAA act, but also compels compliance from Business Associates. Any organizations that deal with Protected Health Information (PHI) in some way, shape or form may now be required to comply with HIPAA regulations.

HIPAA compliance can be an overwhelming process. Attending the Compliance Webinar will give your organization the overview of what it takes to be in accordance with HIPAA regulations. The webinar can help you determine what resources (staff, consultants, and automatic software tools) can help build the organizational infrastructure to handle HIPAA Compliance. With such infrastructure, compliance can turn from a burden to a process that is highly manageable and efficient.

During the webinar, experts will explain and elaborate on HIPAA, HITECH, Meaningful Use, and Omnibus. The process of risk assessments, tracking of incidents, managing paper trail, reporting of data, and managing concealed issues will all be addressed. We'll go through the various components of HIPAA, including the Privacy, Security, Enforcement, and Breach Notification Rule. In addition, the various Administrative, Technical, Organizational, and Physical safeguards required will be explained. This includes a host of issues: from ensuring security of the premises, making sure system passwords are secure, safeguarding that the right staff has access to the right data, tocertifying data is encrypted at all levels.

We can show you that compliance, with an effective and efficient infrastructure, can be more economical and less complicated than you believed. Not just that, doing so will mitigate the costs of non-compliance, which could be several times greater than what it would take to achieve compliance. Sign up today!

Read More

Policy Management Software

As organizations grow, they face a continuous increase in the number and complexity of policies and procedures that staff members need to share and collaborate with one another. This is one of the biggest challenges for organizations of all types and sizes. It involves demonstrating compliance to auditors and the best practices to staff. This is required not just at periodic intervals, but also continuously and instantly to a variety of stakeholders.

It is essential to have high quality policy management software to help a company to be on top of itself. Such software allows users to create and refine policies and procedures in compliance with standards that are relevant. When policies are not maintained properly, its value decreases and the policy loses its authority and relevance.

Increasing regulatory requirements these days necessitates organizations be proactive in their management of important documents. Having up-to-date policy reduces the chance of liability and demonstrates an organization is acting in solid governance to government authorities, outside organizations, and even itself.

Misplaced documentation (either through poor organizational structure or poor systems architecture) can cost an organization valuable time, energy, and resources. The easier it is for staff to find documents and update them in a distributed real-time manner, the easier it is to ensure that the most up-to-date information is at the fingertips of those who need it. It is very helpful to have a means of recovering information if portions of a company’s policies, procedures, and guidelines are missing or no longer relevant. This aids in the flexibility of an organization tobounce back on its feet during times of change or disarray.

An end-to-end policy management package ensures that the creation, preservation, and deletion of information in the documentation occur in a step-by-step procedural manner. This process should be free from obstacles such as interference from conflicting processes, confusion on what processes are involved, and confusion as to the roles and responsibilities of who updates what and is accountable for what. A good policy management system takes all of these factors into account, while delegating authority and authorship as needed.

A proper policy management system will not only save time and energy but ultimately the bottom line expenses. There are a countless number of lost work hours that result from creating, recreating, and updating an organization’s policy in an inefficient manner. A seamless process in this regard allows an organization to use human resources elsewhere by taking care of the overhead.

In summary, good policy management software helps an organization maintain rigorous control over its infrastructure, track usage, update, and assimilate various components distributed throughout the organization. It gives individuals in the company a solid means of tracking policy changes and ensuring that authority in updates is delegated, and escalated, to the right parties at the right time. It can continuously reduce ineffective workflows by tracking changes throughout the process without the stopping and backtracking associated with manual policy management.

Read More

HIPAA Compliance Checklist

Once you've concluded you are handling protected health information (PHI), you will have to ensure your organization is HIPAA compliant. Compliance with HIPAA requires going through a series of steps that, altogether achieved, ensure you are in-line with the regulations set forth by the Department of Health and Human Services for patient health records.

Compliance achievement can take the form of checklist that walks through the 4 sets of rules within HIPAA: The Privacy Rule, Security Rule, Enforcement Rule, and Breach Notification Rule. While it is beyond the scope of this article to provide a comprehensive breakdown, we will provide a basic overview of what such a checklist entails.

The Privacy Rule presents standards that protect health records that apply to various health care providers that conduct their transactions electronically. It involves preventing impermissible uses of the PHI, ensure breach notification procedures are in place, ensure appropriate access to the PHI, and provide disclosures to the Secretary of HHS as needed.

The HIPAA Security Rule ensures that various safeguards are in place on Technical, Physical, and Administrative levels. Some are designated as 'required', and others designated as 'addressable' (required for certain organizations).

Technical safeguards deal with: unique user identification, emergency access procedures, automatic logoff, encryption/decryption, audit controls, and authentication systems and methods. Physical safeguards deal with the physical location and the facilities themselves, including: contingency operations, security plans, access control, maintenance records, workstation use, workstation security, disposal of documents, accountability, and data backup/storage procedures.

Administrative safeguards cover the conduct of workers in the organization, and provide measures in place to protect PHI. It requires establishing a privacy officer, conducting staff training, review documentation on a regular basis, performing a risk assessment, creating agreements with the various Business Associates (BA) that partner with your organization.

The Enforcement Rule and Breach Notification Rule are not necessarily actionable in advance, but they spell out the penalties and procedures for hearings related to HIPAA non-compliance, as well as procedures for dealing with a breach of unsecured PHI.

Though seemingly daunting, the HIPAA compliance checklist rules can be applied and enforced in your organization in a systematic manner through a checklist. In addition, automatic tools can enhance the value of a checklist by having systematized procedures to bring your organization into compliance.

