Businesses operating in the U.S. healthcare sector are required to comply with the data privacy and security regulations first defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The purpose of HIPAA legislation is to protect the privacy and security of an individual’s health-related information.
When HIPAA was passed, its primary concern was with safeguarding physical records containing protected health information (PHI). Subsequent updates to HIPAA regulations address the way the privacy and security of electronic protected health information (ePHI) are implemented.
In a perfect world, organizations would protect patient privacy and data security because it’s the right thing to do. Unfortunately, the market does not always operate in that way which was the reason HIPAA was necessary in the first place.
How Much Does HIPAA Noncompliance Cost?
Without the ability to levy fines and penalties, HIPAA would be an instructive but toothless set of standards. Fines for HIPAA violations can be issued by the Department of Health and Human Services’ Office for Civil Rights (OCR) or state attorney generals.
The OCR issues civil fines directly related to HIPAA violations whereas in many cases, attorney generals enforce equivalent state standards. It can be easier to hold violators accountable with state laws and the financial penalties available can be greater than those imposed by HIPAA. In rare cases, criminal charges can result from activities such as the theft and use of PHI for financial gain.
Not all HIPAA violations lead to financial penalties. In some cases, especially when dealing with minor violations predicated by a misinterpretation of the rules, the OCR prefers organizations to adopt the necessary measures to comply voluntarily. When this tactic fails, the OCR has the authority to impose penalties on covered entities and business associates.
The costs of HIPAA noncompliance fall into two distinct categories.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that mandates the creation of national standards to protect delicate and private patient medical history and health information from being disclosed to other parties without their knowledge.
HIPAA focuses on patient privacy, record keeping, and employees in the medical field. It is a landmark piece of information for every player in the healthcare industry and had a lot to offer everyone in the healthcare industry and patients.
Why Is HIPAA Important?
HIPAA is the law, and the penalties for breaking this law can be severe. Violations of this law can lead to fines of up to $25,000 per every record compromised. All players in the healthcare industry, including business associates, are required to abide by this law.
The law helps prevent fraud in the healthcare industry and ensures that every piece of health information is secured, and restricts access to health-related data to unauthorized individuals. Introduced in 1996 and enacted in 1997, HIPAA’s first most important order was to make sure employees continued to receive health insurance coverage when they are between jobs.
The HIPAA law later moved on to handle standardized medical record-keeping and patient privacy.
Why is HIPAA Important In the Healthcare Field?
The law introduced a transition from paper records to electronic records of health information. Before HIPAA, it was not unusual to see patient’s health records, x-rays, or photographs lying around an office for everyone to see.
Courier services could deliver paper records between hospitals or offices, and one mishap could reveal embarrassing photographs or patient information that should have been kept private. The transition to electronic records makes patient records more secure, confidential and minimizes the risk of losing vital information.
When it comes to patient’s privacy, some of the questions that one can ask are, should a billing clerk be able to pull up a patient’s height, weight, and family medical history? Does an imaging technician need to view blood test results? The answer is no.
The Healthcare Insurance Portability and Accountability Act (HIPAA) was adopted in 1996. It seeks to ensure the secure management of healthcare information and outlines guidelines that all healthcare organizations and employees must follow to manage protected healthcare information (PHI). Under HIPAA, PHI is any information that can be used to identify an individual, including:
Contact information
Demographic information
Lab test results
Insurance information
Medical history
As technology continues to evolve, the risks facing PHI also grow. It’s now more important than ever for players in the healthcare industry to comply with HIPAA to avoid costly penalties. To understand the significance ofHIPAA compliance, it’s best to revisit past cases relating to violations. These cases will provide crucial lessons on how to avoid common HIPAA-related mistakes.
Case #1: Allergy Associates of Hartford, Conn.
Hartford-based Allergy Associates was fined $125,000 after a patient complained to the Department of Health and Human Services about the disclosure of her PHI by a physician at the facility to a reporter. An investigation revealed that the physician disregarded advice from the hospital’s privacy officer not to respond to the media regarding claims that the woman had been turned away from the facility for bringing along her service animal. Following the disclosure, Allergy Associates failed to take any corrective or disciplinary action towards the physician.
Lesson Learned
Allergy Associates should have disciplined the physician besides taking corrective action to prevent similar incidents from occurring. Had it done so, the facility would probably not have been penalized. This highlights why healthcare entities should take immediate remediation action when such incidents occur and hold employees responsible for their behavior. Likewise, employees should be trained on media protocols to ensure that PHI is not intentionally or unintentionally disclosed to the media as it happened with Allergy Associates.
By Devin Partida, technology writer and the Editor-in-Chief of the digital magazine, ReHack.com
The coronavirus pandemic has caused massive changes around the world. As people adjust to the new normal, they may notice some differences associated with COVID-19 and telehealth. Here’s an in-depth look at those changes.
Telehealth adoption rising
United States government officials announced changes in mid-March that dramatically increased access to telehealth in the nation. The changes included allowing providers to use everyday technologies to connect with patients, offering more telehealth treatment coverage to Medicare beneficiaries and making such options available at lower costs than traditional appointments.
