Health Information Compliance Alert

Caveat: However, size and scope don’t necessarily factor into enforcement, and recent settlements have shown that OCR can be tough on smaller healthcare providers, depending on the situation.

“Small organizations can be penalized for violations. The costs of responding to a data breach add up based, in large part, on how many patients are involved, rather than the size of the entity experiencing the breach,” warns Hartsfield.

Consider These Tips

Luckily, there are several things that small practices can do to build their HIPAA compliance plans — and ensure they are implemented according to the Rules. For instance, as part of its training resources, OCR offers “a beginner’s overview of what the HIPAA Rules require, security training games, risk assessment tools, and other aids,” online guidance says. The agency partners with the HHS Office of the National Coordinator for Health Information Technology (ONC) to provide CEs and BAs with these resources.

Even with the plethora of federal resources and guidance available, compliance planning can be daunting and complicated. “Security Rule compliance still requires significant effort and IT-related expertise so, no matter the entity’s size, it may be necessary to hire qualified consultants to help with the risk analysis process,” Hartsfield says. And “beyond the risk analysis, covered entities and business associates must also develop a written plan to manage and mitigate the risks identified. They must also update the risk analysis as needed,” she advises.

In smaller practices, the appointed security officer needs to cultivate compliance and educate the new employees on the HIPAA Rules. Workforce compliance training needs to be ongoing and take into account both state privacy laws and federal updates, too. “Training isn’t something that is given once to a new employee and never again. Training also has to be documented,” says Hartsfield.

Overall, HIPAA training programs must resonate with staff, boost security awareness, and align with the CE’s specific needs, policies, and protocols.

“If your workforce members have not been trained in your policies and procedures, it not only increases the risk of a data breach, but it could result in increased penalties if that breach happens,” Hartsfield cautions. “Staff must be trained in the privacy and security policies and procedures they need to know in order to do their jobs and keep the data they handle private and secure.”

BAs also need to up their game on HIPAA compliance, too. “Some business associates only offer employees canned training modules designed for providers, so there is a risk that the employees won’t understand the special requirements for business associates. A telehealth physician may need different training than an in-person receptionist,” for example, Hartsfield points out.

Resources: Check out OCR and ONC’s online tools at www.healthit.gov/topic/privacy-security-and-hipaa/health-it-privacy-and-security-resources-providers. Review the HITECH amendment at www.congress.gov/116/bills/hr7898/BILLS-116hr7898eh.pdf.