Read More

Introducing the HIPAA Omnibus Rule

New standards have been added to HIPAA regulations through the Omnibus Rule. These new additions address holes in the ability to access PHI (Protected Health Information) by those that are non-privy to such data. These standards ensure that "Covered Entities" follow these rules or deal with significantly harsher penalties.Covered Entities, Business Associates and their subcontractors are more liable for compliance lapses under the Omnibus Rule. Enacted on September 23, 2013,the Omnibus Rule has led to a dramatic increase in the cost and complexity for the maintenance of healthcare documentation, requiring even more precise auditing of systems and policies.

There are a variety of points that make up the new HIPAA Omnibus Rule, which include additional HITECH Act enhancements. During a breach of PHI the Covered Entity must notify eachindividual party whose information was breached, the Dept. of Health and Human Services, and media sources. The definition of a secure system is not simply having access or login protection. It requires the data to be thoroughly encrypted when breached, or automatically destroyed before it is accessed. In addition, the Omnibus Rule expanded the scope of what constitutes a breach to even limited sets of data that might contain certain fields.

The Omnibus Rule is an update to the Interim Final Rule published in August 2009 and involves the discarding of a 'harm threshold'. This threshold analyzed the risk of a potential breach's impact in determining the potential recourse for a Covered Entity. However, the Omnibus Rule voided this threshold, but instead presumes a breach unless certain specific factors are taken into account. This includes who the unauthorized person is, whether the PHI was viewed, and how it was acquired.

Sanctions for not providing the required notice are severe, with some state law requirements even more severe than federal laws. Thus, potential breach and all follow-up protocols should include a full analysis of both state and federal regulations.

The Omnibus Act also expands the definition of a Business Associate. Thus, the new BAA (Business Associate Agreement) must specify the general arrangement of data being exchanged in addition toaddressing the repercussions of a potential breach in the transfer of information between Covered Entities and Business Associates. The NPP (Notice of Privacy Policies) has beenmodified to include provisions for distribution, sale, and notification of breach to patients including special provisions for psychotherapy notes.

Penalties for lack of compliance to these rules include $100 per violation and $25,000 if the violation is identical in one calendar year. Privacy breaches have a far greater consequence, including penalties up to $1.5 million.

With the HIPAA Omnibus Rule in effect, it is even more imperative that Covered Entities and Business Associates take active steps in ensuring that their systems are protected, with protocols and audit tools in place to prevent even a seemingly minor PHI breach from occurring. To comply with these changes, both Covered Entities and Business Associates must make updates to their privacy practices, as well as perform an audit of all their policies and procedures on a regular basis.

Read More

HIPAA Omnibus Rule

The HIPAA Omnibus Rule was brought into effect on January 25, 2013. This was a set of rules that directly affected the Health Insurance Portability and Accountability Act in the areas of Security, Privacy and Enforcement. In a day in age where technology runs nearly everything, these provisions to HIPAA helped implement changes to the Health Information Technology for Economic and Clinical Health (otherwise known as the HITECH Act). These provisions protect patients' personal information more directly in today's high tech world.

One of the first things these provisions address is that under the HIPAA Omnibus Rule all associates of a business and all subcontractors of a business are directly liable for complete compliance with HIPAA. It also goes on to limit the use of personal information for the use of marketing purposes. These provisions also expand on the rights of individuals to receive copies of their medical records over the internet.

In times of a breach of privacy, the HIPAA Omnibus Rule and the HITECH Act increase the monetary penalties. Monetary penalties include:

• Accidental disclosure of personal information resulting in a penalty of no less than $100 but no more the $50,000 for each case
• For disclosure due to reasonable cause and not pure neglect resulting in a penalty of no less than $1,000 but no more than $50,000 for each case
• For disclosure due to neglect but fixed in a timely fashion resulting in a penalty of no less than $10,000 but no more than $50,000 for each case
• For disclosure due to neglect that is not fixed in a timely manner resulting in a penalty of $50,000 but no more than $1.5 million per year for each case

Any known use or disclosure of personal information is considered to be a breach of the HIPAA.

The HIPAA Omnibus Rule was brought in to effect to further cover and protect patients' personal information. All healthcare officials and individuals in the healthcare field must be properly educated on the HIPAA Omnibus Rule and practice it to avoid monetary penalties. 

Read More

Compliancy Group promotes The Guard for better compliancy within an orga...

Read More

Why your organization and its team members should attend compliance webinars ?

Compliance has become a buzzword for organizations both large and small.  The main issue with companies and organizations trying to adhere with all regulatory compliance is that both compliance and the HHShave no bias.  Yes, compliance doesn’t care if you have a full time compliance officer, a million dollar budget or absolutely no idea what you are doing.

There are always tons of options regarding ways to educate yourself about compliance. However,most of these options will only focus on a textbook way of achieving compliance education and can be costly.  In our free compliance webinar series, we strive to not only find industry experts, but also to focus on relevant topics that pertain to the compliance industry and what you need to know.

Here at Compliancy Group, we are aware of the gaps in compliance knowledge as a whole and how this can effect an organization of any size.  This is why we decided to create our free education series where the focus revolves around supplying a wide range of compliance webinars.Most importantly, knowledgeable speakers who have expertise in their fields ranging from HIPAA compliance to health care law carry out these compliance webinars. Past topics of compliance webinars have included: HIPAA, HITECH, Meaningful Use, the Omnibus Rule, Business Associates, HIPAA Compliance Checklist, and much moredemonstrated by speakers such as: Frank Ruelas, Matt Fisher, and Bob Grant.

Read More