Have you ever read such headlines and doubted whether a small billing company, or independent physician practice would ever face such seemingly insurmountable penalties? Actually, there should be No doubt! The Sentara Hospital violations are violations which every small billing company or independent physician practice would face, not just because Sentara is a hospital.
So what happened? In short, a complaint from an individual came from a person receiving a bill containing another individual's billing statement. As a result of Sentara investigating this breach, Sentara reported a breach affecting 8 individuals, when in actuality, Sentara mailed 577 patient’s statements to the wrong addresses. This is an example of why you must perform and document a breach risk analysis as soon as you become aware of a potential incident. It is important that you understand what a breach is and the breach notification requirements.
The second issue discovered during the investigation, revealed Sentara failed to have a business associate agreement in place with an entity that performed business associate services for Sentara. This reinforces the importance of having business associate agreements in place and your understanding that BAA's are contracts which outline timeframes and provide your attestation to satisfactory assurance of your ability to safeguard PHI among other things.
Maybe most importantly, you should know every complaint must be investigated by HHS/OCR. What that means is, if you improperly disclose protected health information, like sending a statement to the wrong patient, you, a billing company, must inform the covered entity (your client) and have a breach risk assessment completed to determine several key factors. Then the covered entity must take action based on these findings. If you haven't completed an accurate and thorough security risk assessment prior to that, you could also be penalized under 'willful neglect'. This category alone is $50,000 per violation!
In fact, Texas Health received a $1.6 million fine for improperly disclosing ePHI. Texas Health failed to comply with several HIPAA requirements including failure to perform the HIPAA Security Risk Assessment.
The fines are huge, but the reputational damage to your billing company and the covered entity is expensive and difficult to overcome.
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud based portal.
Don't risk your company's future, especially when we are offering a FREE Organization Assessment to help determine your company's status.
It's easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com
Keep in mind, a business associate is a 'person' or 'entity'. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
TAKE AWAYS AND THINGS TO CONSIDER:
A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information. Correct any potential risks identified within your Technical, Administrative and Physical deficiencies.
Develop Actionable policies and procedures. HIPAA is no longer a binder on the shelf!
Employees should be HIPAA trained with relevant course material to their role and your organization. Your workforce is your first line of defense. Why would you gamble with generic training material? Completely built into your portal, Live Compliance training is custom, online, and role-based. Trainings are delivered and monitored within your Live Compliance portal, anytime and from anywhere. Easily send and monitor HIPAA training in one click.
Take advantage of our free Organization Assessment to understand your immediate compliance needs!
Contact Jim Johnson at jim@livecompliance.com or at (980) 999-1585