1 You Probably Don t Even Know That You Need To Comply With HIPAA In Collaboration With:
2 About ERM
3 About The Speaker Stephen Siegel, Esq., Of Counsel, Broad and Cassel Board Certified Health Law Over 25 yrs. experience in private practice + 10 yrs. with CMS' predecessor agencies Practice includes regulatory compliance and HIPAA- HITECH compliance Member of Health Law and White Collar Defense/Compliance Practice Groups JD, Georgetown University Law Center
5 About Broad and Cassel Practice Areas include: -Banking -Housing - Commercial Litigation - Intellectual Property -Computer& Tech. Law - International Law - Corporate and Securities - Real Estate -Elder Law - Labor and Employment - Government Relations -Taxation -Health Law - Trust and Estates - White Collar Defense & Compliance
6 If I m Not A Health Care Provider Why Is This Relevant To Me?
7 Objective of HIPAA-HITECH Protect an individual's "protected health information" ("PHI") that becomes subject to an electronic "transaction" PHI belongs to the individual, NOT the business Covered Entities and Business Associates are viewed as having a fiduciary duty to protect the security and confidentiality of each individual's PHI
8 Critical Date September 24, 2013 HIPAA-HITECH* EFFECTIVE FOR BUSINESS ASSOCIATES IMPOSES MOST OF THE OBLIGATIONS OF COVERED ENTITIES ON THEIR BUSINESS ASSOCIATES * (Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2010)
9 What types of information is considered PHI? PHI is information that is individually identifiable and related to: The individual s past, present or future physical or mental health or condition, The provision of health care to the individual, The past, present, or future payment for the provision of health care to the individual. NOTE-PHI is NOT determined in relationship to a payer, it is determined by its relationship to the individual
10 PHI - Examples Social Security Number Name Address Telephone Number Zip Code Diagnosis, Plan of Care Provider's Identity Credit Card Number Spouse's Identity Date of Birth
11 What is a transaction? "Transaction means the transmission of information between two parties to carry out financial or administrative activities related to health care", including: Health care claims/encounter information; Health care payment and remittance advice Coordination of benefits Claims status Enrollment/disenrollment status in a health plan Referral certification and authorization Health care electronic funds transfers
12 Understanding your role Are you a Covered Entity ( CE )? Are you a Business Associate ( BA )? NOTE: If the answer to both questions is "no", HIPAA-HITECH does not apply* *But do not forget state privacy laws and other federal laws regarding protecting information that may be applicable
13 Covered Entities Health Care Providers "A provider of medical or health services and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business." "Health care means care, services or supplies related to the health of an individual", including, but not limited to: Preventive, diagnostic, rehabilitative, maintenance or palliative care." Examples: hospitals, physicians, medical equipment suppliers, nursing homes Health Plans Clearinghouses CEs should have been complying with HIPAA before 9/24/13
14 Business Associates Person or entity who, on behalf ofa Covered Entity- Creates, receives, maintains or transmits PHI for a function or activity regulated by HIPAA-HITECH including Claims processing/administration, data analysis, utilization review, quality assurance, patient safety, billing, benefit management, practice management, etc.
15 Business Associates - Examples Billing service Claims processing Administrative service Computer software vendor Medical record storage Business equipment vendor Cloud storage vendors Accountants Lawyers Consultants
16 Business Associate Agreement ( BAA ) If a CE engages a BA the CE musthave a written business associate agreement ("BAA") The BAA must requirethe BA to comply with the Rules requirements for protecting the privacy and security of PHI BAs are directly liablefor compliance with certain provisions in the HIPAA-HITECH Rules. BAs need BAAs with sub-bas
17 Business Associates Who is considered a BA under the Rules? Persons or organizations outside the CE s workforce (i.e., independent contractors and their subcontractors) that provide services which include the creation, maintenance, use or disclosure of PHI on behalf of a CE that has been the subject of an electronic transaction.
18 The Breach Notification Rule What happens if an unauthorized party gets PHI? HIPAA-HITECH requires CEs to provide notification following a breach of unsecured PHI. Pre- HITECH presumption of no harm discarded in HIPAA- HITECH NOTE: PHI that is encrypted is notunsecured and thus not subject to breach notification requirements.
19 The Breach Notification Rule (Cont.) What is a breach? A breach is an impermissible acquisition, access, use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. An impermissible acquisition, access, use or disclosure of PHI is presumed to be a breach unless the CE can demonstrate that there is a low probability that the PHI has been compromised.
