HIPAA Security Rule - AUDIO

HIPAA Security Rule : 

Manageable Step by step guide to e-phi Important information every provider must know before the auditor arrives HIPAA Security Rule

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI HIPAA – Health Insurance Portability & Accountability Act HIPAA was enacted by the U.S. Congress in 1996 This Act is massive in scope with five separate Titles Title II of HIPAA is known as the Administrative Simplification provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, employers and the AS provisions also address the Security and Privacy of health data. The provider compliance date for the Security Standards was April 20, 2005.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI Five Titles of HIPAA Title I, "Health care access, portability and renewability," requires employers and health plans to allow a new employee's medical insurance coverage to remain continuous without regard to pre-existing conditions. Title II, "Preventing health care fraud and abuse; administrative simplification; medical liability reform," defines new requirements for privacy and security of individually identifiable patient information. Title II, "Administrative simplification," Subtitle F, reduces the administrative component of health care costs through the implementation of electronic data interchange (EDI) standards primarily by embracing ASC X12N transaction formats. Title III, "Tax-related health provisions," standardizes the amount you can save per person in a pre-tax medical savings account. Title IV, "Application and enforcement of group health plan requirements," broadened information on insurance reform provisions and provides detailed explanations. Title V, "Revenue offsets," has regulations on how employers can deduct company-owned life insurance premiums for income tax purposes.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI The Privacy Rule deals with Protected Health Information in general, whereas the Security Rule deals with Electronic Protected Health Information (e-PHI) ARRA - American Recovery & Reinvestment Act ARRA HITECH Act is concerned with defining the requirements for being compatible with the Security and Privacy regulations of the Privacy Rule.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI WHY NOW On February 17, 2009 the American Recovery & Reinvestment Act was signed into law by president Obama (ARRA). Within this Act the administration is pushing for a national health care infrastructure, this will effectively create all medical/health records to be stored and transmitted between health care providers electronically. This brings a new audit focus to the Security Rules.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI HITECH Health Information Technology for Economic & Clinical Health Act The HITECH Act can be understood as a regulatory measure that has been introduced in anticipation of the sudden rise in the volume of healthcare practices adopting EHRs due to lucrative financial incentives offered by the ARRA. Due to the implementation of the HITECH Act, all healthcare facilities and covered entities who consider themselves eligible for receiving these financial incentives are ensuring that they are full compliant with the HIPAA benchmarks or they face the risk of not only losing out on the financial rewards but attracting civil or criminal liabilities. http://whatishipaa.org/emr-certification-hitech-meaningful-use.php

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI WHO ANY PROVIDER who has electronic storage and transmission of patient information. This is a very broad sweeping scope – If you provide Health Care, which can be defined as Services, or Supplies related to the health of an individual, Sale or Dispensing of Drugs, Device, Equipment, or other item in accordance with a Prescription. If you have Patient Health Information in your computer system – YOU need to follow the HIPAA e-PHI Standards

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI PENALTIES Type of Offense: Person did not know (and by exercising reasonable diligence would have known) that the person violated HIPAA Minimum: $100 per violation, with an annual maximum of $25,000 for repeat violations Maximum: $50,000 per violation, with an annual maximum of $1.5 million Type of Offense: Violation due to reasonable cause and not willful neglect Minimum: $1,000 per violation, with an annual maximum of $100,000 for repeat violations Maximum: $50,000 per violation, with an annual maximum of $1.5 million Type of Offense: Violation due to willful neglect but violation is corrected within required time period Minimum: $10,000 per violation, with an annual maximum of $250,000 for repeat violations Maximum: $50,000 per violation, with an annual maximum of $1.5 million Type of Offense: Violation is due to willful neglect and is not corrected Minimum: $50,000 per violation, with an annual maximum of $1.5 million Maximum: $50,000 per violation, with an annual maximum of $1.5 million

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI § 164.308 Administrative safeguards. (a) A covered entity must, in accordance with §164.306: (1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations. (ii) Implementation specifications: (A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity. (B) Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a). (C) Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity. (D) Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. This is a very small sampling of what the Security Rule Standards look like. The Standards in this rule are very technical and impossible to decipher unless your have the skills and knowledge of an IT Specialist (Information Technology)

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI What Our Guide Provides Every Standard in the HIPAA Administrative Simplification Regulation Text regarding e-PHI has been designed so you, the covered entity, can produce your own e-PHI Manual using easy to follow guidelines. All Standards have an “example” page of each policy & procedure along with a template for you to customize that policy & procedure.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI There is not a “One Size Fits All” answer to the Security Rule, however this Guide will provide you with explanations of each Standard in easy to understand terms. Having this Guide to follow will eliminate hours for you or an IT person, in trying to decipher what the Administrative Simplification Regulation Text (which contains all the Security Rule Standards) is requiring you to do to be in e-PHI compliance.

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI Each “Standard” and “Purpose” of the Standard has been defined using “layman’s terms”. Easy to follow icons lead the way.   Companion logs have been designed to document necessary training, follow-up and electronic equipment inventory.   In today’s world of electronic media, the integrity of your e-PHI requires the upmost vigilance to maintain the security of your company and the security of your patient’s information.

: 

Manageable Step by Step Guide to e-PHI : 

Manageable Step by Step Guide to e-PHI HHS Wall of Shame As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.

Manageable Step by Step Guide to e-PHI : 

Compliance was April 20, 2005. HIPAA’S Security Rule only applies to electronic protected health information that a covered provider creates, receives, maintains, or transmits. The purpose of the Security Rule is to require covered entities to protect against reasonably anticipated threats or hazards, and improper use or disclosure of e-PHI. Please see our Website for more information regarding our Manageable Step by Step Guide to e-PHI. www.SLAConsultingGroup.com Manageable Step by Step Guide to e-PHI