Overview
Independent medical practices have been trying to understand, comply with, and avoid penalties under the Health Insurance Portability and Accountability Act since 1996. The intent of the HIPAA statute is to “create confidentiality systems within and beyond healthcare facilities, with the goal of keeping protected health information private.”
This time period has also seen the rise of the EHR, or Electronic Health Record, for tracking patient medical history and pertinent data. And that is where the potential for danger exists. As cyber criminals become more sophisticated in their attacks, security breaches in healthcare have increased dramatically. According to the HIPAA Journal, 2021 saw more healthcare data breaches reported than any other year since records were first published.
Breaches continued to rise during the first five months of 2022. In one medical data breach at the Yuma Regional Medical Center in Arizona, a ransomware attack exposed the patient data of 700,000 individuals. If it is possible for cyber attackers to breach such large medical operations, how can your private practice protect itself against healthcare cyber threats?
What Happens if Your Independent Practice Violates HIPAA Compliance Standards?
The consequences of a breach can be monumental for your private practice. At the very least, it will take a great deal of time and effort required by the Breach Notification Rule to contact all patients that the breach affected, and to correct the problem. This could result in a loss of revenue and patient confidence. At the most, there could be a number of penalties involved, depending on the severity of the violation. Penalties can be assessed by both the Department of Health and Human Services’ Office for Civil Rights (OCR), and your state’s attorney general.
In most cases, OCR will try to resolve violations with non-punitive measures and technical guidance, but they can also assess penalties, with fines ranging from $100 to $50,000 per violation for the most egregious of circumstances. According to Medical Economics, one five-physician medical practice in Arizona was fined $100,000 for failing to meet HIPAA’s privacy and security requirements.
Most Common HIPAA Violations in Healthcare
Even a seemingly small action can become a HIPAA violation, so it is important for your private practice to be aware of danger areas, including:
- Lost or stolen devices: While laptops, tablets, smartphones, and thumb drives add a great deal of convenience to the practice environment, they can also present a real danger. Insecure or sloppy handling of these devices can lead to theft, and a possible breach.
- Unencrypted data: All office equipment and devices should have password protection and be encrypted to secure the Protected Health Information (PHI) of patients. When hundreds of patients can be affected by a breach, a practice can face extremely stiff penalties.
- Inadequate training: Team members can be brought into the practice regularly, or existing office staff might simply get sloppy with the day-to-day pressing activity.
- Database breach: Data breaches are the most reported form of HIPAA violations, impacting the entire healthcare industry, from independent practices to regional medical centers.
- Disclosure of Information: Even a seemingly inconsequential conversation can have major implications. In the medical world, this applies to all those conversations around the office and even during off-duty hours, where discussions about a patient’s health or personal information can lead to privacy violations.
- Disposal of patient information: While medical practices previously had to worry about the management and security of paper charts, today’s Electronic Health Records also require a similar degree of vigilance. Any paper documents should be shredded, and any electronic devices should be wiped of all patient information before disposal.
Steps Your Private Practice Can Take to Maintain HIPAA Compliance
Vigilance is the key watchword in maintaining HIPAA compliance. Steps your private practice can take include:
- Limit Access to Information: Really think about who needs to be in areas where any patient information is available, and strictly limit computer access. Don’t allow team members to share devices or passwords for convenience.
- Respond in a Timely Manner to Requests for Personal Data: Even though your practice has a lot to manage with day-to-day activities, failure to respond to a patient’s request for personal data in a timely manner (usually within 30 days) is a HIPAA violation.
- Establish and Enforce Security Protocols: Lax attention to security is an open invitation to cyber criminals. Make a risk assessment of your practice on a regular basis to examine all your security procedures and make proper corrections. Update your software within recommended timeframes, and make sure all team members revise their passwords regularly. Pay special attention to mobile devices, so they can be either erased or disabled if lost or stolen.
- HIPAA Training Schedule: It is important to have a regular HIPAA training schedule, at least on a quarterly basis, to keep everyone vigilant and aware of breach consequences.
- Ensure Your Software is HIPAA Compliant: To be sure your practice is using an HIPAA compliant EHR, it should be able to meet the following important security criteria:
- All users must be properly authorized.
- Access is controlled, so that only these authorized users can access it.
- An authorization monitoring program is in force.
- There is a data backup plan.
- There is a remediation plan in case of a breach.
- There is an emergency mode.
- Users are automatically logged off after a certain period of time.
- Data is encrypted.
Key Takeaways for Protecting Your Private Practice Against a HIPAA Breach
Healthcare data breaches can be a costly and confidence-sapping violation for your private practice. To protect against breaches, make sure you have security protocols in place, train your staff regularly, and ensure your software is HIPAA compliant.
PrognoCIS EHR by Bizmatics provides a cloud-based application which is fully integrated with powerful modules including HIPAA compliant Electronic Health Records (EHR), Telemedicine, Practice Management, Medical Billing, Revenue Cycle Management (RCM), and Patient Engagement tools.