The increased access and provider flexibility are temporary, intended to remain only for the duration of the country’s health emergency. However, some people believe the changes could bode well for telehealth in general, such as by giving adoption of the technology a sustained boost.
Analysts at Frost & Sullivan predict a 64.3% year-over-year growth increase for the telehealth sector this year. The researchers mentioned the need for social distancing as a central factor influencing the surge. However, they cautioned that the telemedicine industry contains an ecosystem where numerous parties affect adoption rates and healthcare compliance standards.
Medical practices can increase income through telehealth visits
Many people avoid face-to-face treatments now due to the risk of virus transmission. However, even before COVID-19 became a threat, people faced other obstacles that made in-person care more complicated, such as a lack of transportation or mental health struggles that made them nervous in public.
Jason Popp, a partner at Alston and Bird’s healthcare litigation group, pointed out how making telehealth more accessible introduces more revenue streams for medical facilities: “When the pandemic started, physicians in practices were seeing big changes because they couldn’t see patients anymore.”
Popp continued, “Now they’re quickly adapting to the change. Otherwise, they’ve got limited revenue because patients aren’t coming to clinics or certain facilities. It’s been a bit of a wake-up call to practitioners who were previously kind of opposed to telehealth. Now they’re seeing there are immense benefits. After the pandemic, many will continue to provide telehealth.”
A temporary telehealth waiver connected to the coronavirus pandemic expands access to people beyond rural areas. Popp viewed that regulatory change as the most significant and hopes Congress will eventually make it permanent. Other parties familiar with telehealth say the sector is scaling up so rapidly that reverting to pre-COVID-19 healthcare compliance standards would prove difficult.
By Rob Wiley, head of marketing and product strategy, Formstack.
Rob Wiley
If you’re in healthcare, it’s likely because you have a passion for helping others and solving problems. Those on the IT side of the industry are no exception. Healthcare IT has seen a significant shift from navigating health records in a paper-based system to the digitization of health data—and for good reason.
There are many benefits to digital transformation in the health industry. For one, administrative costs alone in healthcare account for nearly $266 billion per year. By transferring records like medical forms and insurance verification paperwork to a secure electronic platform, healthcare providers can save on administrative spending and put those funds into more impactful areas. Additionally, the digitization of health data streamlines communication between all levels of the healthcare process: from physicians to patients and insurance companies.
But the digitization of health data also comes with challenges that healthcare IT professionals must solve—most notably around the implications of Health Insurance Portability and Accountability Act (HIPAA) compliance, patient engagement and employee empowerment.
HIPAA Compliance
Rules and regulations in healthcare are ever-changing, and health providers and practices are expected to stay up-to-date and comply. Ensuring your company maintains compliance and data stays secure begins with your healthcare IT team. Not only does compliance protect your company from stiff penalties and violations, it also safeguards the protected health information (PHI) of customers and partners.
Consider this: A patient is asked to share interest in an elective surgery and decides to opt out. If this document confirming their disinterest in the surgery is stored insecurely using a paper file, this puts the patient’s trust at risk of being breached, and in turn, the decision to opt out of the procedure at risk of being dishonored. Meanwhile, storing this information in a secure, electronic file would reduce the risk associated with data breaches and the file being lost or misread. With a strong IT team following HIPAA guidelines, your practice can stay safe from violations and accidental exposure of sensitive records in the digital world of healthcare.
Patient Engagement
The digital transformation of healthcare doesn’t just impact the backend of business; it also affects patient experience and how practices are represented to future customers and partners. Healthcare IT professionals have to consider how digitization impacts the user experience and the ease of electronic communication between patient and practitioner. Here are seven important questions healthcare IT teams should ask themselves when evaluating their current digital network and any future improvements:
What systems are patients interacting with when preparing for or during the visit?
How easy is it for patients to provide information to their health provider?
How long does it take for the patient to fill out the intake documentation?
Are patients required to enter duplicate information anywhere?
Is the process convenient for the patient? Are they able to complete the information when and where they would like?
Is there an option to sign electronically and securely?
Does the patient receive copies of their documents for their own record keeping?
Healthcare IT professionals should consider the answers to these questions to determine the top changes they need to make to their digital system in order to improve patient experience and, ultimately, increase the number of patients they serve.
The rapid digitalization happening in healthcare promises to streamline patient care and the availability of patient information.
Overall, advancements in technology fueling this are a step in the right direction. That said, there are side effects to this trend that put sensitive patient data at risk.
Healthcare organizations are rife with sensitive personal data, ranging from health records to social security numbers, birth dates, and addresses. This makes them an appealing target for cybercriminals looking to steal and profit from that information. One recent survey reports that the majority of hospitals (82 percent) have had a significant security incident in the past year.
Healthcare organizations must protect sensitive patient data as mandated by theHealth Insurance Portability and Accountability Act(HIPAA), the regulatory framework for the healthcare industry. As breaches continue to rise, healthcare providers and others in the industry must understand how to properly secure this sensitive data.