20 The Breach Notification Rule (Cont.) A low probability that the PHI was compromised is demonstrated via a comprehensive and documented risk assessment. If the CE/BA can establish through its risk assessment that there is a low probability that the PHI was compromised, breach notification is not required.
21 The Breach Notification Rule If you are a CE or BA here are some likely data breach sources: smart phones thumb drives unsecure vendors tablets archives hard drives gossip laptops hackers CDs or DVDs digital cameras digital dictation cloud storage unhappy employees
22 Conducting a Risk Assessment After a breach evaluate at least the following 4 factors: a. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification. b. The unauthorized person who used the PHI or to whom the disclosures were made. c. Whether the PHI was actually acquired or viewed. d. The extent to which the risk to the PHI has been mitigated. -The extent and efficacy of the mitigation may depend on the recipient; was it a BA or CE or a third party?
23 The Breach Notification Rule (Cont.) The burden is on the CE/BA to demonstrate that a breach has not occurred and notification is not required. The risk assessment must be thoroughly documented. In lieu of a risk assessment, the CE can choose to simply notify the individuals whose PHI was improperly used or disclosed as well as the press and HHS-OCR (as required).
24 Who must be notified of a breach? Following a breach of unsecured PHI a Covered Entity must notify: The individual whose PHI has been compromised or is believed to have been compromised. The notification must include: What happened and when; The type of unsecured PHI involved; Steps the individual should take to protect him/herself from potential harm from the breach; What the CE is doing to investigate and mitigate the breach and prevent further breaches; and Contact information for individuals to ask questions.
25 Who must be notified of a breach? (Cont.) Media Notice: Breach involving more than 500residents in a state or jurisdiction-the entity must notify prominent media outlets, in addition to the affected individuals, within 60 days of discovery of the breach. Notice to the Secretary of the Department of Health and Human Services (DHHS): Breach involving 500 or moreindividuals the entity must notify DHHS within 60 days of discovery. Fewer than 500individuals -the entity may notify the Secretary within 60 days of the end of the calendar year in which the breach occurred.
26 Who must be notified of a breach? (Cont.) Notification by a Business Associate: If the breach of unsecured PHI occurs at or by a BA, the BA must notify the CE without unreasonable delay, as required by the BA Agreement, but no later than 60 days after discovering the breach, and The BA must provide sufficient information for the CE to notify the affected individual(s). Note: BAA may require the BA do more Indemnification Credit protection
27 Enforcement of the Rules The Office of Civil Rights (OCR) enforces the HIPAA Privacy, Security and Breach Notification Rules. The OCR implemented a pilot program that audited 115 covered entities in 2011 and OCR now randomly auditing compliance of CEs and BAs.
28 Audit Protocol The OCR audit protocol includes: Privacy Rule: Notice of privacy practices for PHI, Rights to request privacy protection for PHI, Access of individuals to PHI, Administrative requirements, Uses and disclosures of PHI, Amendment of PHI, Accounting of disclosures. Security Rule: Administrative, physical and technical safeguards Breach Notification Rule requirements.
29 Audits (Cont.) Every CE and BA (and, presumably sub-bas) is subject to auditing. Although audits are viewed as compliance improvement tools, a particular violation may lead to sanctions and penalties. If an audit indicates a serious compliance issue it may trigger a separate enforcement investigation by OCR or DOJ.
30 Audit Results Privacy Rule violations: Failure to provide appropriate patient access to records, Insufficient Notice of Privacy Practices, Lack of Policies and Procedures.
31 Audit Results Security Rule violations: Failure to monitor user activity, Lack of contingency planning, Authentication/integrity, Media reuse and destruction.
32 OCR s Complaint Investigation (pre HIPAA-HITECH) The Top 5 OCR investigation issues: Impermissible uses and disclosures of PHI Lack of safeguards Access to records Failure to keep access to minimum necessary No or insufficient Notice of Privacy Practices OCR Complaint Statistics (April 2013) through December 2012: Complaints received 77,190 Complaints resolved 70,800 Corrective action required 18,711 No violation 8,971 Ineligible for enforcement 43,118
33 Who is looking at you HIPAA-HITECH allows for enhanced sanctions and penalties and expands HIPAA s enforcement provisions Enforcement agencies include: OCR DOJ State Attorneys General Whistleblowers (?) Patients/family members (?)
