HIPAA.com

Word of the Day: Data Authentication

Data Authentication: The corroboration that data have not been altered or destroyed in an unauthorized manner.

Carolyn HartleyHealth IT and HITECHauthentication, data, Security, word of the dayLeave a comment

Is Certification a Surrogate for HIPAA Privacy and Security Training?

Several visitors to HIPAA.com have asked if ‘certification’ can substitute for compliance with the HIPAA Privacy and Security training standards and new Privacy requirements under the HITECH Act. Generally, certification is a snapshot in a moment of time. The Merrim-Webster’s Collegiate Dictionary (11th ed.) defines certification as the act or state of “attest[ing] as being true or as represented or as meeting a standard.” Certification generally is done by an external source. Training is an ongoing internal process for safeguarding protected health information from unauthorized use or disclosure as business policies and procedures evolve and regulatory standards are initiated or modified. Further, training requires that workforce members, including management, demonstrate…

Ed JonesPrivacy, Security45 CFR, 45 CFR Part 164, certification, compliance, TrainingLeave a comment

Three Key Properties of HIPAA Privacy and Security of Protected Health Information

HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009. Recently, HIPAA.com answered the question of particular interest to several readers: what exactly is protected health information (PHI)? In this posting, we answer the question: what are the fundamental properties that underlie privacy and security of protected health information? Three Key Properties The three key properties that underpin privacy and security under the Health Insurance Portability and Accountability Act (HIPAA) are availability,…

Ed JonesHealth IT and HITECH, HIPAA Law, Privacy, SecurityAdministrative Simplification, American Recovery and Reinvestment Act, August 24, authorized person, availability, Breach Notification, Code of Federal Regulations, confidentiality, February 17, Federal Register, guidance, HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT, HHS, HIPAA, HIPAA Privacy, HIPAA security, HITECH Act, indecipherable, integrity, Interim Final Rule, key properties, OCR, Office of Civil Rights, PHI, President Obama, protected health information, Security Standards, U.S. Department of Health and Human Services, unauthorized individuals, unauthorized persons, unauthorized processes, unreadable, unsecured protected health information, unusableLeave a comment

HIPAA ‘Protected Health Information’: What Does PHI Include?

HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009. Of particular interest to readers is: what exactly is protected health information (PHI)? Protected Health Information To get to protected health information, you have to examine two definitions that were in Section 1171 of Part C of Subtitle F of Public Law 104-191 (August 21, 1996): Health Insurance Portability and Accountability Act of 1996: Administrative Simplification. These statutory definitions are of…

Ed JonesAmerican Recovery and Reinvestment Act, HIPAA Law, Privacy, Securityaccount numbers, Administrative Simplification, American Recovery and Reinvestment Act of 2009, August 24, biometric identifiers, breach, Breach Notification, certificate/license numbers, CFR, Code of Federal Regulations, covered entity, dates, de-identification, derivation, device identifiers, Disclosure, electronic mail addresses, electronic media, employer, employment records, Family Educational Rights and Privacy Act, fax numbers, February 17, Federal Register, finger print, geographic subdivisions, health care clearinghouse, Health Care Provider, health information, Health Insurance Portability and Accountability Act of 1996, health plan, health plan beneficiary numbers, HIPAA, HITECH Act, Identifiers, implementation specification, inadvertent, Individually Identifiable Health Information, Interim Final Rule, IP address, license plate numbers, medical record numbers, names, PHI, photographic images, President Obama, Privacy Rule, protected health information, Public Law 104-191, re-identification, Security, Security Rule, serial numbers, social security numbers, standard, telephone numbers, unauthorized, unsecured protected health information, URLs, vehicle identifiers, voice print41 Comments

CMS Issues New and Updated HIPAA and HITECH Act FAQs: EHR Incentive Payment Start Dates

The Centers for Medicare and Medicaid Services (CMS) periodically issues new and updated Frequently Asked Questions (FAQs). HIPAA.com will periodically reproduce new and updated Questions and Answers pertaining to HIPAA Administrative Simplification standards and implementation specifications and to HITECH Act provisions that will be of interest to its readers. This FAQ [ID#9807] was created on June 22, 2009, and updated by CMS on August 18, 2009. Question: When will CMS begin to pay incentives to eligible professionals and hospitals for using certified Electronic Health Records (EHRs)? Answer: By statute [American Recovery and Reinvestment Act of 2009], the earliest dates that CMS will be able to pay an incentive under Medicare…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECHAmerican Recovery and Reinvestment Act of 2009, Answers, ARRA, August 18, Centers for Medicare and Medicaid Services, certified, CMS, duplication, EHR, electronic health record, eligible, eligible professionals, FAQ, February 17, HIPAA, HIPAA Administrative Simplification, HITECH Act, hospitals, implementation specifications, Incentive start dates, incentives, January 1, late 2009, meaningful EHR user criteria, Medicaid, October 1, planning, President Obama, Proposed rule, provider incentive payments, Questions, regulatory, Standards, States, statute, Title IVLeave a comment

