Becoming HIPAA compliant can be quite challenging for medical practices. Practice owners who are well versed with HIPAA provisions, there’s always the possibility of gaps and ignorance. According to the Department of Health & Human Services (HHS), an average of 1,445 complaints has been submitted each day during the calendar year 2018. To protect Patient Health Information (PHI) and financial health, medical practices must know how to become HIPAA Compliant.
The basic assumption of HIPAA is, practices must proactively preserve patient health information. In fact, becoming HIPAA compliant means more than managing patient health information. Your practice must be proactive about preventing HIPAA violations by creating privacy and security policies. These privacy and security policies must be documented, communicated to your staff, and regularly updated. Your proactive activities will include training your staff on HIPAA privacy and security policies during orientation and at least once a year. Your staff must attest in writing that they understand all HIPAA policies and procedures and follow them while handling patient data. Also, create and distribute a Notice of Privacy Practices (NPP) form for patients to review and sign. The NPP should outline your practice’s privacy policies, including how PHI is handled, and notify patients of their right to access copies of their medical records.
HIPAA legislation is complicated and ever-changing, so every healthcare organization needs its own internal HIPAA experts. The HIPAA security rule requires designating a privacy compliance officer to oversee the development of privacy policies, ensure those policies are implemented and update them annually. In the case of small practices, you can hire a consultant and for bigger practices form a privacy oversight committee. The privacy officer or oversight committee members must have up-to-date knowledge of HIPAA regulations.
The HIPAA security rule requires three types of safeguards to secure patient health information. You must be able to control who has access to physical facilities where PHI is stored. They must also secure all workstations and devices that store or transmit PHI. You must have access controls to secure PHI in the EHR and other databases to ensure employees only see data they’re authorized to see.
Becoming HIPAA compliant is a continuous activity, being a HIPAA compliant practice is not sufficient, you have to maintain that status quo. HHS requires covered entities and business associates to conduct annual audits of all administrative, technical, and physical safeguards to rectify compliance gaps. Practice must then create written action plans that clearly explain how they plan to reverse HIPAA violations and when this will happen.
Before sharing PHI with business associates, covered entities must obtain satisfactory assurances that the business associate is HIPAA-compliant and can effectively safeguard the data, and the parties must enter a Business Associate Agreement (BAA). All BAAs must be reviewed annually and updated to reflect any changes in the nature of the business associate relationship.
Your practice must document all HIPAA compliance efforts, including privacy and security policies, risk assessments and self-audits, remediation plans, and staff training sessions. You can review all this documentation during HIPAA audits and complaint investigations.
HIPAA compliance is critical for medical practices, not only to protect patient privacy but also to ensure financial sustainability. To keep data safe, healthcare providers need to know how to become HIPAA compliant, and they need billing partners who take it just as seriously as they do. MedicalBillersandCoders (MBC) is a medical billing company, that processes patients and their insurance data in HIPAA compliant environment. We hope that the above-mentioned steps will help you to make your practice HIPAA compliant. If you need any assistance in managing your revenue cycle activities in HIPAA compliant environment, contact us at info@medicalbillersandcoders.com / 888-357-3226
