Guest Blog: Meet the HIPAA Police

This is another great guest blog from our friends at GRA Benefits:

The HIPAA police, a.k.a. the Department of Health and Human Services (HHS), are happy to meet you if you do any one or more of the following things:

1. Do not encrypt your email
2. Let a hacker access your customer database
3. Leave completed client forms in a dumpster
4. Share PHI with a subcontractor without an agreement
5. Fail a carrier audit

If the HIPAA police do show up at your office. They will come with gifts – a fine for $100-$1.5 million and maybe even a warrant for your arrest. They will also post about you on their website, free publicity!

Odds are, you don’t want to meet the HIPAA police. Here are some tips to avoid them:

1. Encrypt your email. While you’re at it, encrypt all your data-at-rest too. If you send an encrypted email to the wrong person, you could prevent the incident from becoming a breach.
2. Set up a secure firewall, malware security software, and strong passwords. Adding multiple layers of security will further protect your information from a hacker attempting to access it.
3. Shred it! Any type of media, including paper and electronic devices, should be properly destroyed. Client forms and other paper should be shredded. Old hard drives and computer equipment should be properly cleared or destroyed.
4. Issue Business Associate Agreements (BAA) with any downstream entities that handle PHI on your behalf. This includes your IT vendor, shredding company, cleaning company, or possibly your building owner. The basic rule is if they have access to the information, you should have a BAA with them.
5. Pass your carrier audit by conducting a risk analysis. Carriers are required to be aware of their business associates’ compliance standing, therefore many carriers are performing audits. If you fail, they could dissolve your contract and report you to HHS. Conducting a risk analysis will make the carrier audit process simple.

A risk analysis can be overwhelming and time-consuming. Hiring an outside vendor, such as GRA Benefits Group, makes the process quick and pain-free.

By: Bridgette O’Connor
Google+

Sharing is caring!