HIPAA Privacy and Security: Prepare for New CMS and OIG Reviews

Outline

1. Recent HIPAA privacy activities and their implications
   1. Office of Civil Rights enforcement efforts
      1. Complaint processing
      2. Subpoena power
      3. Representative actions
   2. Private civil litigation involving HIPAA
      1. Using HIPAA as standard of care and other enforcement efforts
      2. Legal rulings regarding the scope or effect of HIPAA privacy regulations
   3. Effect of privacy regulations on clinical research
   4. Issues involving privacy regulations and electronic medical records
2. Recent HIPAA security activities and their implications
   1. Centers for Medicare and Medicaid Services (CMS) compliance reviews
   2. Office of the Inspector General compliance audits
   3. CMS security guidance on portable devices and remote access
   4. Security rule requirements
      1. Risk assessment
      2. Minimize risk of improper use or disclosure of PHI
      3. Meet all “required standards”
      4. Penalties for non-compliance—fines, imprisonment, legal liability
      5. Security rule and technology
3. Documentation standards
   1. Policies and procedures for documentation
   2. Retention of documentation
   3. Availability and accessibility of documentation to workforce
   4. Ensuring confidentiality, integrity and availability of PHI
   5. Attorney–client privilege
   6. State notification laws

Benefits

The panel reviewed these and other key questions:

• What new measures is the government undertaking to ensure compliance with HIPAA?
• What steps can providers take to ensure the confidentiality and integrity of electronic protected health information?
• What can providers do to ensure ongoing HIPAA compliance and minimize their chances of penalties, lawsuits, and negative publicity?