HIPAA New Rules: Where to begin--Actions to take now

WHERE TO BEGIN? ACTIONS TO TAKE NOW Maria K Todd, MHA PhD CEO & Founder, Mercury Advisory Group Denver, CO mtodd@mercuryadvisorygroup.com

Author: HIPAA Provider Privacy & Compliance Toolkit, HealthPro (2003).

Copyright 2014. Mercury Advisory Group. All rights reserved.

YOUR RESPONSIBILITIES AS A COVERED ENTITY PRIVACY RULE COMPLIANCE BREACH NOTIFICATION RULE COMPLIANCE SECURITY RULE COMPLIANCE STAFF TRAINING COMPLIANCE

SECURITY EVALUATION COMPLIANCE COMPLIANCE ASSESSMENT BY AN EXTERNAL EVALUATOR BREACH NOTIFICATION RULE ASSESSMENT STAFF TRAINING COMPLIANCE ASSESSMENT BUSINESS ASSOCIATE DUE DILIGENCE ASSESSMENT CORRECTIVE ACTION PLAN DOCUMENTATION & EXECUTION 6-YEAR RETENTION OF REQUIRED DOCUMENTATION

Nothing to buy…

The regulations are your comprehensive checklist Copyright 2014. Mercury Advisory Group. All rights reserved.

Educational Objectives 1. Explain why you have to take action 2. Show you where to find the explicit state / federal requirements 3. Encourage you to get started on a Plan of Action

Your advised to seek competent legal compliance counsel in order to interpret the law.

--We’re just telling you where to find the checklist so you can read it yourself--

Copyright 2014. Mercury Advisory Group. All rights reserved.

Why you must take action • •

law, not an option your brand on the line • Bad publicity • Patient loyalty and trust

•

once you get tapped on the shoulder by the Office of Civil Rights / US Department of Justice • more expensive to do nothing and get busted • Staff can be held personally liable for fines Copyright 2014. Mercury Advisory Group. All rights reserved.

Failure to document policies, procedures and retention of the documents for 6 years

Settlement Agreements vs Civil Monetary Penalties • WellPoint (WLP) • Hospice of Northern Idaho • Massachusetts Eye and Ear Infirmary (MEEI) • CVS Pharmacy • RiteAid • BCBS Tennessee

>$12 Million

• Massachusetts General Hospital • Phoenix Cardiac Surgery • University of California at Los Angeles (UCLA) • Alaska Department of Health and Human Services (DHSS)

Copyright 2014. Mercury Advisory Group. All rights reserved.

Copyright 2014. Mercury Advisory Group. All rights reserved.

WHAT CHANGED? After September 23, 2013, the OCR must pursue Civil Monetary Penalties for wilful and wanton neglect of your responsibilities for compliance auditing and is no longer permitted to seek an

Copyright 2014. Mercury Advisory Group. All rights reserved.

MANDATORY PROTOCOLS • ESTABLISHED PERFORMANCE CRITERIA • KEY ACTIVITY • AUDIT PROCEDURE The regulations are your comprehensive checklist THE UPDATED HIPAA REGULATIONS ARE AVAILABLE AT: www.cms.gov/Regulations-and-Guidance/HIPAA-AdministrativeSimplification/HIPAAGenInfo/index.html

If You don’t have the time to do this yourself, you have to hire it out.

Some protocols require the engagement of an external auditor Copyright 2014. Mercury Advisory Group. All rights reserved.

Three Pillars of HIPAA-HITECH Compliance HITECH HIPAA PRIVACY

54 Implementation Specifications

SECURITY

BREACH NOTIFICATION

75

18

6

Pages

Pages

Pages

56

Standards

50

Implementation Specifications

22 Standards

Copyright 2014. Mercury Advisory Group. All rights reserved.

9 Implementation Specifications

4 Standards

A Comprehensive Compliance Program Policy defines the organization’s Values Expected Behaviors Good Faith Intentions Procedures defines the organization’s Documented process to maintain policies Includes the steps that will be taken Includes periodic audits to verify adherence Commitment of the executive team Train and maintain staff competency Walk the walk; talk the talk Documented Safeguards and controls Encryption, firewalls, anti-malware Intrusion detection, incident management tools BYOD policies and safeguards Copyright 2014. Mercury Advisory Group. All rights reserved.

Take Steps In the Right Direction

Copyright 2014. Mercury Advisory Group. All rights reserved.

Form a Cross-Functional Policy Development Task Force 1. Competency / Subject Matter Knowledge 2. Time to participate on the task force / Time to Manage The Task Force

Copyright 2014. Mercury Advisory Group. All rights reserved.

Set Business Risk Management Goals for your Organization 1. Is this a case of not knowing what you don’t know?

2. How much time can you devote to learning this from scratch?

3. Do you really feel secure about your competency here?

Copyright 2014. Mercury Advisory Group. All rights reserved.

Get Educated – Learn the regulations The requirements, and The consequences for failure

• 99 Pages of regulations • 113 Implementation specifications • 82 standards Copyright 2014. Mercury Advisory Group. All rights reserved.

