Based on prior statements from the OCR and their recently distributed survey, the pool of audit candidates will be approximately 800 to start. These randomly selected organizations will be chosen using the National Provider Identifier database and other external sources.
Who would have thought back in 1990 that someone in China or Russia or anywhere would be able to steal health information in a hospital in Anytown USA and even hold it for ransom.
Healthcare seems to be the #1 target for hackers and ransomware and there are two (2) main reasons that make up the root cause.
Imagine trying to come up with the top ten things our planet should do to decrease vulnerabilities and threats. Looking at earth from 30,000 feet can make that seem easier to do. But if we zoom in to the details we could probably come up with hundreds of things to consider. The same is true with health information privacy and security. To come up with what we consider to be the top ten things to do to pass an Office for Civil Rights (OCR) audits and reduce risk of unauthorized access to your protected health information (PHI), we had to zoom out and look at what we have observed over the past several years from a very high level. Our top ten things to do are not listed in any particular order. Keep in mind that our top ten today will most likely change very soon and at least year to year. Here they are:
Since we are talking about healthcare information we must talk about protected health information (PHI) and the HIPAA-HITECH-OMNIBUS Privacy, Security, and Breach Notification Rules. BI and Big Data analysis that includes PHI and its use and disclosure must be reviewed against the HIPAA security and privacy requirements and the breach notification requirements.
The numbers of individuals involved in recent breaches have been huge in relation to the magic number of 500. We all read about breaches involving millions of individuals. Some of the recent cyber attacks have potentially resulted in numbers up to 10 million. Compare that to 500, and you have to wonder if that metric is going to increase, and where will it all end. How big can future breaches become?
Journal of Healthcare Information Management – (JHIM) – Winter 2015 Used by permission from HIMSS. Download the JHIM PDF version of this article The authors have written a number of JHIM columns regarding HIPAA-HITECH-Omnibus, (HIPAA ,Heath Insurance Portability and Accountability Act; HITECH, Health Information Technology for Economic and Clinical Health) etc., and have focused at … Continue reading Accountable Care Organizations & Health Information Exchanges (An Information Security Survey)
It is hard to believe that the HIPAA Security Rule was written when most medical records were only in hardcopy format. Today, HIPAA CEs and BAs must make sure they understand their current vulnerabilities that could impact how they protect PHI. We read about PHI breaches on a regular basis, and some have been huge. This kind of news has certainly caught the attention of healthcare leaders. The key is to continually have a program in place to assess changes that result from innovation and try to stay one step ahead of related potential vulnerabilities.
Could your organization be selected for an audit? The answer is obviously yes. So how do you prepare? We recommend that your organization conduct a document review and organize all your HIPAA privacy, security, and breach notification policies, procedures, plans and evidence of due diligence in one place for easy access to provide to OCR. Remember that OCR only provides a two-week notice. If your organizations documentation is not organized, two weeks may not be enough time to get ready for the audit.
(Journal of Healthcare Information Management – (JHIM) – Winter 2014 – Used by permission from HIMSS). By now we all know that “ePHI” refers to electronic protected health information. Unfortunately, based on the number of breach notifications we read about, it seems that PHI has been anything but protected. The authors continue to receive e-mails that report breaches on a regular basis. There are even questions being raised about the privacy and security controls or lack thereof on the federal health insurance exchange website. It is difficult to imagine that the federal government’s website for healthcare insurance exchange is not in compliance with the federal government’s HIPAA OMNIBUS Rule.