Posts Tagged: HIPAA

What Is ViewMaster?

Posted November 19, 2019 by Beth Osborne & filed under Healthcare, Pharmacy.

Record retention isn’t an option in healthcare. There are many regulations in place that define how many years of patient data you must retain. However, the process you are using now may be inefficient and at risk of a breach. Meeting regulations and compliance factors must be balanced with ease of access. To eliminate challenges, we created V iewMaster, a web-based transaction viewing tool.

Why You Should Archive

If you currently still have a legacy system in use to satisfy record retention policies, then you certainly have pain points. Searching through an old system isn’t easy and can be time-consuming. Should you be faced with an audit by a regulatory board, it may take you a substantial amount of time to create a report.

Further, patient information may be at risk for a breach. That’s because legacy systems may no longer be receiving updates, which can make them vulnerable. The other big issue with keeping old platforms in place is the cost. Even if you no longer use it, you’re probably paying a monthly fee.

You can search fast, create reports, and ensure the security of your data with ViewMaster. This system allows you to archive data, images, and documents.

How Does Archiving Work?

Typically, pharmacies or healthcare organizations choose to archive when they move from one software system to another. They decide not to carry over all their data to the new system, which is usually 18 months to two years of data. However, they still need to retain other documents for 10 years at a minimum.

They choose to archive so that their data conversion is smoother and less complicated. Our solution allows users to log into the system for any web browser and immediately search and filter as necessary.

In an archiving project, our team receives the data, documents, and images from your current system then digitizes each of them. You can store numerous image types. This includes critical images like signatures of patients acknowledging they picked up their prescriptions and did or did not request a consultation with the pharmacist.

More ViewMaster Benefits

One of the things pharmacies and healthcare love about the platform is that it’s a one-time charge. There are no monthly fees! Organizations don’t have to worry about compliance, as the tool meets HIPAA and HITRUST regulations with encrypted and secure data.

With ViewMaster, you can satisfy all the requirements for record retention and reporting from entities such as the Board of Pharmacy, CMS, DEA, and more. It’s a true turnkey solution to the challenges of meeting requirements while also maintaining security and privacy.

It’s super simple to use as well. Your staff can use it in minutes. It has an intuitive user interface, so you can find what you need in minutes. If you have multiple locations, you can search across them. You can also set up specific user permissions so that each individual can also see what is pertinent to them.

It’s time to ditch legacy systems and archive. Get started by requesting a five-minute demo of ViewMaster.

Social Media and HIPAA: How to Be Smart in the Digital World and Remain Compliant

Posted November 12, 2019 by Beth Osborne & filed under Healthcare.

HIPAA was passed long before the launch of social media networks. In fact, HIPAA, passed in 1996, preceded the digital world. However, social media and HIPAA have now become a real concern in the 21st century with HIPAA updating its policies on the subject. There are many benefits to leveraging these sites for healthcare, but it comes with a warning. Many healthcare providers have been the subject of fines and violations due to noncompliant social media activities.

The First Rule of HIPAA and Social Media

Rule number one: don’t post protected health information (PHI) on social media! The HIPAA privacy rule prohibits the use of PHI on any social media profile for any reason. This includes text and images. The only exception is if you have written permission from the patient to do so. For example, many providers include testimonials or case studies around a specific patient’s journey. This type of content can be very compelling, but, of course, requires patient authorization.

As providers, patients, and other stakeholders navigate the modern digital world; it’s often a murky area of what’s legal and what’s not. That’s why every healthcare organization should have documented rules about social media. Social media is not the channel to discuss PHI or even respond to questions or reviews with any snippet of PHI.

While it’s certainly human nature to want to respond on social media, the approach must be compliant and careful. In these types of channels, providers may feel helpless, as consumers basically have free reign to review the provider. However, the provider doesn’t have that same luxury.

Such a case occurred this year in which a dental practice responded to a Yelp review and allegedly disclosed PHI. The settled the dispute with OCR for a $10,000 fine. OCR found that the organization had actually violated HIPAA on several occasions.

How Providers Can Respond Compliantly on Social Media

Providers do have options when responding on social media. But they must always be HIPAA compliant. Here are some ways to craft compliant responses:

Respond in general terms with a standard response: while many other companies reply with specificity, that’s a no-go here
Reach out to the patient directly rather than responding on social media
Draft a response that says you’ll be in touch with them to discuss their concerns (with this approach, you are telling others that you are aware of the situation but will handle it offline)

Responses like these should be documented in your social media training for staff. Training on social media and HIPAA should occur before the employee comes on board and be further supported with refresher training.

What Are the Most Common Social Media HIPAA Violations?

