Global Health, Fitness and Medical Issues

The information blocking provisions of the 21st Century Cures Act officially went into effect this week, putting into focus the Department of Health and Human Services’ regulatory and compliance effort around HIPAA-required data sharing between applicable healthcare entities. 

Enacted by the 21st Century Cures Act in 2017 and implemented by a final rule in 2020, Congress defined information blocking and established penalties for providers that engage in practices that interfere with the access, exchange, and use of electronic health information.

The long-awaited info blocking provision established rules and penalties for non-compliance. The law carves out exclusions for providers if they meet an exception established by the HHS Secretary, or for other applicable reasons.

Starting April 5, relevant covered entities and business associates must comply. The Office for the National Coordinator recently released insights on just what the law’s enactment means for those relevant providers, as well as the areas HHS will focus on in the next 18 months.

For now, a smaller subset of electronic health data is in scope.

“Specifically, the electronic health information that cannot be blocked is limited to the data elements represented in the US Core Data for Interoperability,” ONC officials explained.

“This initial 18-month period and limited scope gives the regulated community time to grow more experienced with the information blocking regulation, including when and how to meet an exception, before the full scope of the regulation’s EHI definition comes into effect.” 

“Of course, those who are able to share more EHI than is represented by the USCDI need not wait to begin doing so,” they added. “Similarly, as a way to prepare for October 2022, we strongly encourage the regulated community to make all EHI available as if the scope of EHI were not currently limited.”

As the US surpasses its one-year milestone of the COVID-19 national emergency and subsequent Department of Health and Human Services’ HIPAA liability waivers, it’s the ideal time for providers to assess the health of their privacy governance and compliance programs.

To Sean Sullivan, a senior associate attorney with the Health Care Group of Alston & Bird, the industry should consider this period as breathing room: the enforcement arm of the rule hasn’t been fully enacted and the HHS liability waivers put into place for COVID-19 remain intact -- for now.

The info blocking provisions signal a sea of change for the industry, he explained. Providers had the last year to prepare for these drastic changes, and now ONC has stressed it will be focusing on this compliance area moving forward.

While the rules won’t immediately change things, it does provide new rights to accessing data between providers and other covered entities through authorized requests.

Sullivan stressed that it overlays HIPAA’s information sharing requirements that merely suggested providers may share data with other covered entities.

The new provisions make data sharing a requirement, or those efforts could be considered info blocking and a direct violation of the provisions. 

The timeline for data sharing has also changed from the previous 30-day requirement to “on a timely basis and without necessary delay.” There’s no strict deadline, rather an expectation that the data be immediately available, he explained.

The idea is to allow other healthcare providers to use their EHR or the platform of the connected covered entity to download the needed information.

“The expectation is that now data should be instantaneously available as long as it’s electronic,” Sullivan said. “And a lot of providers who miss those new timeframes are going to continue to fall back on that 30-day timeline. It’s a mistake.”

Instead, providers need to review their policies and procedures for all electronic data within their possession and determine whether the tech in place is capable of adhering to the provisions. They will also need to assess how to provide electronic data on a timely basis, via the EHR or even a patient portal.

“Frankly, the government has been struggling with [data sharing and info blocking] for some time,” Sullivan said. “But the financial services industry figured it out years ago.”

Sullivan also mused that providers, insurers, and specialists are operating within similar environments, but still the data sharing process has remained stagnant -- with the healthcare industry, as a whole, reluctant to change.

Previous arguments have stressed the sensitive nature of the data, while others have pointed to a lack of resources to invest in needed tech. There’s also an anti-competitive factor, where some providers worry that its patients may shop around at a competitor’s care site.

A recent study concluded that many popular mobile health apps pose a risk to protected health information (PHI) security.

The study analyzed the security of 30 health apps that allow healthcare providers to review patient charts and schedules and found that all of them are vulnerable to API cyberattacks. More details on the risks of mobile health apps are discussed.

The Health Insurance Portability and Accountability Act (HIPAA) was created in 1996 to modernize the flow of healthcare information. It stipulates how all personal data maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft. It also addresses limitations on healthcare insurance coverage.

All healthcare and healthcare insurance industries are required to comply with HIPAA guidelines and can expect to be audited by the Office for Civil Rights (OCR), an organization within the U.S. Department of Health & Human Services (HHS).

HIPAA compliance should be taken very seriously, as violations can carry civil or even criminal penalties, not to mention the huge impact a data breach has on a company’s credibility.

