Being in compliance with HIPAA involves not only ensuring you provide the appropriate patient rights and controls on your uses and disclosures, but also that you ensure you have the right policies, procedures, and documentation, and have performed the appropriate analysis of the risks to the confidentiality, integrity, and availability of electronic Protected Health Information.
Using Risk Analysis can help you make defensible, documented decisions about your compliance in a variety of circumstances, for a variety of regulations. Risk Analysis is the key to making your health information privacy and security regulatory compliance work more sensible as well as defensible.
HIPAA enforcement is on the increase and random audits of HIPAA compliance have begun. In addition, audits of Meaningful Use attestations are examining compliance with Objective 15, which calls for a HIPAA Security Rule risk analysis. Failures in any of these reviews or audits can lead to significant penalties and fines. Your HIPAA Covered Entity or Business Associate needs to have the right reviews and documentation right now.
There are tools freely available that can help in the performance of a Risk Analysis, but a risk analysis takes more than tools, it takes an understanding of what to examine and how to consider what you find, to create a coherent analysis of the risks to your electronic PHI. This session will focus on how you can use the tools as part of an analysis process to give you actionable plans and documentation of considerations made in the process.
If you don't take the proper steps to ensure your patients' health information is being protected according to the HIPAA Security Rule, you can be hit with significant fines and penalties. With the increased HIPAA fines beginning at $10,000 in cases of willful neglect, providing good information security and being in compliance are more important than ever, and a good Risk Analysis is key to that compliance.
We will also discuss the HIPAA audit and enforcement regulations and processes, and how they apply to HIPAA covered entities and business associates. We will explain the recent changes that increase fines and create new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000. We will explore what kind of issues and what kind of entities had the most problems, and show where entities need to improve their compliance the most, and also explore the typical risk issues that lead to breaches of health information and see how those issues may be a target for auditors in 2015.
The results of prior enforcement actions and HHS audits (and their penalties), especially those relating to Risk Analysis, will be discussed, including recent actions involving multi-million dollar fines and settlements. In addition, new trends in information security risks will be discussed so you can start to plan for the work you'll need to do to stay in compliance and keep patient information private and secure.