Along with responding to patient posts or reviews, several other violations have been repeat offenders, including:

Posting of images or video of patients without approval
Gossiping about patients
Using any type of information that could lead to a patient’s identification
Sharing images within a healthcare organization where PHI is visible (i.e., don’t take a picture of a physician at his desk while there are patient files there!)
Distributing any content about patients within a social media private group (it may be private, but it’s still not compliant)

HIPAA Social Media Guidelines

Your organization should have HIPAA social media guidelines. Here are some ideas on what to include:

Ensure awareness with HIPAA compliance and social media through consistent training
Provide examples to staff on what would be a compliant type of post
Communicate to staff the consequences of HIPAA noncompliance
Review and update policies annually based on new rules, regulations, and usage
Make sure that company and personal profiles are separate
Maintain a record of social media posts in the event of an audit
Encourage staff to report any possible violations
Moderate all comments on platforms
Include social media in your risk assessments

While there are many constraints with social media, the healthcare industry shouldn’t just abandon it. Social media is a way for you to provide critical information, share industry news, and promote patient stories (with approval). You just have to balance your social media engagement strategy with remaining HIPAA compliant.

HIPAA Trends and Emerging Challenges: What to Expect in 2020

Posted October 15, 2019 by Beth Osborne & filed under Healthcare.

HIPAA is now over two decades old. In that time, much has changed. When it was written, the Internet was in its infancy, and most healthcare data was still on paper only. The objective of HIPAA was to modernize the flow of healthcare information and protect patients from fraud and theft. HIPAA compliance is critical to every healthcare organization, but that doesn’t mean it’s easy to keep up with HIPAA trends and emerging challenges.

To help you prepare for any changes in 2020, we’re breaking down what to expect in the next year regarding HIPAA regulations.

National Patient Identifier

As part of HIPAA’s passage in 1996, a National Patient Identifier was to be established. However, Congress overruled the legislation and restricted funding to develop it. In June of 2019, the House voted in favor of lifting this ban. There are two sides to the argument.

Most health IT leaders believe that creating an identifier is vital to solving challenges with patient matching and has the potential to minimize medical errors and misidentification. The American Health Information Management Association (AHIMA) supports the lift of the ban and development of the identifier.

The identifier could help reduce interoperability issues, as well. The fierce objections to the identifiers are still coming from politicians, namely Sen. Rand Paul, R-Ky. He introduced a repeal act of the identifier in Congress recently. Paul argues that the national identifier would threaten patient privacy. Critics say his arguments are without merit and don’t align with the current reality of healthcare data needs.

A healthcare identifier for Medicare beneficiaries has been approved and goes into effect on January 1, 2020. This is a HIPAA trend that will continue to be a hot topic in the next year.

Compliance and Enforcement HIPAA Trends

Enforcement of HIPAA by HHS OCR has been picking up speed in 2019. After a record-breaking year of recovery of over $28 million, the OCR started 2019 with a $3 million settlement related to two breach incidents.

Later in the year, the OCR announced its first settlement under the Right of Access Initiative. The case involved a healthcare organization that failed to respond to a patient’s request for medical records in a timely manner. With this settlement, it sends a clear sign that entities will be held accountable for not providing access to patients per HIPAA requirements.

The largest settlement in 2019 will reportedly be a fine of $145 million paid by Allscripts Healthcare Solutions. The settlement is in reference to Practice Fusion, an entity purchased by Allscripts in 2018 that was under investigation regarding HIPAA’s anti-kickback statutes.

Data breaches continue to be an Achilles heel for healthcare. Healthcare again leads all industries in cybersecurity attacks and data breaches. What’s interesting and provides context to this statement is that most incidents originated inside the organization.

Healthcare organizations must begin to evolve and modernize their infrastructure to combat this. They should also think of HIPAA compliance as a baseline and exceed requirements for better protection.

More Risk Assessments Will Occur

Healthcare organizations often think, incorrectly, that general insurance will cover a data breach. This is rarely the case. To ensure companies have insurance, they’ll likely need to perform risk assessments, which are already part of HIPAA audits. While you can undergo a risk assessment internally, it’s often a good idea to work with an experienced third-party expert.

Social Media Continues to be a Compliance Miss

There have been many tales associated with social media and HIPAA noncompliance. Social media is another channel for communication and must be treated with the same perspective. Under HIPAA, violations on social media networks include:

Gossip or hearsay posted to unauthorized individuals even if no name is disclosed
Sharing any patient photos without express permission
Posting pictures from your office that contain any visible patient files
Directly publishing any PHI

Much of this noncompliance challenges comes to appropriate employee training. Organizations need to have a clear and accessible policy on social media, so there is no room for misinterpretation.

State AGs Ramping Up General HIPAA Enforcement

While the healthcare industry generally thinks about the OCR as the agency to be concerned about the most, they can’t overlook state attorney generals. State AGs are becoming more active and have begun to band together to initiate multi-state suits.

In addition to OCR, states are bringing their own actions on entities found to be in violation of HIPAA. The OCR is profoundly encouraging state AGs to take a stand. They were once not really a party. That all changed in 2010 when the Connecticut AG took aim at a company responsible for the breach of 446,000 patient records in the state.

Since then, multiple state AGs have sued noncompliant businesses and recouped monies on behalf of their impacted residents. That isn’t expected to decline. Research has shown that of the enforcement actions taken by state AGs, much of the time ePHI is the risk. Yet another reason to strengthen cybersecurity programs.

As technology advances and new innovative tools like AI and blockchain become part of the healthcare infrastructure, there will be new HIPAA trends to consider. Healthcare organizations must be proactive, rather than reactive, in sustaining HIPAA compliance and data security. We’ll keep you updated. Stay in touch by subscribing to the blog.