Design and Outline your Standards Template • This one took about 400 hours to complete

Determine the specific policies that are required by your organization • Write the policies unique to your organization

Copyright 2014. Mercury Advisory Group. All rights reserved.

1. Create a project plan for development – parse out projects to staff • Assuming others are as competent to accept responsibility to do their part • Assuming they have the time to do this and their regular jobs

Copyright 2014. Mercury Advisory Group. All rights reserved.

Build a change management / communications subproject 1.

2.

3.

4.

5.

6.

7.

8.

9.

Determine what, exactly, needs to change Brainstorm potential solutions Decide how to move forward Write action steps Set time frame Reflect on how these changes will affect different groups of people Identify potential obstacles Put the plan on paper

Create – review revise approve communications process Copyright 2014. Mercury Advisory Group. All rights reserved.

Iterate into staff training and retraining Document the training in personnel files

Copyright 2014. Mercury Advisory Group. All rights reserved.

Establish ongoing preventive maintenance process to stay current in the future

‌ and be sure to save some time to treat patients and send out bills

Copyright 2014. Mercury Advisory Group. All rights reserved.

An all-inclusive alternative solution Hire • • •

out the entire project to Mercury Advisory Group All-inclusive, flat fee audit and report, with Corrective Action Plan (CAP) The regulations require you to engage an external auditor on several items anyway We engage and report through your attorney – so all findings are protected by “privilege”

One price includes: • • • • • • •

Data security audit against actual regulations Policies and procedures tracer audits against actual regulations Query into Business Associates’ practices Review of your staff training materials and documentation of onboarding and periodic refresher training Onsite physical safeguards review Travel costs for auditors Exit Interview with Written Report and Corrective Action Plan

GET STARTED TODAY: 800.727.4160 ©2014. Mercury Advisory Group. All rights reserved.

MERCURY ADVISORY GROUP

International Healthcare Management Consultants

Solve Your HIPAA Compliance Headaches with this Affordable & Convenient All-inclusive Solution Here’s What You Get: 1. On-site risk analysis of your practice of more than 200 required and addressable Key Performance Criteria and activities 2. Vulnerability audit of electronic protected health information (PHI) to loss or theft 3. Identification of all methods of physical access to workstations 4. Tracer method review of inventory of the types and locations of workstations, when last updated, and the documented process for updating the information, and whether or not it was maintained.

5. Signed report documenting that the audit was performed by a qualified external auditor 6. Test and evaluation of data encryption 7. Tracer method audit to obtain evidence for a sample of instances showing implementation of covered entity review practices 8. Tracer method audit to determine if the security policy has been approved and updated on a periodic basis 9. A comprehensive review of your training strategy, documentation and ongoing plan for new hires and refresher training 10. A thorough review of the content of your training materials in relation to specified criteria required by law 11. A comprehensive review of your written policies and procedures for crisis management, in the event PHI is lost, stolen or inappropriately disclosed.

12. A comprehensive review of your disaster recovery plan and data backup policies, procedures and recordkeeping 13. Signed report documenting findings of the policy and procedure audit and suggested improvements, if any 14. A comprehensive review of your Business Associate contracts to ensure that vendors and other associates have proper safeguards in place to secure patient PHI. 15. Signed report of findings of the Business Associate review 16. Comprehensive report of findings detailing any necessary or suggested corrective actions to be undertaken.

17. Exit interview that includes a review and signature approval of written reports, as per §164.308(a)(8) Optional next steps: (additional charge) Our experts will manage the process of implementing and executing all corrective action plan items for you. _________________________________________________________________________

To learn more about how your organization could benefit from an audit just like this, CALL TODAY! 800 727 4160 www.MercuryAdvisoryGroup.com

ABOUT MERCURY ADVISORY GROUP Mercury Advisory Group is an international healthcare and health tourism management consulting firm that works collaboratively with clients to achieve and exceed their goals.

Mercury serves as a change agent and provides practical guidance and industry expertise in • health and hospitality administration • regulatory health policy • business and market entry strategies • organizational development • facilities management • quality and safety accreditation • healthcare cost containment and sustainability • technology deployment • regulatory compliance • healthcare revenue cycle • insurance and employer contract negotiation • reimbursement strategy • healthcare leadership effectiveness, and • staff training and development Mercury’s 30-year heritage has produced a substantial portfolio of proven methods, deep operational insight and broad healthcare and health tourism management experience. This enables of team to quickly grasp the issues and develop workable solutions that can successfully and sustainably be deployed. Mercury’s clients span the globe in over 100 countries.

Mercury Advisory Group is a wholly-owned subsidiary of The Mercury Healthcare Companies, headquartered in Denver, Colorado with offices on six continents.

We help healthcare and health tourism providers to build trusted brands and to deliver exceptional high-touch patient experiences.

Mercury Advisory Group 600 17th Street Suite 2800 South Tower Denver, Colorado 80202 USA +1.303.823.4662 US (800) 727.4160 (Toll Free) www.mercuryadvisorygroup.com

© 2013. Mercury Advisory Group. All rights resrved.