HIPAA Audit and Enforcement Update for 2021 - Providing Access and Securing PHI

MentorHealth
Date: Tuesday October 19, 2021
Time:

10:00 AM PDT | 01:00 PM EDT

Duration: 90 Minutes
Instructor: Jim Sheldon Dean
Webinar Id: 802491

 Live 

$139.
One Attendee
$299.
Unlimited Attendees

Recorded

$179.
One Attendee
$379.
Unlimited Attendees ?

Combo

Live + Recorded
$269 $318  
One Attendee
Live + Recorded
$599 $678  
Unlimited Attendees ?

Overview:

While the worldwide pandemic has prompted some relaxation of HIPAA requirements in specific circumstances to ease provision of medical services while preserving social distancing requirements and addressing emergency vaccination needs, enforcement of HIPAA has continued.

HHS OCR has focused heavily on compliance with the HIPAA rules on individual access of information, with approximately one enforcement settlement per month since September of 2019, and the new Information Blocking rules provide a fresh impetus for HHS to keep up the pressure. At the same time, enforcement actions continue for other violations, such as systemic noncompliance, lack of security risk analysis, and improperly addressed business relationships between affiliated entities.

Recent enforcement actions show a willingness for HHS to work in conjunction with State Attorneys General to bring about settlements for violations of several laws at once, a new emphasis on the importance of prompt action on requests for individual access of Protected Health Information (PHI), and a new crack-down on doctors’ responding to patients’ social media posts and including PHI in the posting.

New guidance from HHS about the liability of Business Associates for compliance makes it more clear what Business Associates are liable for, and what responsibilities for HIPAA compliance remain in the Covered Entities’ hands. Both Covered Entities and Business Associates need to be prepared for the enforcement distinctions and responsibilities.

In this session we will discuss the enforcement actions that have been taken, and the lessons that can be learned from those actions. We will explore what kind of issues were most prevalent and what kind of entities had the most problems, and show where entities need to improve their compliance the most based on real enforcement experience.

Even though the HIPAA audit program is on hold for at least the time being, that doesn’t mean there will be no enforcement of the HIPAA rules. In fact, preparing for a HIPAA Audit is one of the best ways to be ready to respond to any enforcement action, and going through an internal HIPAA Audit will help you find issues before they become problems that can lead to penalties.

USDHHS has published a protocol for the HIPAA audits, so it is possible to know how to prepare for an audit or enforcement review. Nearly any health care covered entity may be subject to an audit or enforcement investigation; all entities need to know what kinds of questions they’ll be asked, what information they'll need to provide and how to prevent issues that could lead to violations and fines. Being ready to reply to an inquiry can help minimize potential penalties.

Why you should Attend: The US Department of Health and Human Services (HHS) has been busy with enforcement focused on individual access and information security as well as new areas and on new kinds of entities, and compliance responsibilities for HIPAA Business Associates have been clarified. At the same time enforcement has been relaxed during the pandemic emergency for some HIPAA Business Associate requirements pertaining to telemedicine and vaccination appointments.

The HHS Office for Civil Rights (OCR) recently increased the penalty levels for HIPAA violations and indicated a new emphasis on the culpability of organizations when determining penalties for rule violations. If you have taken steps to be in compliance, you will be treated less severely than if you have ignored compliance. Taking steps to meet compliance requirements can help minimize potential penalties, according to the new HIPAA Safe Harbor Law.

Areas Covered in the Session:

  • Fines and penalties for violations of the HIPAA regulations have been increased and include mandatory fines for willful neglect of the rules that begin at over$10,000 minimum, but showing due diligence can reduce culpability and penalties
  • Find out what HHS OCR is likely to ask you if you are selected for an audit or enforcement review, and what you'll have to have prepared already when they do
  • The HIPAA Audit Protocol will be examined along with the sets of questions asked at other HIPAA audits previously
  • HIPAA enforcement actions will be explored, to illustrate violations that can be avoided and the proper practices that can help compliance
  • Relaxation of enforcement for the pandemic will be explained, including how it works during and after the emergency
  • Learn how having a good compliance process can help you stay compliant more easily
  • Find out what you'll need to have documented to survive an audit or enforcement review and avoid fines
  • Learn how to use the contents of the HIPAA Audit Protocol as the foundation of your compliance activities and documentation

Who Will Benefit:
  • Compliance Manager
  • HIPAA Privacy Officer
  • HIPAA Security Officer
  • CEO
  • Office Manager
  • HR Director
  • Privacy Officer
  • CIO
  • Records Release Manager
  • HIM Manager
  • Counsel

Speaker Profile
Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities.

Sheldon-Dean serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and is a recipient of the WEDI 2011 Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference in Washington, D.C.

Sheldon-Dean has more than 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related Web sites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master's degree from the Massachusetts Institute of Technology.


You Recently Viewed