HIPAA Certification, To Do or Not To Do

Catherine Beasley, MS, BSN, LNCC 
Dec 2020 

Breaches of protected health information are becoming commonplace.  The US Department of Health and Human Services, Office for Civil rights now publishes a Breach Report Results which can be accessed at https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.   

Hospitals and health care organizations must report breaches affecting more than 500 people to the Department of Health and Human Recourses as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.  A breach of more than 500 patients’ information may result in the organization’s name on the Department of Health and Human Resources website.  Simply stated, breaches of protected health information are bad for the business of health care organizations.  Patients are left to wonder about the ability of the organization to provide safe, effective care.  After all, if an organization can’t manage paper, how can they manage safe care?   
 
The Health Insurance Portability and Accountability Act (HIPAA) training is now available online by third party vendors.  Training can be done at the convenience of the trainee and both individual and corporate rates are provided.  Seminars ranging from one or two days are also offered nationwide and pricing varies by vendor.   

The Department of Health and Human Services is very clear in that breaches of protected health care information are unacceptable regardless of the number of victims impacted.  However, does having a HIPAA certification mean an organization is better able to secure the personal data of those they serve?  There are two schools of thought to consider.  First, the training and knowledge will support safe practice and thus decrease risk of any potential breaches.  Training will also increase the confidence level of staff in managing protected health information and recurring training allows the trainee access to up to date information regarding HIPAA.   

An opposing view is that the Department of Health and Human Services does not endorse or recognize HIPAA certifications regarding security rules and warns against misleading marketing claims.   

“We have received reports that some consultants and education providers have claimed that they or their materials or systems are endorsed or required by HHS or, specifically, by OCR. In fact, HHS and OCR do not endorse any private consultants’ or education providers’ seminars, materials or systems, and do not certify any persons or products as HIPAA compliant.” 

The HHS website goes on to reflect:  

“There is no standard or implementation specification that requires a covered entity to “certify” compliance. The evaluation standard § 164.308(a)(8) requires covered entities to perform a periodic technical and non-technical evaluation that establishes the extent to which an entity’s security policies and procedures meet the security requirements. The evaluation can be performed internally by the covered entity or by an external organization that provides evaluations or “certification” services. A covered entity may make the business decision to have an external organization perform these types of services. It is important to note that HHS does not endorse or otherwise recognize private organizations’ “certifications” regarding the Security Rule, and such certifications do not absolve covered entities of their legal obligations under the Security Rule. Moreover, performance of a “certification” by an external organization does not preclude HHS from subsequently finding a security violation. 

Given certification is not mandatory it is up to an organization to ensure compliance is achieved.  Investment in training, while not required, is an organization decision based on the level of comfort and ability to meet requirements.   

Breach Portal, (n.d.).  Retrieved 23 Nov 2020  from https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf 

HHS.gov. (n.d.).  Are we required to “certify” our organization’s compliance with the standard security rule?  Retrieved 23 Nov 2020 from https://www.hhs.gov/hipaa/for-professionals/faq/2003/are-we-required-to-certify-our-organizations-compliance-with-the-standards/index.html 

HHS.gov. (n.d.) What you should know about OCR HIPAA privacy rule guidance materials.  Retrieved 23 Nov 2020 from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/be-aware-misleading-marketing-claims/index.html 

Legal Nurse Consultants… Put them into action

A legal nurse consultant (LNC) is a subject matter authority on nursing and healthcare matters much like how an attorney is an expert in legal matters. They are state licensed, detail-oriented healthcare professionals, working on behalf of the litigation team.  

Legal nurse consultants apply their knowledge, education, and clinical training to medical legal cases. Supreme is their ability to interpret medical records. Using their nursing knowledge, LNCs can quickly evaluate medical records and distill them into comprehensive summaries, or chronologies. Their attorney clients can then quickly read, understand, and put them into action. 

The primary role of LNCs involves the identifying, analyzing, and evaluating medical records while providing their professional opinions regarding health issues in medical legal cases. This field of study is composed of evaluating the standards of care, causality, and other medically related issues through the examination of medical records, healthcare literature, and legal documents. Their expertise extends to multiple topics, including: long-term care, medical malpractice, personal injury, worker’s compensation, and mass-tort litigation.  

Legal nurse consultants will also be able to establish a chronology or summary of medical records, and prepare evidence for trial. Additionally, they act as a liaison between the attorney, the healthcare provider, and medical experts. In brief, legal nurse consultation is a valuable asset to the litigation team. 

R&G Medical Legal Solutions has an extensive team of certified legal nurse consultants, that are available around-the-clock, 24-7, to assist you with anything you need. We are agile, in that we can scale up or scale down the project workload to adapt to your needs as they change. Please give us a call today to see how legal nurse consulting at R&G can solve problems for you, dial 1-623-566-3333 or send us an email: rngrfp@rngmedical.com

Why hackers are going after healthcare records…

 

When data is stolen from a bank, it quickly becomes useless once the breach is discovered and passwords are changed. However, data from the healthcare industry, which includes both personal identities and medical histories, can live and affect people for a lifetime.

Cyberattacks will cost society more than $305 Billion over the next five years.   According to industry consultancy, Accenture, 1 in 13 patients will have their data compromised as a result.

chart

The healthcare sector is uniquely vulnerable to privacy breaches.  Recent government regulations have required healthcare providers to adopt electronic health records (EHR) under the Patient Protection and Affordable Care Act.  This has the potential to expose patient data to potential compromise unless providers make equal investments in the security of the systems used to house and manage that data.   To comply with legal requirements, healthcare organizations often store detailed medical information for many years. The probability of a breach and the potential severity of the consequences increases according to the amount of data store and the length of time it is stored.

To a hacker, healthcare records contain valuable information, including Social Security numbers, home addresses, and patient histories. Criminals can sell this data for a premium on the black market, providing incentive to focus attacks on the healthcare industry.

With the push toward integrated care, medical data is being shared with many different entities whose employees may have access to patient records. This extended access to medical records also increases the potential for privacy breaches.

In summary, as companies move to digital record-keeping, the industry is so focused on regulatory compliance, that cybersecurity has largely been a secondary thought. Companies with legacy systems are trying to connect to and integrate EHRs. Security is not always considered an integral part of that, and patching systems are always filled with issues.

Source:

https://www.accenture.com/t20150723T115443__w__/us-en/_acnmedia/Accenture/Conversion-Assets/DotCom/Documents/Global/PDF/Dualpub_19/Accenture-Provider-Cyber-Security-The-$300-Billion-Attack.pdf