34 Non-Compliance Risk Failure to comply with HIPAA-HITECH could result in: Federal/State penalties/fines/licensure action Criminal or civil investigation and prosecution Loss of contracts Public harm and reputational risk Legal costs Cost of notification of breach Private damage judgment
35 Civil Money Penalty Structure Violation Category Section 1176(a)(1) The Department will determine the penalty amounts based on the nature and extent of the violation and the nature and extent of the resulting harm. Each Violation All violations of same provision in one calendar year (A) Did not know $100-$50,000 $1,5000,000 (B) Reasonable Cause $1,000- $50,000 (C)(i) Willful Neglect Corrected (C)(II) Willful Neglect Not Corrected $10,000- $50,000 $1,5000,000 $1,5000,000 $50,000 $1,5000,000
36 HIPAA Criminal Penalties A person who knowinglyobtains or discloses PHI in violation of HIPAA-HITECH may be subject to criminal liability. That is, knowingly in violation of HIPAA-HITECH: Uses or causes to be used a unique health identifier; Obtains individually identifiable health information relating to an individual; or Discloses individually identifiable health information to another person.
37 HIPAA Criminal Penalties (Cont.) Under HIPAA-HITECH any personcan be prosecuted for violating the provision including an employee or other person. The knowledge requirement refers only to obtaining PHI, not to knowledge that such actions were in violation of HIPAA-HITECH.
38 HIPAA Criminal Penalties (Cont.) Summary of Categories of Criminal Penalties: Level of Knowledge/Intent Criminal Penalty A person knowingly obtains or disclosed PHI in violation of HIPAA Up to $50,000, and/or Imprisonment up to 1 year If such offense is committed under false pretenses Up to $100,000, and/or Imprisonment up to 5 years If such offense is committed with the intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm Up to $250,000, and/or Imprisonment up to 10 years
39 HORROR STORIES AvMed Lost laptop; private state action Affinity Health Plan Photocopier memories; 350,000 members; $1.3 million Advocate Medical Group 4 million members; 4 mainframes stolen; 4 weeks to notify; $????????
40 Fines, Penalties and Settlement Agreements $1.5M Settlement -Massachusetts Eye and Ear Infirmary (MEEI) (9/12). MEEI reported the theft of a laptop containing unencrypted PHI. The laptop contained information about MEEI s patients, incl. patient prescriptions and clinical information. OCR concluded that MEEI showed a long-term organizational disregard for the requirements of the Security Rule. In addition to the $1.5M settlement MEEI must adhere to a corrective action plan and must retain an independent compliance monitor and render semi-annual reports to HHS for 3 years.
41 Fines, Penalties (Cont.) $4.3M Fine Cignet Health, 2010 HIPAA Privacy Rule Violation 41 patients denied access to medical records and individually filed complaints with OCR. Cignetrefused to cooperate with OCR in its investigation incl. refusing to produce the subpoenaed records. $1.3M fine for denying patients access to their records $3M fine for the failure to cooperate with OCR
42 Fines, Penalties (Cont.) $1.5M Settlement Blue Cross Blue Shield of Tennessee, March 2012 Theft of 57 computer hard drives containing unencrypted PHI of over 1 million individuals. Compromised PHI included: Names, SSN#, DOB, and Diagnosis Codes OCR s investigation showed a failure to implement physical safeguards in violation of the Security Rule.
43 Fines, Penalties (Cont.) $1.0M Settlement Massachusetts General Hospital (2/2011). Loss of PHI of 192 patients from the Infectious Disease Associates O/P practice. Compromised PHI included: List of Names of Patients, DOB, Diagnosis, etc. OCR s investigation showed a failure to implement safeguards to protect PHI when removed from premises. (Documents were lost by employee who left them behind on subway train).
44 How can you reduce your risk? Perform self-audits! Review and update policies and procedures for: Administrative Safeguards, Physical Safeguards, and Technical Safeguards as they pertain to the Privacy and Security Rules. Review your Breach Notification procedures. EDUCATE, EDUCATE, EDUCATE and document, document, document
45 Administrative Safeguards Designate a privacy officer responsible for reviewing, updating, and documenting policies concerning: Potential risks to PHI and e-phi and implementation of measures to reduce the risk and vulnerability of the information, Keeping authorized access to PHI and e-phi to the minimum necessary based on the user s role, Periodic training of workforce members, Compliance with BAA requirement
46 Administrative Safeguards (Cont.) Training of workforce members and BAs should include: Annual training for everyone Immediate training of new hires/bas Have processes in place to evaluate and sanction violations. Workforce members include employees, volunteers, trainees and others under the CE s direct control.
