Husch Blackwell’s Wakaba Tessier and Erica Ash have published a post on Husch Blackwell’s Byte Back privacy blog detailing a new announcement from the Office of Civil Rights of the U.S. Department of Health and Human Services that relaxes the HIPAA Security Rule in response to the COVID-19 crisis, expanding on our previous discussion on
The U.S. Department of Health & Human Services Office for Civil Rights (OCR) released its plans for Phase 2 of the HIPAA Audit Program (Phase 2). Whereas Phase 1 was a pilot program conducted by KPMG and intended to assess the controls and processes of 115 covered entities with respect to HIPAA compliance, in Phase
My New Year’s resolutions will likely be broken early and often in 2016. My consequences are mostly non-monetary: a few more pounds, a little less savings, and not winning the triathlon in my age group. Your consequences, as a HIPAA-covered entity or business associate, for not complying with the Privacy and Security Rules could be much greater, and could put you into serious debt to the HHS Office of Civil Rights (OCR). Therefore, we propose that you resolve now to become fully HIPAA compliant in 2016.
OCR delivered an early holiday gift, wrapped in the Director’s Sept. 23, 2015, report to the Office of Inspector General. In that report, she disclosed that OCR will launch Phase 2 of its HIPAA audit program in early 2016, focusing on noncompliance issues for both covered entities and business associates.
So, grab that cup of hot cocoa and peruse this review of 2014-2015 HIPAA enforcement actions, which should help identify noncompliance issues on which OCR will focus in 2016.
Continue Reading HIPAA compliance: another year older, but hopefully not deeper in debt
Cancer Care Group, P.C. settled alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules on September 2 with the U.S. Department of Health & Human Services Office for Civil Rights (OCR) for $750,000. Cancer Care, a radiation oncology private physician practice located in Indiana, also agreed to adopt a corrective action plan to remedy defects in its HIPAA compliance program.
Continue Reading $750K HIPAA settlement highlights importance of risk analysis, device control policy
The Anthem breach sent alarm waves through the health care industry and the employer health plan community. With 78.8 million affected individuals for Anthem and 11 million for the companion breach of Premera Blue Cross, the combined size ranks among the largest data breaches in history.
The Anthem and Premera breaches signal a sea change in the threat environment for health plans, a new reality that requires a fresh look at data security. Prudent employers with group health plans should take that fresh look now, by strengthening the data security provisions in their business associate agreements (BAAs) with third-party plan administrators, and also by updating their HIPAA-required security risk assessments.
Continue Reading Data Security for Employer Health Plans Post-Anthem
On January 17, 2013, the Office for Civil Rights of the U.S. Department of Health & Human Services issued its final rule modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act. The final rule
Pediatric critical care transport teams at the Alfred I. duPont Hospital for Children in Wilmington, Delaware participated in a study using iPads to communicate about the patient’s condition prior to and during transport. The study, which was funded by the Nemours Fund for Children’s Health, found that use of iPads provided better communication between the
Recently, the U.S. Department of Health and Human Services (HHS) announced a settlement with the Hospice of North Idaho (HONI) for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. The settlement, which was for $50,000, is unique because it is the first settlement involving a breach of electronic