Here are a few tips to help you make this process as simple and as smooth as possible.

Technology has changed tremendously since 1996 and this led to an adjustment of HIPAA guidelines in 2013.

Now, 7 years later, data storage and data security protocols are still undergoing massive changes, so it is important to keep your policies up to date. Implementing small changes every year is significantly less costly than waiting to implement huge changes when they are inevitable.

It is important to remember that auditors will be looking for compliance not only within your organization, but also with any partner you work with. This applies to any business associate of yours that has access to or may come in contact with patients’ personal data.

Some examples are lawyers, accountants, IT contractors, billing companies, cloud storage services, receptionists, etc. So make sure you check that all your business associates are compliant with HIPAA and that they maintain that status as well.

Employee education and constant training is a big part of ensuring that your company is HIPAA compliant.

The best way to go about this is to have a plan in place on how you want to approach this training, keeping in mind that this will need to be an ongoing situation. The most important thing is to make sure that employees know how to keep data protected.

It is a great idea to assign an employee to be the security officer in charge of your HIPAA compliance program.

This will help you stay compliant and they are also critical whenever your company gets audited or you suffer from a data breach since they will be responsible for calling any third-party vendors to help you solve your issue.

From the moment an employee captures personal data, up until it is stored in a local or virtual server, you should take the necessary steps to ensure that this data is protected at all times. Auditing the path the data takes makes it easier to identify and eliminate all weak points that are vulnerable to breaches.

The first step is to implement a Virtual Private Network (VPN) that ensures that all communication within your network is encrypted and secure.

Other measures to keep in mind are encrypting all communication that happens outside of your secure network, this means all billing communications, emails, instant messages, and even fax machines must be protected. Testing the robustness of your security is a must to ensure that data is safe.

Any time protected information falls into the hands of an unintended, not necessarily malicious, party constitutes a breach. Even if this data is encrypted and useless for anyone without the proper decryption keys, this is still a breach and it should be documented as such and the reason why it occurred should be addressed immediately.

This is where having all your policies and procedures up to date will help everybody know exactly what to do once a breach is identified.

Having a plan that details how all breaches are reported to your HIPAA security officer is required by the HIPAA Security Rule. So make sure everybody knows how to report breaches immediately after finding any.

There are many ways of storing sensitive data, from paper to removable usb drives and beyond, and all this information can be hard to keep in one place. That is why it is important to consolidate all data storage in order to make it easier for you to ensure that all of it is safe.

Once you are fully compliant with HIPAA guidelines, it is a great idea to form a compliance committee that meets periodically (generally once each quarter) to ensure that you stay compliant.

It is clear that HIPAA guidelines are important to consider when hiring an external service, such as a live receptionist service to make sure all of your business calls are answered in a professional way, schedule appointments on your behalf, and protect your time from pesky robot calls or solicitors.

When you hire phone.com’s live receptionist services you can rest assured that all of our live receptionists are HIPAA compliant.

As the spread of the coronavirus seems to be slowing, many people are preparing to get back to life as usual.

Consumers are anxiously awaiting the reopening of the country, with some states further along than others. The goal is to safely reopen retail stores, restaurants, and theme parks.

This has led some of these establishments to require proof of negative COVID-19 test results, causing many consumers to cry HIPAA violation. Is this a HIPAA violation? HIPAA and coronavirus privacy is discussed below.

The coronavirus pandemic has caused many businesses to reevaluate how well they are protecting consumers.

Many businesses have increased cleaning protocols to prevent the spread of the virus, as well as implemented new standards for consumers entering the establishments.

Several businesses are requiring employees and consumers to wear masks, are conducting temperature checks on anyone entering the business, and requiring proof of negative COVID-19 test results. These new requirements have many consumers concerned that their privacy rights under HIPAA are being violated.

HIPAA established industry standards for the privacy of protected health information (PHI). Under HIPAA, coronavirus test results are considered PHI. As PHI, covered entities and business associates cannot disclose a patient’s coronavirus test results outside of treatment, payment, or healthcare operations. 

But what about during a global pandemic? These entities are permitted to disclose coronavirus test results to public health authorities for the purpose of public safety.

This is to notify people who may have come into contact with a coronavirus positive patient. However, disclosed information must only be the minimum necessary information to accomplish the purpose of the disclosure.

Consumer businesses such as retail stores, restaurants, and theme parks are neither covered entities nor business associates. Since they are neither covered entities or business associates, these establishments do not fall under the jurisdiction of HIPAA law.

