Global Health, Fitness and Medical Issues

As of now, your HIPAA checklist for 2021 looks much the same as years prior. Although there are no confirmed changes to HIPAA, there are several proposed changes that may come into effect soon.

What is the 2021 HIPAA Checklist?

The 2021 HIPAA checklist consists of several questions in which an organization working in healthcare can use to assess their overall HIPAA compliance. 

Have you completed all of your annual self-audits? Have you identified gaps in your compliance based on findings from your self-audits? Have you created remediation plans to address these gaps? Have all employees received their annual HIPAA training? Do you have policies and procedures in accordance with HIPAA requirements? Do you have signed business associate agreements with all of your business associates? Do you have a process for identifying, tracking, and reporting breaches?  How to Use the Checklist to Help with Your Compliance

By utilizing the HIPAA compliance checklist 2021, you can assess your current HIPAA practices against HIPAA standards. The purpose of the 2021 HIPAA checklist is to give you a basic understanding of whether or not you are meeting HIPAA requirements. However, the checklist is not meant to confirm or verify your compliance program.

 

To do so, you should speak with a HIPAA expert, such as Compliancy Group. We will walk you through the checklist to help you understand where your compliance program is lacking, and help you implement an effective HIPAA compliance program in accordance with the law. When working with us, you will never have to go at it alone, we will be there every step of the way to make sure that you have HIPAA compliance covered!

Proposed HIPAA Changes

Although there are no current changes to the HIPAA compliance checklist 2021, it is highly likely that it will change in the near future. This is because there are several proposed changes to the HIPAA Privacy Rule that may come into effect soon. 

These changes may include:

Reducing identity verification burdens Improving information sharing Expansion of permitted PHI disclosures Reducing administrative burdens Updating Notice of Privacy Practices requirements

For more information on proposed Privacy Rule changes, please click here.

Cybersecurity as a Priority

In addition to potential changes to the Privacy Rule, there has also been a push to update HIPAA cybersecurity requirements.

 

As of January 2021, a bill known as HR 7898, requires the Department of Health and Human Services (HHS) to incentivize healthcare organizations to implement cybersecurity practices.

 

In essence, if an organization is subject to a HIPAA audit, and they can prove that they had implemented a recognized cybersecurity framework, instead of being fined, they would be given technical assistance from the HHS.

A recent study concluded that many popular mobile health apps pose a risk to protected health information (PHI) security.

 

The study analyzed the security of 30 health apps that allow healthcare providers to review patient charts and schedules and found that all of them are vulnerable to API cyberattacks. More details on the risks of mobile health apps are discussed.

Risks of Mobile Health Apps: What Did the Study Find?

Similar to other healthcare or medical facilities, the majority of dental offices are run digitally these days. While technology makes the entire process for patients and staff easier, advanced tech also creates a more complex legal situation.

 

Dental providers run a heightened risk of potentially violating HIPAA rules. HIPAA stands for the Health Insurance Portability and Accountability Act.

 

HIPAA is legislation that ensures both the privacy and security of a patient’s personal and protected health information. Complying with HIPAA means safeguarding patient’s information and reducing the overall chance of a data breach in your system. As security is a top priority within a facility, here is a HIPAA compliance checklist for dental providers to follow.

Know and Observe the HIPAA Security Rule

There are three parts to the HIPAA security rule, which includes three different aspects of security requirements. These requirements are technical requirements, physical requirements, and administrative requirements.

 

Technical requirements for security include the technicality of communication—how information is transmitted and communicated electronically. There should be a controlled system with standard transmittance processes set in place in order to protect patients’ information.

 

The physical requirements under the security rule rely on the computer systems in place at a dental facility. These computer systems and their surrounding environment should be inaccessible to those who are not responsible for information imputation, meaning there should be procedures set in place to validate a person’s physical access to private information. Administrative requirements under the security rule ties into this procedure.

 

Administrators are appointed to select a communications system that is compliant with HIPAA and are responsible as well to develop policies and protocols for compliance.