CMS Issues New and Updated HIPAA and HITECH Act FAQs: EHR Incentives

The Centers for Medicare and Medicaid Services (CMS) periodically issues new and updated Frequently Asked Questions (FAQs). HIPAA.com will periodically reproduce new and updated Questions and Answers pertaining to HIPAA Administrative Simplification standards and implementation specifications and to HITECH Act provisions that will be of interest to its readers. The FAQ [ID#9844] that follows is new, published by CMS on August 13, 2009. Question: Are physicians who practice in hospital-based ambulatory clinics eligible to receive the Recovery Act’s Medicare or Medicaid electronic health record (EHR) incentive payments. Answer: Hospital-based eligible professionals are ineligible for the EHR incentive payments under both Medicare and Medicaid. Our [Department of Health and Human Services] forthcoming NPRM…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECHAmerican Recovery and Reinvestment Act, Answers, ARRA, August 13, Centers for Medicare and Medicaid Services, CMS, definition, DEPARTMENT OF HEALTH AND HUMAN SERVICES, EHR, electronic health record, eligible, FAQ, February 17, HHS, HIPAA Administrative Simplification, HITECH Act, hospital-based ambulatory clinics, implementation specifications, incentive payments, ineligible, Notice of Proposed Rulemaking, NPRM, President Obama, Questions, Recovery Act, Standards, Title IVLeave a comment

HHS Issues Interim Final Rule for HITECH ‘Breach Notification’

U.S. Department of Health and Human Services Secretary, Kathleen Sebelius, has issued the Interim Final Rule for Breach Notification for Unsecured Protected Health Information. The Interim Final Rule was signed by Secretary Sebelius on August 6, 2009, filed at the Federal Register on Wednesday, August 19, 2009, and will be published on Monday, August 24, 2009, in the Federal Register. The effective date of the Interim Final Rule will be 30 days after publication, and will cover both covered entities and business associates of covered entities. Here is the Summary of the Interim Final Rule: “The Department of Health and Human Services (HHS) is issuing this interim final rule with…

Ed JonesHealth IT and HITECH800-111, 800-113, 800-52, 800-77, 800-88, Amercian Recovery and Reinvestment Act, ARRA, August 19, August 24, August 6, Breach Notification, business associates, covered entities, decryption, DEPARTMENT OF HEALTH AND HUMAN SERVICES, effective date, electronic phi, encryption, February 17, Federal Reigster, FIPS 140-2, guidance, Health Information Technology for Economic and Clinical Health Act, HHS, HIPAA, HIPAA Security Rule, HITECH, indecipherable, Interim Final Rule, Kathleen Sebelius, key, National Institute of Standards and Technology, NIST, PHI, redaction, unauthorized individuals, unreadable, unsecured protected health information, unusableLeave a comment

HHS Secretary Delegates to ONC Head New HITECH Act Authority

Effective August 7, 2009, and published in the Federal Register on Tuesday, August 18, 2009, Secretary Kathleen Sebelius of the U.S. Department of Health and Human Services (HHS) has delegated authority to the National Coordinator for Health Information Technology, David Blumenthal, M.D., to administer “Subtitle B, ‘Incentives for the Use of health Information Technology,’ sections 3011 through 3017, with the exception of 3012(c)(5), the Financial Support subsection.” These sections and titles, which appear on pages 132-144 of the American Recovery and Reinvestment Act of 2009 (ARRA), signed by President Obama on February 17, 2009, available on the hipaa.com site, include: 3011 Immediate Funding to Strengthen the Health Information Technology Infrastructure,…

Ed JonesAmerican Recovery and Reinvestment Act, Health IT and HITECH2009, American Recovery and Reinvestment Act of 2009, ARRA, August 18, August 7, Certified EHR, Clinical Education, David Blumenthal, delegation of authority, effective date, Electronic Exchange, February 17, Federal Register, health information technology, healthit, HHS Secretary, HIT, HITECH, Kathleen Sebelius, MD, National Coordinator, ONC, President Obama, Regional Extension Centers, strategic plan, Subtitle BLeave a comment

HHS Secretary Sebelius Delegates Oversight and Enforcement of HIPAA Security Rule to OCR

U.S. Health and Human Services (HHS) Secretary Kathleen Sebelius has delegated oversight and enforcement of the HIPAA Administrative Simplification Security Rule Standards for Protection of Electronic Protected Health Information to HHS’s Office of Civil Rights (OCR), effective July 27, 2009. Since October 7, 2003, the Security Rule had been the responsibility of HHS’s Center for Medicare & Medicaid Services (CMS). OCR also has responsibility for the HIPAA Administrative Simplification Privacy Rule. This delegation brings responsibility for administrative, technical, and physical standards for safeguarding of protected health information in each rule under one authority, and likely will facilitate enforcement of the HITECH Act breach, notification, and business associate security rule compliance…

Ed JonesHIPAA Law, Security2009, administrative, American Recovery and Reinvestment Act of 2009, ARRA, August 4, breach, business associate security rule compliance, Center for Medicare & Medicaid Services, CMS, electronic protected health information, Enforcement, February 17, Federal Register, HHS, HIPAA, HIPAA Administrative Simplification, HITECH Act, July 27 2009, notification, OCR, October 7 2003, Office of Civil Rights, oversight, physical standards, President Obama, Privacy Rule, Secretary Sebelius, Security Rule, Standards, technicalLeave a comment

What’s In Your Personal Health Record?

The 800-pound gorilla at the center of health information transformation is the patient. This sleeping giant is slowly emerging from hibernation, and watch out when it wakes up. Folded into ARRA’s HITECH Act are provisions that require health care providers to “Provide patients and families with access to data, knowledge, and tools to make informed decisions and to manage their health.” If you are a caregiver, or manage a chronic disease, this policy will have a profound effect on you. While my sister and brother battled terminal aggressive cancers, it was their caregiver who carried the pharmacological list of medications, nutritional supplements, allergies, adverse reactions, near fatal overdoses, sleep patterns,…

Carolyn HartleyHealth IT and HITECHCancer patients, HITECH, personal health record, PHRsLeave a comment