As such, they can ask patrons for proof of negative COVID-19 test results, without fear of violating HIPAA, before they are permitted entry to these establishments. 

Similar to other healthcare or medical facilities, the majority of dental offices are run digitally these days. While technology makes the entire process for patients and staff easier, advanced tech also creates a more complex legal situation.

Dental providers run a heightened risk of potentially violating HIPAA rules. HIPAA stands for the Health Insurance Portability and Accountability Act.

HIPAA is legislation that ensures both the privacy and security of a patient’s personal and protected health information. Complying with HIPAA means safeguarding patient’s information and reducing the overall chance of a data breach in your system. As security is a top priority within a facility, here is a HIPAA compliance checklist for dental providers to follow.

There are three parts to the HIPAA security rule, which includes three different aspects of security requirements. These requirements are technical requirements, physical requirements, and administrative requirements.

Technical requirements for security include the technicality of communication—how information is transmitted and communicated electronically. There should be a controlled system with standard transmittance processes set in place in order to protect patients’ information.

The physical requirements under the security rule rely on the computer systems in place at a dental facility. These computer systems and their surrounding environment should be inaccessible to those who are not responsible for information imputation, meaning there should be procedures set in place to validate a person’s physical access to private information. Administrative requirements under the security rule ties into this procedure.

Administrators are appointed to select a communications system that is compliant with HIPAA and are responsible as well to develop policies and protocols for compliance.

As mentioned above, healthcare and dental facilities have gone digital with recordkeeping and patient files. At the top of this HIPAA compliance checklist for dental providers lies an important task—knowing how to act under the HIPAA security rule.

To best way to protect patient’s private information is to have a system of secure messaging as well as data encryption. Encryption of patient data is a requirement to appropriately protect sensitive information like SSNs, birthdates, addresses, or phone numbers. It’s also best to use passwords on computers in the office, and have secured and not open or public Wi-Fi network.

Having clear compliance protocols set in place is the very best way to protect patient information. Examples of such protocols would be not public broadcasting private information in the office and safely and quietly inputting private information in the computer.

Employee error is a major cause of data breaches, so train staff under HIPAA’s privacy, security, and breach notification rules.

With more and more remote workers in the healthcare space, PHI security should be a top concern. A recent survey determined that 44% of employees are currently working from home, with several employers expecting workers to continue to work remotely permanently.

So what does this mean for cybersecurity and HIPAA compliance? To provide healthcare organizations with guidance, remote workers and HIPAA is discussed.

As a requirement of HIPAA, organizations working with protected health information (PHI) must ensure the confidentiality, integrity, and availability of the data.

When you suddenly have a remote workforce, this becomes more difficult to accomplish, and you therefore must adjust your business practices. 

Paper records are still used frequently in the healthcare field. When working from home, healthcare workers may be printing medical records from their home office, as such they must be cognizant of who in their household has the potential to view them. Records that contain any patient information must be kept in a secure location such as locked filing cabinets or a locked office.

Otherwise, if an unauthorized individual views these paper documents, even when viewed accidentally by a family member, this is considered a HIPAA violation.

There are several instances in which remote workers would require access to their organization’s network.

In these cases, it is essential that the organization has policies and procedures in place for secure remote access, this may include the requirement of an employee to connect to a virtual private network (VPN) before connecting to the organization’s network, or requiring the implementation of multifactor authentication.

Perhaps the most challenging aspect of remote workers and HIPAA, is how to dispose of records in a secure manner. Paper records that are no longer needed must be shredded, burned, pulped, or pulverized beyond recognition, or stored in a secure location until they can properly be disposed of. The difficult aspect of proper PHI disposal is when the records are electronic. For electronic PHI disposal, organizations likely must contract a third-party for disposal, which means remote workers must have clear guidelines on how they may comply with ePHI disposal requirements when they aren’t working in the office.

Security risk assessments (SRAs) must be conducted annually, however it is recommended to conduct an SRA whenever there are changes to your business practice, much like the change to a remote workforce.

Having remote workers poses a significant cybersecurity risk to any organization, and as such it is important to identify risks and vulnerabilities presented by a remote workforce. By conducting an SRA, gaps in current security practices are identified so that organizations can create remediation plans to address gaps. 

Just like it is important to conduct SRAs when there are changes to your organization’s business practices, it is important to consider your vendors’ risks. Many of your vendors have likely converted to a largely remote workforce, therefore it is essential to reassess the risk that they pose to your organization’s security by sending vendor risk assessments to any vendor that has the potential to access PHI.

