Rather than asking, “What has changed for your business in the healthcare realm this year?” the better question might be, “What hasn’t changed?”
The Affordable Care Act, premium increases, existing policy cancellations, enrollment period confusion, continuing IT problems with the HealthCare.gov website…Each of these minor healthcare earthquakes has shaken the small business community to its core.
Add in constant worries about data security and IT functionality and it can be enough to drive a business owner mad. But there’s one feature of the healthcare landscape that represents an even more critical decision: new HIPAA rules, regulations, and compliance requirements.
If your business has any contact with electronic health records or medical information, either as a Covered Entity (CE)—healthcare provider, health plan, or healthcare clearinghouse—or a Business Associate (BA)—any vendor or subcontractor that helps a CE carry out its activities and functions—HIPAA compliance should be of the utmost importance for you.
Why? The Following 10 Reasons Provide a Good Start:
1) The HITECH Act and HIPAA Omnibus Rule have substantially increased civil penalties for non-compliance. The penalty cap for HIPAA violations was increased from $25,000/year to $1,500,000/year per violation. Willfully ignoring or failing to be compliant means mandatory investigations and penalties can be initiated by any complaint, breach, or discovered violation.
2) New Breach Notification rules will increase the number of HIPAA violations determined to be breaches. The HIPAA Omnibus Rule expands the definition of a breach and the consequences of failure to address it properly. Providing proper notification can trigger federal investigations and eventual fines and penalties.
3) The mandated deadline for new HIPAA compliance rules has already passed. All Covered Entities and Business Associates were required to update their HIPAA policies, procedures, forms, and Notices of Privacy Practices by Sep. 23, 2013.
4) All Covered Entities must have documented policies and procedures regarding HIPAA compliance. Recently, a dermatology practice in Concord, MA, learned this lesson the hard way, getting slapped with a $150,000 fine for allowing the health information of just 2,200 individuals to be compromised via a stolen thumb drive. The company also had to incur the cost of implementing a corrective action plan to address Privacy, Security, and Breach Notification rules.
5) Business Associates are now required to be compliant with HIPAA Privacy and Security Rules. Business Associates will be held to that standard by Covered Entities, who are now responsible for ensuring their BAs are compliant.
6) While Meaningful Use incentives for Electronic Health Records (EHR) are optional, HIPAA compliance is not. If you manage Protected Health Information (PHI), you must comply with federal regulations or face substantial civil and criminal penalties. If a Covered Entity accepts Meaningful Use funding, a Security Risk Analyze is required—and any funding may have to be returned if adequate documentation is not provided upon request.
7) The Department of Human & Health Services (HHS) Office of Civil Rights (OCR) is expanding its Division of Health Information Privacy enforcement team. The federal bureau is stepping up hiring for HIPAA compliance activities calling for professionals with experience in privacy and security compliance and enforcement.
8) State Attorney Generals are getting involved in HIPAA enforcement. HHS has even posted HIPAA Enforcement Training for State Attorneys General agendas on its www.HHSHIPAASAGTraining.com website.
9) HIPAA compliance requires staff privacy and security training on a regular basis. All clinicians and medical staff that access PHI must be trained and re-trained on proper HIPAA procedures. Documentation of provided training is required to be kept for six years.
10) Protecting your practice means avoiding the HIPAA “Wall of Shame.” The list of healthcare organizations reporting major breaches and receiving substantial penalties is growing at an alarming rate. The details of these breaches are widely available to the general public—and widely reported in the media.
The consequences of a healthcare-related data breach can include not just civil and criminal penalties but also damage to your company’s reputation. As a fellow small business that’s worked hard to come in line with HIPAA requirements, CMIT Solutions understands your business investments are too valuable to risk because of HIPAA noncompliance.
We offer real solutions—Privacy and Security Risk Assessments, data encryption tools, employee policies and procedures, and ongoing training programs—that can deliver positive outcomes and an unparalleled level of care. Contact CMIT Solutions today to find out how our HIPAA-Compliant Managed Services can go to work for your business.