47 Physical Safeguards Privacy officer should review, revise and document the following: Physical access to the entity s facility should be limited to authorized access, Proper use of and access to workstations and electronic media, including transfer, disposal, and re-use of electronic media.
48 Technical Safeguards Privacy officer should review, revise, and document: Technical procedures allowing only authorized personnel access to e-phi, Hardware or software that records access to and activity in systems that contain e-phi, Electronic measures in place to ensure that e-phi is not improperly altered or destroyed, Technical security measures that protect e-phi that is transmitted over an electronic network
49 Document your self-audits Must maintain written security policies and procedures and written records of required actions, activities or assessments. These records must be maintained until 6 years after the later of their date of creation or their last effective date. While BAs are not obligated to self-audit, is it a good idea?
50 SUMMARY Self-audit start now! Designate a privacy officer and review your privacy, security and breach notification processes and procedures, Identify your risks and take steps to remove or reduce them, EDUCATE your workforce members, and DOCUMENT, DOCUMENT, DOCUMENT!
51 Your go to advisors for all matters in information security. 800 S Douglas Road #940 Coral Gables, FL Phone: Stephen H. Siegel, Esq
TODAY S PRESENTERS Why Lawyers? Why Now? New HIPAA regulations go into effect September 23, 2013 Expands HIPAA safeguarding and breach liabilities for business associates (BAs) Lawyer is considered a business
HIPAA More Important Than You Realize J. Ira Bedenbaugh Consulting Shareholder February 20, 2015 This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record
UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 RULES Issued August 19, 2009 Requires Covered Entities to notify individuals of a breach as well as HHS without reasonable delay or within
HIPAA Omnibus Rule Practice Impact Kristen Heffernan MicroMD Director of Prod Mgt and Marketing 1 HIPAA Omnibus Rule Agenda History of the Rule HIPAA Stats Rule Overview Use of Personal Health Information
HIPAA Omnibus Rule Overview Presented by: Crystal Stanton MicroMD Marketing Communication Specialist 1 HIPAA Omnibus Rule - Agenda History of the Omnibus Rule What is the HIPAA Omnibus Rule and its various
HIPAA Breaches, Security Risk Analysis, and Audits Derrick Hill Senior Health IT Advisor Kentucky REC Why Does Privacy and Security Matter? Trust Who Must Comply with HIPAA Rules? Covered Entities (CE)
Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Note: Information provided to NCRA by Melodi Gates, Associate with Patton Boggs, LLC Privacy and data protection
Office of the Secretary Office for Civil Rights () Overview of the HIPAA Security Rule Office for Civil Rights Region IX Alicia Cornish, EOS Sheila Fischer, Supervisory EOS Topics Upon completion of this
FIVE EASY STEPS FOR HANDLING NEW HIPAA REQUIREMENTS & MANAGING YOUR ELECTRONIC COMMUNICATIONS James J. Eischen, Jr., Esq. October 2013 Chicago, Illinois JAMES J. EISCHEN, JR., ESQ. Partner at Higgs, Fletcher
HIPAA Hot Topics Audits, the Latest on Enforcement and the Impact of Breaches September 2012 Nashville Knoxville Memphis Washington, D.C. Overview HITECH Act HIPAA Audit Program: update and initial results
Procedure Name: HITECH Breach Notification The ReHabilitation Center 1439 Buffalo Street. Olean. NY. 14760 Purpose To amend The ReHabilitation Center s HIPAA Policy and Procedure to include mandatory breach
HIPAA 101 March 18, 2015 Webinar Agenda Acronyms to Know HIPAA Basics What is HIPAA and to whom does it apply? What is protected by HIPAA? Privacy Rule Security Rule HITECH Basics Breaches and Responses
This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American
HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions Table of Contents Understanding HIPAA Privacy and Security... 1 What
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. firstname.lastname@example.org www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually
HIPAA OMNIBUS RULE: EXPANDED COMPLIANCE REQUIREMENTS James J. Eischen, Jr., Esq. November 2013 San Diego, California JAMES J. EISCHEN, JR., ESQ. Partner at Higgs, Fletcher & Mack, LLP 26+ years of experience
What do you need to know? DISCLAIMER Please note that the information provided is to inform our clients and friends of recent HIPAA and HITECH act developments. It is not intended, nor should it be used,
New HIPAA regulations require action. Are you in compliance? Mary Harrison, JD Tami Simon, JD May 22, 2013 Discussion topics Introduction Remembering the HIPAA Basics HIPAA Privacy Rules HIPAA Security
Implementation Business Associates and Breach Notification Tony Brooks, CISA, CRISC, Tony.Brooks@horne-llp.com Clay J. Countryman, Esq., Clay.Countryman@bswllp.com Stephen M. Angelette, Esq., Stephen.Angelette@bswllp.com
Office of the Secretary Office for Civil Rights () HIPAA Enforcement Emily Prehm, J.D. Office for Civil Rights U.S. Department of Health and Human Services December 18, 2013 Presentation Overview s investigative
HIPAA Compliance, Notification & Enforcement After The HITECH Act Presenter: Radha Chanderraj, Esq. Key Dates Publication date January 25, 2013 Effective date - March 26, 2013 Compliance date - September
Electronic Health Records: Data Security and Integrity of e-phi Worcester, MA Wednesday, 2:15pm 3:30pm Agenda Introduction Learning Objectives Overview of HIPAA HIPAA: Privacy and Security HIPAA: The Security
Compliance Tip Sheet National Hospice and Palliative Care Organization www.nhpco.org/regulatory HHS Issues New HITECH/HIPAA Rule: Implications for Hospice Providers Hospice Provider Compliance To Do List
Ethics, Privilege, and Practical Issues in Cloud Computing, Privacy, and Data Protection: HIPAA February 13, 2015 Katherine M. Layman Cozen O Connor 1900 Market Street Philadelphia, PA 19103 (215) 665-2746
Data Breach, Electronic Health Records and Healthcare Reform (This presentation is for informational purposes only and it is not intended, and should not be relied upon, as legal advice.) Overview of HIPAA
OCR UPDATE Breach Notification Rule & Business Associates (BA) Alicia Galan Supervisory Equal Opportunity Specialist March 7, 2014 HITECH OMNIBUS A Reminder of What s Included: Final Modifications of the
HIPAA, HIPAA Hi-TECH and HIPAA Omnibus Rule NYCR-245157 HIPPA, HIPAA HiTECH& the Omnibus Rule A. HIPAA IIHI and PHI Privacy & Security Rule Covered Entities and Business Associates B. HIPAA Hi-TECH Why
Business Associates, HITECH & the Omnibus HIPAA Final Rule HIPAA Omnibus Final Rule Changes Business Associates Marissa Gordon-Nguyen, JD, MPH Health Information Privacy Specialist Office for Civil Rights/HHS
M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice
Court Reporters and HIPAA OCRA Spring Convention ~ 2014 Phyllis Craver Lykken, RPR, CLR, CCR 2463 1 What Exactly is HIPAA? HIPAA is an acronym for the Health Insurance Portability and Accountability Act
HIPAA Compliance: Are you prepared for the new regulatory changes? Baker Tilly CARIS Innovation, Inc. April 30, 2013 Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed
HIPAA Update Focus on Breach Prevention Objectives By the end of this program, participants should be able to: Identify top reasons why breaches occur Review the breach definition and notification process
Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance For Calendar Years 2011 and 2012 As Required by the Health Information Technology for Economic and Clinical
HIPAA PRIVACY AND SECURITY FOR EMPLOYERS Agenda Background and Enforcement HIPAA Privacy and Security Rules Breach Notification Rules HPID Number Why Does it Matter HIPAA History HIPAA Title II Administrative
HIPAA Compliance The Time is Now Changes on the Horizon: The Final Regulations on Privacy and Security May 7, 2013 Presenters James Clay President Employee Benefits & HR Consulting The Miller Group email@example.com
Applicability: Policy Title: Policy Number: Use & Disclosure of Protected Health Information by Business Associates PP-12 Superseded Policy(ies) or Entity Policy: N/A Date Established: January 31, 2003
HIPAA Privacy & Breach Notification Training for System Administration Business Associates Barbara M. Holthaus firstname.lastname@example.org Office of General Counsel University of Texas System April 10,