Be Secure Against Cybersecurity Threats

As mentioned above, healthcare and dental facilities have gone digital with recordkeeping and patient files. At the top of this HIPAA compliance checklist for dental providers lies an important task—knowing how to act under the HIPAA security rule.

 

To best way to protect patient’s private information is to have a system of secure messaging as well as data encryption. Encryption of patient data is a requirement to appropriately protect sensitive information like SSNs, birthdates, addresses, or phone numbers. It’s also best to use passwords on computers in the office, and have secured and not open or public Wi-Fi network.

Ensure Proper Staff Education and Training

Having clear compliance protocols set in place is the very best way to protect patient information. Examples of such protocols would be not public broadcasting private information in the office and safely and quietly inputting private information in the computer.

 

Employee error is a major cause of data breaches, so train staff under HIPAA’s privacy, security, and breach notification rules.

With more and more remote workers in the healthcare space, PHI security should be a top concern. A recent survey determined that 44% of employees are currently working from home, with several employers expecting workers to continue to work remotely permanently.

 

So what does this mean for cybersecurity and HIPAA compliance? To provide healthcare organizations with guidance, remote workers and HIPAA is discussed.

Remote Workers and HIPAA: Data Privacy

As a requirement of HIPAA, organizations working with protected health information (PHI) must ensure the confidentiality, integrity, and availability of the data.

 

When you suddenly have a remote workforce, this becomes more difficult to accomplish, and you therefore must adjust your business practices. 

Paper records.

Paper records are still used frequently in the healthcare field. When working from home, healthcare workers may be printing medical records from their home office, as such they must be cognizant of who in their household has the potential to view them. Records that contain any patient information must be kept in a secure location such as locked filing cabinets or a locked office.

 

Otherwise, if an unauthorized individual views these paper documents, even when viewed accidentally by a family member, this is considered a HIPAA violation.

Access controls.

There are several instances in which remote workers would require access to their organization’s network.

 

In these cases, it is essential that the organization has policies and procedures in place for secure remote access, this may include the requirement of an employee to connect to a virtual private network (VPN) before connecting to the organization’s network, or requiring the implementation of multifactor authentication.

PHI disposal.

Perhaps the most challenging aspect of remote workers and HIPAA, is how to dispose of records in a secure manner. Paper records that are no longer needed must be shredded, burned, pulped, or pulverized beyond recognition, or stored in a secure location until they can properly be disposed of. The difficult aspect of proper PHI disposal is when the records are electronic. For electronic PHI disposal, organizations likely must contract a third-party for disposal, which means remote workers must have clear guidelines on how they may comply with ePHI disposal requirements when they aren’t working in the office.

Security risk assessment.

Security risk assessments (SRAs) must be conducted annually, however it is recommended to conduct an SRA whenever there are changes to your business practice, much like the change to a remote workforce.

 

Having remote workers poses a significant cybersecurity risk to any organization, and as such it is important to identify risks and vulnerabilities presented by a remote workforce. By conducting an SRA, gaps in current security practices are identified so that organizations can create remediation plans to address gaps. 

Vendor management.

Just like it is important to conduct SRAs when there are changes to your organization’s business practices, it is important to consider your vendors’ risks. Many of your vendors have likely converted to a largely remote workforce, therefore it is essential to reassess the risk that they pose to your organization’s security by sending vendor risk assessments to any vendor that has the potential to access PHI.

HIPAA policies and procedures.

Healthcare organizations must have HIPAA policies and procedures that relate directly to the way their business operates. So it isn’t surprising that organizations with remote workers must have policies and procedures that provide guidelines on how to comply with HIPAA with a remote workforce.

 

To ensure that your organization is complying with HIPAA while your workforce is remote, you must either adapt your existing policies to account for the changes a remote workforce poses to your business, or create new policies and procedures for working remotely.

Office reopenings.

When workers begin to return to the office, they will likely be on a hybrid work schedule, working both from the office and at home. This can pose risks when employees are bringing paperwork or electronic portable devices back and forth. When reopening, organizations must consider this risk and develop policies and procedures to minimize PHI exposure.