Home Health & Hospice Week

Would you pass the test of interviewing 15 randomly selected staffers on HIPAA?

In its recent HIPAA settlement, a Massachusetts medical center paid a big price for its employees lacking HIPAA knowledge.

Part of St. Elizabeth’s Medical Center’s corrective action plan and Resolution Agreement with the HHS Office for Civil Rights required SEMC to assess its workforce members’ knowledge and compliance with its HIPAA policies and procedures, noted attorneys Elizabeth Hodge and Thomas Range in a case analysis for Akerman. The specific P&Ps include those that address:

• Transmitting ePHI using unauthorized networks;
• Storing ePHI on unauthorized information systems, including unsecured networks and devices;
• Removing PHI from SEMC;
• Prohibition on sharing accounts and passwords for ePHI storage and access;
• Encryption of portable devices that access or store ePHI; and
• Security incident reporting related to ePHI. To conduct the self-assessment, SEMC has to make unannounced site visits to five of its departments, interview 15 randomly selected workforce members, and inspect at least three portable devices at each of the five departments. Based on the selfassessment, SEMC must then determine if it needs to revise its HIPAA policies and procedures.

Do this: “Effectively educate workforce members about [your organization’s] policies and procedures, including the reporting of suspected security incidents or other potential HIPAA breaches,” the Akerman attorneys recommended. “Workforce members must know the organization’s contact person to report suspected improper uses or disclosures of PHI.”

Lesson learned: You may want to take this Resolution Agreement to heart and use it in your HIPAA education and compliance preparations. Conduct your own self-assessment to determine the effectiveness of your organization’s HIPAA policies and training, the Akerman attorneys suggested.

“This settlement shows that it is not enough to have the required policies. Rather, your workforce members must also understand and follow them.