STANDARD ADMINISTRATIVE PROCEDURE 16.99.99.M0.26 Investigation and Response to Breach of Unsecured Protected Health Information (HITECH) Approved October 27, 2014 Next scheduled review: October 27, 2019
When HHS Calls, Will Your Plan Be HIPAA Compliant? Petula Workman, J.D., CEBS Division Vice President Compliance Counsel Gallagher Benefit Services, Inc., Sugar Land, Texas The opinions expressed in this
Welcome to ChiroCare s Fourth Annual Fall Business Summit October 3, 2013 HIPAA Compliance Regulatory Overview & Implementation Tips for Providers Agenda Green packet Overview of general HIPAA terms and
HIPAA Privacy and Security Cindy Cummings, RHIT February, 2015 1 HIPAA Privacy and Security The regulation is designed to safeguard Protected Health Information referred to PHI AND electronic Protected
Health Information Privacy Refresher Training March 2013 1 Disclosure There are no significant or relevant financial relationships to disclose. 2 Topics for Today State health information privacy law Federal
OCR Reports on the Enforcement of the HIPAA Rules HCCA Compliance Institute April 22, 2013 David Holtzman Sr. Health IT & Privacy Specialist U.S. Department of Health and Human Services Office for Civil
OCR Reports on the Enforcement of the HIPAA Rules HCCA Compliance Institute April 22, 2013 David Holtzman Sr. Health IT & Privacy Specialist U.S. Department of Health and Human Services Office for Civil
THE HIPAA TANGO CHOREOGRAPHING PRIVACY AND SECURITY UNDER THE FINAL RULE The Speakers Cinda Velasco Attorney, Manager, Privacy Officer Patient Safety and Risk Management Trish Lugtu Senior Manager MMIC
HIPAA/HITECH Privacy and Security for Long Term Care 1 John DiMaggio Chief Executive Officer, Blue Orange Compliance Cliff Mull Partner, Benesch, Healthcare Practice Group About the Presenters John DiMaggio,
HIPAA in an Omnibus World Presented by HITECH COMPLIANCE ASSOCIATES IS NOT A LAW FIRM The information given is not intended to be a substitute for legal advice or consultation. As always in legal matters
HIPAA/HITECH WHAT S YOUR COMPLIANCE STATUS? Daniel B. Mills Pretzel & Stouffer, Chartered WHAT IS HIPAA? 1 DEFINITIONS HIPAA Health Insurance Portability and Accountability Act of 1996 Primarily designed
HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations Health Care Litigation Webinar Series March 22, 2012 Spence Pryor Paula Stannard Jason Popp 1 HIPAA/HITECH
New HIPAA Breach Notification Rule: Know Your Responsibilities Loudoun Medical Group Spring 2010 Health Information Technology for Economic and Clinical Health Act (HITECH) As part of the Recovery Act,
Lessons Learned from Recent HIPAA and Big Data Breaches Briar Andresen Katie Ilten Ann Ladd Recent health care breaches Breach reports to OCR as of February 2015 1,144 breaches involving 500 or more individual
OCR s Anatomy: HIPAA Breaches, Investigations, and Enforcement Clinton Mikel The Health Law Partners, P.C. Alessandra Swanson U.S. Department of Health and Human Services - Office for Civil Rights Disclosure
The Dish on Data and Disks HIPAAPrivacy and Security Breach Developments Robin B. Campbell Ethan P. Schulman Jennifer S. Romano HIPAAPrivacy and Security Breach Overview of the Laws Developments Incident
Shipman & Goodwin LLP HIPAA Alert March 2009 STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS The economic stimulus package, officially named the American Recovery and Reinvestment Act of 2009
January 23, 2013 HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI Executive Summary HHS has issued final regulations that address recent legislative
IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance
HIPAA/HITECH: A Guide for IT Service Providers Much like Arthur Dent in the opening scene of The Hitchhiker s Guide to the Galaxy (HHGTTG), you re experiencing the impact of new legislation that s infringing
PLEASE NOTE: THIS DOCUMENT IS SUBMITTED AS A SAMPLE, FOR INFORMATIONAL PURPOSES ONLY TO ABC ORGANIZATION. HIPAA SOLUTIONS LC IS NOT ENGAGED IN THE PRACTICE OF LAW IN ANY STATE, JURISDICTION, OR VENUE OF
REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS
AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE This Notice of Privacy Practices describes the legal obligations of Ave Maria University, Inc. (the plan ) and your legal rights regarding your protected health
