The Datamax Thinking Blog

2018 was a record breaking year for OCR enforcement of HIPAA fines and settlements.

When it comes to HIPAA violations, healthcare organizations for years have gone the way of the ostrich, burying their heads in the sand at the prospect of facing penalties from the Office for Civil Rights (OCR).

But if the last year proved one thing, it’s this: You can run, but continuing to hide is a potentially costly risk. 

The right technology partner can ensure long-term wellness for your organization: From security/compliance peace of mind, to highly efficient workflow processes and optimal uptime on your fleet of equipment. 

An annual check-up is a routinely prescribed course of action for adults to ensure long-term wellness. But that’s not the end-game.

True wellness is not defined by any one current ailment or appointment; it’s an actively pursued goal of maintaining good health based on a myriad of ongoing good habits. To ensure overall wellness for their print fleet, a healthcare organization needs much more than an annual checkup.

Paired with a barrage of potential threats, yet brimming with productive potential, technology plays an intimate role in the routines of today’s business workday. When well harnessed, it can unlock unforeseen competitive advantages.

Henry Ford once said, "I don't read history. That's in the past. I'm thinking of the future."

Ford, of course, was the Michigan-born engineer who developed a petrol-driven quadricycle into a small car; this proved the basis for the famous Model T motor car introduced in 1908. Just as Ford’s ingenuity forever transformed the auto industry, technology has been a driving force in business transformation for years.

As we look at the state of technology as it relates to business in 2019, Ford’s quote has a profound foreshadowing effect.

Your plan should begin with a Security Risk Analysis. It should also continue with the construction of a long-term compliance framework, one that offers visibility into current risks and reinforces firm security-related policies and procedures. 

When it comes to your healthcare organization and HIPAA, failure (to comply) is not an option.

It cannot be a one-time snapshot, or a one-time risk assessment. It has to be a continuous, ongoing process." -  Navin Balakrishnaraja, National Practice Director, Healthcare IT Services for All Covered (IT Services, Konica Minolta)

All organizations are guilty of just “going through the motions” at times.

A client services specialist leaning too heavily on his company script. The sales representative who meets her quota but fails to concentrate on continued professional development (aka, the learning zone). There are countless scenarios within a work place where crucial tasks are tackled without enthusiasm or a particular level of involvement.

But few, if any, carry the level of risk of a healthcare facility just going through the motions with its cybersecurity plan. The organization must navigate this landscape carefully, and with a trusted map that leads to long-term security and compliance for the unpredictable journey ahead.

Whether they are complying with HIPAA or attesting to the Merit-based Incentive Payment System (MIPS) under MACRA for positive incentives, healthcare professionals cannot avoid (and certainly cannot AFFORD to avoid) the Security Risk Analysis.

For many health organizations, the elephant in the waiting room is still seated there, anxiously anticipating when it might be acknowledged or tended to.

That elephant is the Security Risk Analysis (SRA). Originally mandated by HIPAA and subsequently further enforced by government programs such as Meaningful Use and now the Medicare Access and CHIP Reauthorization Act (MACRA), the SRA is a vital component to both healthcare facilities’ ultimate livelihood and the confidential information of their clients.

You want to be HIPAA-compliant? You need to perform a risk assessment with the help of a Certified HIPAA Professional (CHP).

It's impossible to watch the news without weekly revelations of some new data breach – Target, Equifax, the WannaCry virus, and even teddy bears have been in the news.

As cybercrime continues to pay, attacks and breaches will continue and will especially affect unprepared businesses.

One industry is squarely in the crosshairs of hackers – healthcare.

For organizations that have to accommodate less voluminous records and for those organizations that only need to convert documents from the day record digitization begins, many copiers will be up to the task.

It is absolutely vital that records are readily accessible to ensure that your patients receive the best care possible. This means that every organization, from the largest hospital to one-person general practitioner practices, needs to be able to obtain patient records. Every individual involved in a patient's care, from doctors to nurses, need to be able to view a patient's medical history.

While access is key, HIPAA (Health Insurance Portability and Accountability Act) and the HITECH (Health Information Technology for Economical and Clinical Health) Act have established strict standards for ensuring the security of those records. A balance must be struck between access and security.

When seeking to find that balance, paper records can hold you back and make compliance more difficult. Paper records are difficult to share and not inherently secure, since documents can be lost, misplaced, or stolen.

Being HIPAA compliant doesn't just protect you from fines; it helps protect your patients' trust in you.

The federal government requires all organizations and individuals who handle patient health information to be HIPAA compliant. Office managers must work to ensure that all confidential patient information is only viewed by authorized personnel and is protected against theft.

The HIPAA rules that apply to medical offices take up 115 pages. It is absolutely vital that you read through all the rules to ensure that you are in compliance. In 2013, HIPAA policy changed. After reading through those changes, Medical Economics identified seven potential violations that could leave your office open to fines that range from $100 to $50,000. Here are those seven issues and how to ensure you are HIPAA compliant.

To comply with HIPAA, you must ensure PHI confidentiality, integrity, and availability. This means that the data is only available and alterable by authorized persons or processes.

Every modern office has a copier, and if it's a doctor's office, it must be HIPAA compliant. While multifunction copiers can be HIPAA compliant, none of them are compliant out of the box.

There are a few unscrupulous dealers that will say that their copiers are HIPAA compliant out of the box, hoping to capitalize on doctors and hospitals that want to get compliant as fast as possible by making a simple purchase.

HIPAA is not defined by technology, but by the policies and procedures that secures a patient's protected health information (PHI). To comply with HIPAA, you must ensure PHI confidentiality, integrity, and availability. This means that the data is only available and alterable by authorized persons or processes.