Home Health & Hospice Week

With aggressive cyberattacks against Change Healthcare, Ascension Health, and other providers in the headlines, you may be revisiting how to manage your risk of a such a crime. But stopping a data breach incident and retrieving the compromised records is just the start of mitigation requirements under the HIPAA, experts warn. The law also requires you to levy sanctions on staffers who cause inappropriate protected health information (PHI) disclosures under HIPAA.

Open lines of communication and equitable policies elevate compliance, too, says HIPAA expert Jim Sheldon- Dean, founder and director of compliance services at Lewis Creek Systems in Charlotte, Vt. “Establishing trust and showing that the organization treats security issues fairly are key to organizational success with sanctions. Where there is found to be an intentional violation, disciplinary action is a learning moment for other staff, and where there is an accidental violation, it’s a learning moment for the organi­zation,” Sheldon-Dean asserts. “What can we do better to keep this from happening again? Make issues a positive, and praise those who find them, as well as fix them,” he says.

2. Re-educate. Additional training should be a part of the sanction policy. “Sometimes documented counseling is an appropriate sanction,” Hartsfield expounds. “A sanction could involve re-training the people involved, or even looking at whether an entire department should be retrained to make sure that potentially systemic problems don’t continue.”

Sheldon-Dean agrees. “If it’s accidental but the employee should have known, the incident needs examination as to the cause of the issue.” He suggests asking, “Is there a training deficiency? Do systems or processes encourage such mistakes? How widespread a problem is this?”

However, punitive action “may be appropriate if an employee has already been warned about an accidental issue and nobody else is having the same problem,” Sheldon-Dean maintains.

3. Factor Remote Work Into Your Sanction Plan, Too. The combination of remote work, the use of personal devices, and decreased information technology budgets make it harder to regulate data security — and that makes implementing a sanction policy more complicated. Risk assessment and analysis are critical components of compliance planning as required under the HIPAA rules and can help you address the intersection of remote work and sanction policy­making.

“Covered entities (CEs) should document the risks relating to remote work and how those will be mitigated,” Hartsfield says. Then they should implement systems and processes to require secure connections when remote workers access PHI. CEs should also audit and monitor remote workers for compliance.

Tip: Employing security safeguards like multi-factor authentication from the start can thwart potential security issues both in the office and for remote workers, Sheldon- Dean says. “This makes access more consistent across the organization for all roles and simplifies a lot of IT headaches. If there are still policy violations, see if access can be tightened, and use the incident as a training moment,” he advises.

Note: Find the OCR Cybersecurity Newsletter at www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-october-2023/index.html.