Protecting Patient Information in an Electronic Environment- New HIPAA Requirements SD Dental Association Holly Arends, RHIT Clinical Program Manager Meet the Speaker TRUST OBJECTIVES Overview of HIPAA
Understanding HIPAA Regulations and How They Impact Your Organization! Presented by: HealthInfoNet & Systems Engineering! April 25 th 2013! Introductions! Todd Rogow Director of IT HealthInfoNet Adam Victor
Am I a Business Associate? Do I want to be a Business Associate? What are my obligations? Brought to you by Winston & Strawn s Health Care Practice Group 2013 Winston & Strawn LLP Today s elunch Presenters
HOW TO REALLY IMPLEMENT HIPAA Presented by: Melissa Skaggs Provider Resources Group WHAT IS HIPAA The Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. 104 191, 110 Stat. 1936,
Beyond The Legal Requirements: Key Practical Issues in Negotiating Business Associate Agreements, Responding to a Breach of Unsecured PHI, and Understanding HHS Enforcement Philip L. Gordon, Esq. Littler
HIPAA WEBINAR HANDOUT OCR Enforcement Tools Voluntary corrective action Resolution Agreement and Payment CMPs Referral to DOJ for criminal investigation Resolution Agreements Contract signed by HHS and
Lessons Learned from HIPAA Audits October 29, 2012 Tony Brooks, CISA, CRISC Partner - IT Assurance and Risk Services HORNE LLP AGENDA HIPAA/HITECH Regulations Breaches and Fines OCR HIPAA/HITECH Compliance
HIPAA Security Rule Compliance Caryn Reiker MAXIS360 HIPAA Security Rule Compliance what is it and why you should be concerned about it Table of Contents About HIPAA... 2 Who Must Comply... 2 The HIPAA
A How-To Guide for Updating HIPAA Policies & Procedures to Align with ARRA Health Care Provider Edition Version 1 Policy and Procedure Templates Reflects modifications published in the Federal Register
9/25/13 Lawyers as HIPAA Business Associates ISBA Solo and Small Firm Conference October 4, 2013 Rick L. Hindmand McDonald Hopkins LLC 1 Agenda Background HIPAA/HITECH Act/Omnibus Rule Who is a business
HIPAA and Mental Health Privacy: What Social Workers Need to Know Presenter: Sherri Morgan, JD, MSW Associate Counsel, NASW Legal Defense Fund and Office of Ethics & Professional Review 2010 National Association
What s New with HIPAA? Policy and Enforcement Update HHS Office for Civil Rights New Initiatives Precision Medicine Initiative (PMI), including Access Guidance Cybersecurity Developer portal NICS Final
HIPAA BUSINESS ASSOCIATE AGREEMENT THIS HIPAA BUSINESS ASSOCIATE AGREEMENT ( BAA ) is entered into effective the day of, 20 ( Effective Date ), by and between the Regents of the University of Michigan,
HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 Orchard Creek Health Care is required by law to maintain the privacy of protected health information (PHI) of our residents. If you feel
Americas - U.S. Legislative, Privacy & Projects Jurisdiction Effective Date Author Release Date File No. UFS Topic Citation: Reference: Federal 3/26/13 Michael F. Tietz Louis Enahoro HIPAA, Privacy, Privacy
HIPAA Privacy, Security, Breach, and Meaningful Use Practice Requirements for 2012 CHUG October 2012 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Standards for Privacy of Individually
HIPAA Business Associate Agreement Sample Notice Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) The information provided in this document does not constitute, and is no substitute
Everett School Employee Benefit Trust Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Introduction The Everett School Employee Benefit Trust ( Trust ) adopts this policy
Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Patricia D. King, Esq. Associate General Counsel Swedish Covenant Hospital Chicago, IL I. Business Associates under
Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A., UC Health 7093020v1 Examples from the News Review of HIPAA Breach Regulations
HIPAA Omnibus Final Rule Changes Breach Notification & Enforcement Plus An Audit Update OCR / WEDI Webinar Series July 17, 2013 Today s Speakers Verne Rinker, JD, MPH Health Information Privacy Specialist
1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists