Hipaa.In » HIPAA

Reasons medical businesses should comply with HIPAA regulations

admin — Tue, 01 Jun 2010 04:01:20 +0000

Late Farrah Fawcett, a well known television and film actress, was in the news few years ago, when it was discovered that data pertaining to her health issues was leaked to the newspapers. It can be said that a celebrity is always at the center of attention and is susceptible to the act of compromising confidential information broke a federal law. The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to avoid unauthorized access to confidential data, and this is what all business related to the medical field must comply with.

Who recognizes HIPAA?

If you are employed by an organization that gathers health data from individuals, you are termed as a ‘covered entity’, and you are expected to adhere to this law. Covered entities encompass the following:

Healthcare centers and clinics.
Insurance players in the health and medical space.
Private practitioners – includes general and specialized practice doctors and others.
Psychiatrists and Psychologists
Medical billing outlets and collection companies.

Whether you employ a few or many people, safeguarding patient data is of paramount importance.

Records secured by HIPAA

Patients going to a healthcare center or a clinic must be guaranteed of discretion. It is necessary that confidential records are not compromised and cannot be accessed by people who do not have the required authority. Medical data secured by these federal laws encompass, but are not restricted to:

Prescription data.
Medical history logs.
Appointment records.
Phone and voicemail data.
Insurance documents.
Billing records.

Complying with HIPAA requirements

Old and obsolete patient records must be destroyed to ensure the patient’s privacy. A company adhering to HIPAA rules must be ready to exterminate documents in accordance with policies. Any and all documents have to be shredded thoroughly as just dumping papers cannot assure security – any person with a malicious intent could go through the garbage and obtain important personal information. Retaining the services of a professional is a sure way to ensure your safety also.

Adhering to the HIPAA pertinent to your business will provide you with the peace of mind needed to run without any hitches.

Increasing Computer Network Security for effective HIPAA Compliance

admin — Mon, 31 May 2010 04:16:48 +0000

Making computer networks safe is the core part of the HIPAA plan to totally transform the national patent health data into an electronic image, which can be then effortlessly shared by health care providers, insurance providers and administrators. Because of this, the health care agencies can handle the record keeping process more proficiently and quickly and render efficient service to the patients. As the current computer system is vulnerable to hacking and virus attacks, the vital records are thus at a risk of getting stolen or being wiped out. To safeguard the patient health data, there are network security regulations, which should be adhered, to enable the establishment to attain HIPAA Compliance.

The 2 important parts of HIPAA that pertains to computer network security are:

Administrative Safeguards:

To attain HIPAA compliance the provider must recognize, protect and intimate any malevolent software program in the system. The compromised emails are carriers of worms, virus and Trojans, and there has to be a safeguard measure to stop the unwanted breach. For managing the computer systems network efficiently, it is important to keep a watch by installing specialized security measures as noted below:

Gateway and virus blocking mechanism should be in place.

The safeguard system should be able to carry out, deep packet penetration, inspect and provision for relevant web filtering mechanisms to the network. Signature systems that refresh at every half hour should be used as they are the premier defense shields against rapidly moving worms.

Security Measures

For a computer network to be HIPAA compliant, it is essential for the organization to draft a security system, which gives authority to the key people or software systems to access the confidential health information.

Appropriate encryption mechanisms should be in place to code the confidential health information when in transit to stop unauthorized access or intercept. The sending of information must be encrypted in a high security encryption and must be received by authorized users who must use the decryption code to decrypt the message.

Ultimately, it is necessary for all parties concerned in the healthcare system, like health service providers, insurance providers, transcription service providers, labs, internet service providers, hospitals and billing services to cement a relation of trust to ensure confidentiality of patient information shared between them. This can be achieved through a linkage of computers that stick to HIPAA rules and regulations to achieve a safe and protected transmission, of private health information on a public platform.

HIPAA and the Internet: Intranet Collaboration Software requirements

admin — Sat, 29 May 2010 04:10:18 +0000

In today’s modern, busy and high tech world, most of the personal business of people is conducted online. This includes accessing information regarding private health records etc. Healthcare providers have no choice but to grant access to this private health information or face losing their customers.

HIPAA also commonly known as The Health Insurance Portability and Accountability Act, requires employment of stringent measures by the health care providers, to assure the patient that his/her personal health records are protected from the unauthorized access over the internet.

HIPAA when enacted required health-providing entities to assure the confidentiality of patient information in the following ways:

Responsibility for security was to be assigned to a person or organization.
Assessment of risks to find out any security or privacy threats to medical information.
Establishment of a program to address physical, personnel and technical security controls.

Certification of effectiveness of the employed security controls.

Creating procedures, guidelines and policies to use computing devices, and ensuring that the suitable mechanisms are there to allow or ban access to an individual’s status.

Implementation of controls on access which include user-based access, encryption, role-based access, context-based access and auditing control mechanisms, authentication of data, and authentication of entity.

Security is the key

HIPAA provides for both civil and criminal action against the violations and violators, as data access and security is top priority for a healthcare firm. To assure HIPAA compliance, security features that should be included in online documents are:

Secure web server – A server should be running secure socket layers. It is the bare minimum required.

Encrypted database – All data has to be encrypted. Modern Encryption Software is available that encrypts all the data sent between two computer and any device on the internet.

Session timeout – This assures that private data is not left unattended and is only viewed by unauthorized personnel.

Server monitoring – monitoring of the web server is required to detect break-in attempts and hacking attempts.

Secure access control – Apart from user id and password, for additional security, strong passwords and smart cards should be used.

Regular security audits – all security precautions need to be checked for their state of readines and proper working. For this regular audits should be carried out.

Personnel – Qualified personnel familiar with HIPPA requirements should be employees for system maintenance.

HIPAA to implement strict rules to Safeguard Patient Health Information

admin — Fri, 28 May 2010 04:26:24 +0000

United States Health Insurance Portability and Accountability Act is HIPAA and includes HIPAA I and HIPAA II. HIPAA I deals with health insurance rules related to people who have lost or changed their jobs. The HIPAA II is to develop a standard process that needs to be adhered to by the health providers. HIPAA II is most important and popular and sets the rules for safeguarding patient health data. This helps to safeguard the patients and the health insurance organisations from the malpractices because of fake identity.

HIPAA is implementing strict rules and regulations to deal with health insurance related malpractices like the sale of important health data of patients to lawyers to earn money. Recently action has been taken with the aim to make sharing of people’s electronic health records.

In the month of November 2009, 8 federal agencies sanctioned a notice approval form. This form makes compulsory for the health agencies to reveal to the customers the procedure through which their data is obtained and disbursed. This helps the customer to take an effective decision to avail or reject the service.

The new rule empowers the government to initiate legal proceedings against the defaulter for not adhering to HIPAA compliance, taking criminal action and levying hefty fines.

The last rule of Federal Trade Commission (FTC) in accordance with American Recovery and Reinvestment Act makes it compulsory for the health agencies to inform any violation of patient health record to the customer. The media should be informed if there is breach of 500 or more patient health data. The rule also specifies the time, matter and procedure of conveying the breach.

The Recovery act makes it compulsory for HHS or Department of Health and Human Services to carry out a research on the stakeholders that dispense health services but are not under the umbrella of the HIPAA. The intent is to draw up norms on how such parties can dispense their healthcare services simultaneously safeguarding important patient information.

Ultimately, newer and more stringent rules point towards the exercises of the regulatory bodies to put an end to malpractices that are inherent to the process despite security measures that are in place. The only intention is to ensure the electronic sharing of confidential health records safe and resistant to tampering. This will plug the losses that the state and the people incur on account of fraudulent claims.

HIPAA Emails compliance – Safeguard your private information

admin — Tue, 25 May 2010 04:32:04 +0000

In the coming years, millions and millions of patients’ data will be compiled into Electronic Health Record (EHR) systems. For this, the federal government has created a level of confidentiality for Protected Healthcare Information (PHI) and is imposing fines for breaches of HIPAA. HITECH or Health Information Technology for Economic and Clinical Health Act of 2009 allocated about $19 billion dollars to assist physicians and health care centers to accept this transition. $17 billion would be allocated to healthcare centers and physicians who utilize this system.

However, transfer of personal and private data from paper documents that utilizes direct faxes to an electronic process that relies on unsecure email will naturally raise security concerns. Data in transportation via non-secure channels can be breached with relative ease and could be used with a malicious intent. Patients are predictably worried that best practices might not be observed to safeguard their confidential data.

To be abreast of these updates in Health Information Technology (HIT), health centers and physicians are required to find and utilize safe and secure computers and email programs that are compliant with both HITECH and HIPAA standards. Just as different treatments are available for different ailments, a wide range of options exists regarding security and email applications. It can be confusing for health centers and doctors to go through such vast options and find the one that is suited to their needs and budgets.

Some organizations have implemented an economical system that can be scaled to suit your requirements. Whether it is a tiny clinic or a large healthcare center, systems can be tailored to meet the demands of their patients. There are some applications which obliterate the need for on-site IT resources or maintenance and work on most known web browser or merge with outlook email accounts too.

HITECH medical data software is anticipated to be completely implemented by 2014. With this, the US will move a step closer to the world standard of health care data storage. It will be on the same level as other first-world countries who have their data securely stored a conveniently used.

If you are a covered entity under HIPAA, then you must also make sure that your email system has the required safeguards and encryptions to ensure safe transfer of medical data.

Factors influencing HIPAA Compliance

admin — Mon, 24 May 2010 04:58:13 +0000

HIPAA was introduced in 1996 by Congress with the aim to ensure national standards for privacy and to safe guard personal health data. On April 14, 2003, the US Department of Health and Human Services passed The Privacy Rule.

HIPAA compliance needs specific attention and effort, if any failure to adhere involves high risk of reputation damage, fines starting from $100 to $250,000 and imprisonment varying from 1 year to 10 years. Different various HIPAA management efforts are required for a practice with various different systems for patient timetable, electronic and medical files and billing. This article shows an honest way to HIPAA management adherence and is a summary of main important HIPAA terminology, principles, and requisites to assist the practitioner to adhere to HIPAA compliance through medical billing and software retailers.

The last 10 years of the 19^th century saw a rapid increase of digital technology in health care, with lesser expenditure and much better service quality, also resulted in new and higher risks for accidental revelation of private health information.

Protected Health Information (PHI)

The main requirement of HIPAA is PHI, which covers any aspect that can be required to identify a person and any information or data exchanged or disclosed to other health care providers in any medium viz. digital, verbal, recorded, faxed, printed or written).

Information that is required to recognize a person includes:

Name
Health plan numbers
Zip code not less than 3 digits, telephone and fax numbers, email
License numbers
Social security numbers
Dates (excluding year)
Medical record numbers
Photographs

Details shared with other healthcare firms or clearinghouses are:

Data about treatment and billing
Notes made by nurses and physicians

HIPAA principles

HIPAA aims to ensure smooth running of PHI for healthcare operations with the patient’s approval; however, bans unauthorized PHI for any other reasons. Healthcare procedure involves payment, competence review training, treatment, care quality assessment, accreditation, auditing, legal procedures and insurance rating,

HIPAA encourages unbiased information practices and sets guidelines for those who have access to PHI to protect it.

Unbiased information practices means that a person should be permitted to

Access to PHI,
Rectifying mistakes and completeness,
Know who else are using PHI.

Protecting PHI means that the subject who possess PHI should

be responsible for self use and disclosure
have a legal source to counter violations

HIPAA – Difference between Security and Privacy Violations

admin — Sat, 22 May 2010 05:30:15 +0000

Many health vendors are joining the HITECH bandwagon and are offering their own products and services. All these, products and services, are aimed at protecting against any breaches covered under HIPAA. There has been enough communication within the industry to show that it does not properly distinguish between the two kinds of breaches, i.e., privacy breaches and security breaches.

A privacy breach is said to have been perpetuated, when a properly authenticated and authorized user looks into a patient’s record without any particular need or requirement to do so. For example, a doctor looking at a record of a patient to review information, if he is not treating that person at the moment, is termed as privacy breach.

This privacy breach has to be disclosed under the HITECH regulations. The same doctor, however, cannot be booked for privacy breach when he pulls up the records a week later, as he is treating that patient at that particular time.

A security breach occurs when there is a successful hacking carried out into a system, disks or unencrypted laptops and computers containing identifiable patient details. This also implies a privacy breach, as it is an unauthorized access to private data. But strangely enough, a privacy breach cannot be termed as a security breach.

Many experts conclude that protection against security breaches is a prevention of privacy breaches. Prevention of security breaches can be easily accomplished through a two-factor authentication at the data workstation, locking terminals to prevent improper and unauthorized usage of data; other authentication approaches for clinical users should also be included. The latter is an important way to prevent privacy breaches, but is the more difficult of the two to achieve.

The introduction of HITECH regulations has extended the bite of the HIPAA framework. Healthcare organizations are now required, under law, to disclose a patients privacy breach to the patient who has been effected. In certain cases, a notification of the same has to be made to the secretary of Health and Human Services. This much talked about HIPAA and HITECH compliance and the application and desktop virtualization can therefore be an effective means of protecting against security breaches.

HIPAA and Your Medical Records

admin — Fri, 21 May 2010 04:35:14 +0000

Safety and privacy of you medical records are extremely important as they allow our doctors to provide correct treatment to us and avoid misdiagnosis of our illnesses. Records must also be stored in a safe and secure manner, so that they don’t fall in the wrong hands. Most people want to keep their medical history under wraps and HIPAA has made it mandatory to all those people who handle such records to keep them private.

HIPAA has given a number of rights to an individual regarding his or her medical records. The individual can demand to see his medical records from his doctor or the hospital where he is getting the treatment. The individual has the right to demand the records without providing any specific reasons for it and the doctor or hospital must give him a copy of his records within 30 days of the request.

But the institution or doctor can impose a small fee in return of the provided records. If the patient wants them to post the records, then he will have to pay for the postage and handling charges. Even though, you will get most of the information in your medical records, but in some rare cases, your doctor may hold some information from you. This is done in the cases where the doctor feels that disclosing a particular piece of information may hurt you or people around you or endanger your health in any way.

Even though with the introduction of electronic medical records and strict rules, the chance of error in medical records has decreased considerably, but still, you can get any mistakes in your medical records rectified. Similarly, if there is an omission of certain information from your medical records, then it’s the duty of the hospital or doctor who issued the records to correct it and provide the updated version of records free of cost.

Even if your doctor or hospital doesn’t think that there is a mistake in your medical records, you can still ask them to register your disagreement in your medical records. This will inform your future doctors about the conflict of opinions between you and your doctor.

Our medical history is extremely private to us and it should stay that way. Thankfully, HIPAA has provided many rules which ensure that nobody can abuse our privacy.

Features of HIPAA Training

admin — Mon, 10 May 2010 04:40:54 +0000

As per rules of HIPAA, every individual whose working in a covered entity and handles medical records (electronic and on papers) of patients, must undergo HIPAA certification training. This training must be provided a qualified instructor.

This training is provided by independent training centers. Companies hire professionals from these centers to train and educate their employees and high level management about every aspect of HIPAA. Once the training is completed, the training institutes provides a HIPAA certification to every employee who has completed the training successfully. These certifications are used to prove the skills of the employees during OCR inspections.

HIPPA training can be done in many different manners. The employees can choose a one-on-one instructor led training method, classroom training, online training, virtual classroom training or on-site training. Different companies choose different methods to provide this training.

Covered entities like hospitals, health insurance providers, healthcare clearing houses etc. are required by the law to provide training to their employees. Failure to comply with this law might end-up in a fine for them. Most covered entities prefer to provide group training instead of one-on-one training as it is much more time consuming. In big companies, one-on-one training may also cost too much and disrupt the company’s budget.

On-site training is also more preferred as compared to classroom training as the employees can get first hand idea about how to manage the records and other formalities in their own work place. This also saves a lot of time of the employees and they don’t need to waste time in commuting to and from the training center.

But classroom training also has a number of benefits. It provides a more focused training as students only concentrate on their training and are not interrupted by constant phone calls and emails at their workstations. Classroom training also facilitates better interaction between students, which facilitates a better understanding about training. Visual and hearing aid can also be provided in the classroom training to help the students.

If you are planning to arrange for HIPAA training sessions for yourself or your firm, make sure that the training provider you choose is capable in handling your firm. Every company has different requirements in terms of situation, time period and method of training. Training provider must be capable in this.

HIPAA training is an important aspect of the HIPAA law and should not be taken lightly.

What are HIPAA Standards?

admin — Fri, 07 May 2010 04:29:56 +0000

All the professionals and workers working in the health care industry in America are required to comply with HIPAA standards. This federal law ensures that patients who have a pre-existing condition get the right insurance coverage and are not excluded on these grounds by their health care provider.

This law also prevents malpractice by insurance companies and doctors and also provides a savings account for medical purposes. This law was in response to the demand of health industry to shift to electronic transaction standards to help hospitals and other concerns cut cost and increase the security of the medical records of patients.

Thus HHS or Department of Health and Human Services created HIPAA standards to control and regulate administrative and financial transaction in medical field. They have created codes for health plans, hospitals, retail pharmacies, nursing homes etc. to ensure security and privacy of identifiable information in medical records of individual.

These codes were standardized so that the multiple versions of electronic HCFA 1500 and UB-92 can be replaced. These standards were adopted back in April 2007 and are applicable to all kinds of health plans, clearing houses, hospitals etc. These standards streamline billing and make the inquiries for eligibility and referral authorizations much easier.

The required transactions codes are:

Health plan identifiers
Country codes
Employer identification number
Provider taxonomy codes

Based on these standards, a transaction through HHS HIPAA is performed in following manner:

A person is enrolled into a health plan and pays the premium on it.
His eligibility is verified.
His referral is authorized electronically or via phone or fax.
A health care claim is made by the insured person.
Bills and documents are submitted to prove the claim
The claims are checked and verified.
If there is no dispute, then the claim is remitted to the patient.

All the covered entities under are required to conduct electronic transactions for everything, including eligibility confirmation and sending claims through a clearinghouse.

HIPAA standards have made the task of managing and clearing health insurance claims really fast. It has also reduced the chances of human error or delay in delivery as all the data is now transferred electronically.

Hipaa.In » HIPAA

Reasons medical businesses should comply with HIPAA regulations

Related Hipaa Posts

Increasing Computer Network Security for effective HIPAA Compliance

Related Hipaa Posts

HIPAA and the Internet: Intranet Collaboration Software requirements

Related Hipaa Posts

HIPAA to implement strict rules to Safeguard Patient Health Information

Related Hipaa Posts

HIPAA Emails compliance – Safeguard your private information

Related Hipaa Posts

Factors influencing HIPAA Compliance

Related Hipaa Posts

HIPAA – Difference between Security and Privacy Violations

Related Hipaa Posts

HIPAA and Your Medical Records

Related Hipaa Posts

Features of HIPAA Training

Related Hipaa Posts

What are HIPAA Standards?

Related Hipaa Posts