HHS Office of Civil Rights (OCR) is now completing reports of audits performed in 2016 and distributing reports. Once the report is received, organizations have 10 days to respond. The following is an overview of a small clinic that was subject to a Privacy Audit by the OCR. This was a desk audit, meaning that the auditors did not come on-site and all information was provided to the OCR by uploading documents to a portal. While a desk audit...

Reversing the position taken in May 2016, The Joint Commission (TJC) recently clarified that licensed independent providers (LIPs) or other practitioners may not use secure text messaging platforms to transmit patient care orders. TJC’s earlier position said that use of secure text messaging platforms was an acceptable method to transmit such orders, provided that the use was in accordance with professional standards of practice, law and...

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is taking an aggressive stand on HIPAA enforcement and targeting violations related to security risk assessments and business associate agreements. Three resolution agreements posted in the last month make clear that the agency expects entities subject to HIPAA to take appropriate steps to secure their data, regardless of the size or type of the entity. It’s a HIPAA...

It’s been just over a year since the February 2015 health plan Anthem Inc. reported a record-breaking cyber-attack that affected almost 78 million individuals. In the last year the healthcare sector has been the target of several other massive cyber-attacks since the Anthem breach; however, the Anthem incident still tops the Department of Health and Human Services’ “wall of shame” website as the largest health data...

Look for the 2016 agenda for the Department of Health and Human Services’ Office for Civil Rights to accelerate its recent emphasis on enforcement of HIPAA.

Over a five-week period, the OCR announced plans to collect $5 million in monetary penalties in three enforcement actions against HIPAA covered entities. This increased emphasis on collecting fines and penalties is seen as a move to provide funds for the agency. These funds will be allocated to a program focused on auditing entity compliance with the HIPAA Privacy, Security and Breach Notification Rules, as well as other enforcement and regulatory activities.

Several recent large data breaches involving email mishaps serve as a reminder of precautions that healthcare entities must take with protected health information contained in digital communications that are sent or received by their organizations.

Recent incidents listed on the HHS “wall of shame” include two incidents at the North Carolina Dept. of Health and Human Services. Another reported incident, not yet publicly posted on the HHS website, occurred at the University of Cincinnati Health.

HIPAA is not a new issue for healthcare providers; however, the ever changing threat landscape along with the OCR’s renewed commitment to compliance and enforcement, reinforces the need for healthcare providers to ensure that they are focused on preparing for privacy or security issues that are increasingly occurring.

As the healthcare industry continues to digitize patient records, that data is a growing target for cybercriminals intent on committing medical identity theft and fraud.

The number of individuals affected by medical identity theft in the U.S. increased 22 percent in 2014 compared to the previous year—an increase of nearly half a million victims.

The recent string of major hacker attacks in the healthcare sector, including the cyber-attack on UCLA Health, highlights the need for healthcare providers to step up their security programs.

St. Elizabeth’s Medical Center in Massachusetts has been hit with a $218,000 HIPAA penalty. This penalty is the result of an investigation stemming from two security incidents.

The first incident involved staff members using an Internet site to share documents containing patient data without first assessing risks. The second involved the theft of a worker’s personally owned unencrypted laptop and storage device.