Healthcare organizations must have HIPAA policies and procedures that relate directly to the way their business operates. So it isn’t surprising that organizations with remote workers must have policies and procedures that provide guidelines on how to comply with HIPAA with a remote workforce.

To ensure that your organization is complying with HIPAA while your workforce is remote, you must either adapt your existing policies to account for the changes a remote workforce poses to your business, or create new policies and procedures for working remotely.

When workers begin to return to the office, they will likely be on a hybrid work schedule, working both from the office and at home. This can pose risks when employees are bringing paperwork or electronic portable devices back and forth. When reopening, organizations must consider this risk and develop policies and procedures to minimize PHI exposure.

As more organizations continue to work remotely, they are relying on texting and email as means of communication.

For organizations that work in healthcare, it is important to determine if the communication tool they use is HIPAA compliant. HIPAA compliant texting and email are discussed below.

An essential component of HIPAA is ensuring the confidentiality, integrity, and availability of protected health information (PHI). This includes PHI communicated via texting and email.

For HIPAA compliant texting and email, there are certain measures that must be implemented.

HIPAA Compliant Texting. 

Traditional texting platforms are not HIPAA compliant as they cannot be encrypted. Encryption masks sensitive data so that it is unreadable to unauthorized users. As such, they cannot be used in conjunction with PHI.

Traditional texting platforms can only be used for patient communication with prior authorization from the patient. In addition to written consent, the covered entity (CE) must issue a warning to the patient to let them know that text messaging is not a secure form of communication, the warning must also be documented.

However, this authorization extends to provider and patient communication, the provider may not communicate PHI through text message to a party other than the patient. Text messaging can also be used to send patient appointment reminders and under certain circumstances, during a natural disaster. 

If your organization prefers to communicate PHI through text messaging, there are HIPAA compliant texting platforms. These platforms are specially designed for the medical field. As such, they include all of the required security measures, and they are willing to sign a business associate agreement (BAA).

 HIPAA Compliant Email. 

To use email for communication in compliance with HIPAA, the email provider must enable encryption.

When sending email attachments with PHI, the attachments must also be encrypted. However, PHI cannot be contained in an email subject line, as this information cannot be encrypted. Before using email to communicate PHI, you must have a signed BAA with your email provider.

Even with encryption enabled, using email to communicate PHI still poses a risk. This is why providers must receive patient authorization and issue a warning before using email to communicate PHI to a patient.

HIPAA Policies and Procedures Templates are form documents that relate to a particular area of HIPAA compliance.

HIPAA Policies and Procedures templates provide information on what an organization must do to be compliant in that area. As an example, HIPAA Policies and Procedures Templates include a Policy and Procedure Template for Breach Notification.

The template contains general language about how to detect and report a breach. 

For a healthcare organization to meet HIPAA compliance requirements, its physicians, nurses, other medical staff, and any other employees who may encounter protected health information (PHI) or electronic protected health information (ePHI) must understand what their job roles allow them to do.

HIPAA Policies and Procedures Templates include, for example, a policy and procedure for the HIPAA “Accounting of Disclosures” provision of the HIPAA Privacy Rule. This provision requires healthcare organizations to give patients an accounting of entities and persons to whom the organization has sent patient PHI.

When a patient requests an accounting, the healthcare organization must have a policy, or overall principle, about accountings of disclosures. This principle can be put in writing, as something along the lines of “The law requires us to provide patients with the names of people and organizations we have given their PHI to. The law also requires that we let patients know what PHI we disclosed.” 

The organization can only handle specific patient requests once it has implemented a series of processes for doing so. These processes are called procedures.

A procedure is a series of steps allowing for the organization to provide the accounting. Procedures that are required in the accounting of disclosures context include procedures for determining who is qualified to answer a request (so that only people whose job duties require access to PHI can answer), what requests require the organization to provide the accounting and what requests the organization need not provide an accounting for, how the accounting is to be provided (i.e., by first-class mail, overnight mail, fax with a HIPAA compliant fax cover sheet), and when (within what timeframe) the accounting must be provided.

The organization must also have a process in place that addresses what it must do when a patient complains that the accounting he or she received was not complete, or did not contain required information.

Using HIPAA Policies and Procedures Templates, which require that the same process be followed each time a patient makes a request, ensures the organization will consistently and accurately meet its compliance requirements.