Here are three ways to ensure HIPAA compliance with patient privacy.
Ensure Technical Safeguards are in Place
Healthcare organizations must protect sensitive patient data from external and internal threats. While digital health records may improve efficiency, this electronically protected health information (ePHI) must be kept safe via technical safeguards.
This includes access and audit control requirements that determine access control capabilities for all information systems that have ePHI and ensuring that activity within these systems can be traced back to specific users. Organizations also need formal policies for access control.
Authentication and integrity are also critical, meaning that healthcare organizations must protect ePHI from being altered or destroyed and must also secure that data while stored at rest. Authentication can be accomplished via digital signatures, checksum technology, and error-correcting memory.
Data in motion must also be secured, especially with the proliferation of electronic medical records (EMR) and health information exchanges (HIEs). Healthcare organizations must be able to securely transmit patient medical records between facilities.
Apply Administrative Safeguards
Healthcare organizations bear responsibility for both Protected Health Information (PHI) and Personally Identifiable Information (PII), which requires the proper categorization of each type of data. Each type of data requires its own unique treatment, making it paramount that the information is properly classified.
Administrative safeguards break down into the following categories:
Security management process
Assigned security responsibility
Workforce security
Information access management
Security awareness and training
Security incident procedures
Contingency plan
Evaluation
These areas help organizations implement policies and procedures to guide employees in the proper care and use of ePHI. This may include security training requirements along with a delegation of security responsibilities within an organization.
Prepare for Compliance Audits
It may sound obvious, but preparing for and submitting to compliance audits on a regular basis can help healthcare organizations stay in check and avoid expensive HIPAA fines. By employing a feedback loop based on the results of reviews, organizations can inform future decisions regarding security. Organizations should be conducting internal reviews ahead of scheduled audits to go over daily logs and to seek out anomalies, errors, and other suspicious activity that could signal a threat.
More than simply scanning for these anomalies, organizations must also have an appropriate and measured response mechanism in place. The ability to quickly respond to security issues is incredibly important and requires documentation and training.
This new digital environment makes for exciting new opportunities in the healthcare space. Unfortunately, it also brings with it new threats and security concerns that must be addressed. HIPAA compliance requires a comprehensive strategy to protect PHI and PII, including the right technology, the right safeguards, and the right training.
Cloud technology application in healthcare is not new. Back in 2015, we created a post on cloud usage in healthcare, where we researched this topic and predicted that we will see the growth of this industry. And now in 2019, we see that we were right. Let us see what as changed in this area with time.
What are the benefits of using cloud technology in healthcare?
Although not yet fully implemented, cloud computing is popular with healthcare because it offers a lot of positive features that are essentials for improving the medical industry.
Improved data management and storage
It goes without saying that the healthcare industry deals with a lot of data that needs to be stored somewhere. And cloud data storage capacity is one of the biggest advantages of adopting cloud technology in this industry. Plus, keeping records on the cloud allows analyzing the data, which in its turn can help prevent major disease outbreaks.
Mobility and speed
For hardware servers, we run a speed test to verify if the connection is speedy enough, but it is a fact that cloud computing offers faster connection and access to required information, which oftentimes is key in healthcare. Additionally, storing data on the cloud allows healthcare professionals to be able to access it from anywhere at any given time. It also enhances more efficient collaboration between them, as information is synchronized in real-time. This way doctors can easily view samples, lab results, and share notes, which significantly improves patient care.
Lower cost
Compared to supercomputers, cloud computing costs far less. Also, upgrades of any of the various features of cloud tools are both faster and cheaper than those done for hardware solutions.
Challenges and risks of cloud application in healthcare
Even though cloud technology has many advantages for healthcare, nevertheless, there is a number of risks and challenges that slow down the transition process to the new system completely. The biggest ones of them are the following:
HIPAA compliance
Whatever cloud solution healthcare organizations decide to use, it must be compliant with the Health Insurance Portability and Accountability Act (HIPAA) for secure data portability. It means that these principles should not only be understood and followed by medical facilities, but by cloud technology vendors as well. However, there are many cloud providers on the market now who offer HIPAA compliance.
The data backup plan was established as a mandatory stage of HIPAA compliance to create, implement and maintain a set of rules and procedures for healthcare organizations to follow when managing the backup and restore requirements of electronic protected health information (ePHI). A data backup plan is part of the HIPAA Security Rule and encompasses wider contingency planning processes that any chosen business associate (BA) or managed service provider (MSP) must be able to demonstrate a compliant backup service capable of backing up and restoring exact copies of healthcare data when required.
The data backup plan should be integrated within a wider contingency plan because it is designed as a failsafe for the protection of patient data. Most MSPs will already be offering disaster recovery technology capable of moving over data and services to a secondary location almost instantaneously. But backups are often considered the last line of defense in the event of a catastrophic system failure. It allows for data restoration capability to be available in the worst possible scenarios.
The Health Insurance Portability and Accountability Act
The rapid digitalization happening in healthcare promises to streamline patient care and the availability of patient information.
Cloud technology application in healthcare is not new. Back in 2015, we created a 