HIPAA.com

Security Incident Procedures Response and Reporting: What to Do and How to Do It

This is the sixth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. This is its one implementation specification, Response and Reporting, which is required for compliance. As we have noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (“ARRA”) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. What to Do This standard requires that the covered entity implement response and reporting policies to address security incidents. A security incident is defined as “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system…

Ed JonesHIPAA Law2009, 2010, Administrative Safeguard Standard, American Recovery and Reinvestment Act of 2009, ARRA, business associates, February 17, Federal Register, HIPAA Security Rule, implementation specification, Response and Reporting, security incident, Security Incident Log, Security Incident Procedures, Security Incident Report, Security Rule, system operations, system points, threats, unauthorized access, unauthorized destruction, unauthorized disclosure, unauthorized modification, unauthorized use, vulnerabilities1 Comment

What should you expect from your HIPAA Security Official?

HIPAA’s Security Rule requires covered entities to designate one person to be responsible for the development and implementation of policies and procedures that safeguard electronic protected health information. Nearly all organizations implemented measures to manage privacy in oral, written, and electronic media. However, as healthcare organizations and their business associates, inspired by the HITECH Act (stimulus package) respond to forthcoming financial incentives to adopt electronic health record (EHR) software, the need to beef up your security measures. So what should you look for in your Security Official? For starters, you need someone who understands clinical and billing workflows, recognizes that in the past some clinicians have communicated with patients via…

Carolyn HartleySecurityEHR, electronic health record, HIPAA, HITECH Act, Security Official, stimulus packageLeave a comment

Is Your Covered Entity Preparing for 5010/D.0 Testing? Part 2: Level 2 Testing

On March 17, 2009, the Final Rules for Modifications to the Health Insurance Portability and Accountability Act (HIPAA) become effective. HIPAA.com has available for download the final rules for 5010/D.0 as published in the Federal Register on January 16, 2009 (pp.3295-3328). The effective date is “the date that the policies set forth in this final rule take effect, and new policies are considered to be officially adopted.” [p.3302]. All covered entities are to be in compliance with 5010/D.0 on January 1, 2012. Testing can occur “from the date of the final rule until the compliance date for Versions 5010 and D.0.” [p. 3306] The Final Rules outline two levels of…

Ed Jones50102009, 2012, 5010/D.0, civil money penalties, clearinghouse, compliance date, compliant transactions, covered entity, effective date, external testing, health plan, ICD-10, internal testing, January 1, Level 1 testing, Level 2 testing, March 17, US Department of Health and Human Services, Version 4010/4010ALeave a comment

Security Incident Procedures: What This HIPAA Security Rule Administrative Safeguard Standard Means

This is the sixth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has one implementation specification: Response and Reporting, which is required for compliance. As we have noted in earlier postings, with enactment of the American Recovery and Reinvestment Act of 2009 (“ARRA”) on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. This safeguard standard and its implementation specification require covered entities to establish policies and procedures to respond to security incidents and to report them. A security incident is defined as “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information…

Is Your Covered Entity Preparing for 5010/D.0 Testing? Part 1: Level 1 Testing

Ed Jones50105010/D.0, civil money penalties, clearinghouse, compliance date, compliant transactions, covered entity, external testing, health plan, ICD-10, internal testing, Level 1 testing, Level 2 testing, US Department of Health and Human Services, Version 4010/4010ALeave a comment

Information Access Management: Access Establishment and Modification-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the third implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we have noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. What to Do Implement policies and procedures that, based upon the covered entity’s…

Ed JonesHIPAA Law2009, 2010, Access Authorization, Access Establishment and Modification, addressable, Administrative Safeguard Standard, American Recovery and Reinvestment Act of 2009, business associate, business associate agreement, documentation, electronic protected health information, February 17, HIPAA Administrative Simplification Security Rule, implementation specification, Information Access Management, Right of Access, Security Official, transaction, workforce, workstationLeave a comment

Effective Dates for Modified HIPAA Administrative Simplification Transaction and Code Set Rules Coming in March

In less than three weeks, HIPAA Version 5010/D.0 transaction and ICD-10 code set rules become effective, and the clock starts running on testing in preparation for compliance several years hence. Next Monday, March 2, 2009, HIPAA.com will outline Level 1 testing requirements and opportunities for the 5010/D.0 transaction rule, and on Tuesday, March 3, 2009, outline testing requirements for ICD-10. Sign up for HIPAA.com email reminders for these and other HIPAA Administrative Simplification standards postings, as well as postings relating to the new Health Information Technology for Economic and Clinical Health Act and Medicare and Medicaid Health Information Technology (“HITECH Act”) provisions of the American Recovery and Reinvestment Act (“ARRA”)…

Ed JonesHIPAA Law5010/D.0 transaction rule, American Recovery and Reinvestment Act, ARRA, effective date, Health Information Technology for Economic and Clinical Health Act, HIPAA Administrative Simplification Transaction and Code Set Rules, HIPAA Version 5010/D.0, HITECH Act, ICD-10, Level 1 testing, Medicare and Medicaid Health Information Technology, President ObamaLeave a comment

Information Access Management: Access Authorization-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the second implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is addressable. Remember, addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we have noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. What to Do Implement policies and procedures for granting access to electronic protected…

Ed JonesHIPAA Law2009, 2010, Access Authorization, access authorization records, addressable, Administrative Safeguard Standard, American Recovery and Reinvestment Act of 2009, business associate, business associate agreement, dental office, electronic protected health information, February 17, health plan, HIPAA Administrative Simplification Security Rule, implementation specification, Information Access Management, Information Technology, job description, minimum, payer, physician practice, policies, Privacy Official, Risk Analysis, Security and Privacy Rules, Security Official, transaction, workforce, workstationLeave a comment

Information Access Management: Isolating Healthcare Clearinghouse Functions-What to Do and How to Do It

In our series on the HIPAA Administrative Simplification Security Rule, this is the first implementation specification for the Administrative Safeguard Standard (Information Access Management). This implementation specification is required. What to Do If a healthcare clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Remember, a clearinghouse is defined as a covered entity, but also can serve in the role of a business associate to other covered entities, namely a health plan or healthcare provider. How to Do It This implementation specification is required, but is not likely…

Ed JonesHIPAA LawAdministrative Safeguard, American Recovery and Reinvestment Act, breach, business associate, business associate agreement, clearinghouse, covered entity, electronic protected health information, health plan, healthcare provider, HIPAA Administrative Simplification Privacy Rule, HIPAA Administrative Simplification Security Rule, implementation specification, Information Access Management, Isolating Healthcare Clearinghouse Functions, protected health information, required, US Department of Health and Human Services, violationLeave a comment

Information Access Management-What This HIPAA Security Rule Administrative Safeguard Standard Means

This is the fourth Administrative Safeguard Standard of the HIPAA Administrative Simplification Security Rule. It has three implementation specifications: Isolating Healthcare Clearinghouse Functions; Access Authorization; and Access Establishment and Modification. The first is required; the second and third are addressable. Addressable does not mean “optional.” Rather, an addressable implementation specification means that a covered entity must use reasonable and appropriate measures to meet the standard. Further, as we noted in a posting last week, with enactment of the American Recovery and Reinvestment Act of 2009 on February 17, 2009, business associates also will be required to comply with the Security Rule standards, effective February 17, 2010. The covered entity is…

Ed JonesHIPAA LawAccess Authorization, Access Establishment and Modification, addressable, Administrative Safeguard, American Recovery and Reinvestment Act, business associate, covered entity, electronic protected health information, Federal Register, HIPAA Administrative Simplification, HIPAA Administrative Simplification Privacy Rule, HIPAA Security Rule, implementation specification, Information Access Management, Isolating Healthcare Clearinghouse Functions, policies and procedures, required, standard, transaction, workstationLeave a comment