UNDERSTANDING HIPAA & THE HITECH ACT. Heather Deixler, Esq. Associate, Morgan, Lewis & Bockius LLP
|
|
- Mavis Parks
- 6 years ago
- Views:
Transcription
1 UNDERSTANDING HIPAA & THE HITECH ACT Heather Deixler, Esq. Associate, Morgan, Lewis & Bockius LLP 1
2 Objectives of Presentation Learn what HIPAA is Learn the purpose of HIPAA Understand who HIPAA regulates Understand what information is protected by HIPAA Understand the penalties associated with noncompliance 2
3 What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) is the federal medical privacy law HIPAA was enacted to: Increase efficiency and effectiveness of the health care system Protect the privacy and provide for the security of PHI Establish standards for accessing, storing and transmitting medical data and ensuring the privacy and security of PHI MOST IMPORTANT TAKE HOME OF THE DAY: It s HIPAA, NOT HIPPA. 3
4 The HIPAA Legal Timeline HIPAA (Aug. 21, 1996) The Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) established baseline federal medical privacy and security standards. HIPAA Privacy Rule (Final Rule in Dec. 2000, modified in Aug. 2002): established rules to regulate the use or disclosure of PHI and provide individuals with certain rights with respect to such PHI. HIPAA Security Rule (Feb. 2003): established a system of reasonable and appropriate administrative, physical and technical safeguards for protecting PHI. The HITECH Act (Feb. 17, 2009): among other things, extended the reach of the HIPAA Privacy and Security Rules to business associates ( BAs ), imposed breach notification requirements on covered entities ( CE ) and BAs and created enhanced penalties. HIPAA Omnibus Final Rule ( HIPAA Final Rule ) (Jan. 25, 2013): amended the HIPAA Privacy and Security Rules and implemented requirements of the HITECH Act, extending certain HIPAA obligations to BAs and their subcontractors. - Compliance date for the HIPAA Final Rule is September 23, 2013.
5 What is the Purpose of the HIPAA Privacy and Security Rules? Individual Rights: To provide individuals with certain rights to their health information, including access to, and amendment of, such information. Restrict Uses and Disclosures of PHI To restrict how covered entities and business associates can use or disclose such information Security Safeguards To create a system of safeguards for securing such information 5
6 The HIPAA Privacy and Security Rules Privacy: refers to WHAT is protected health information about an individual, and restrictions placed on WHO may use, disclose or access the information Security: refers to HOW information is safeguarded system of administrative, physical and technical safeguards for electronic protected health information 6
7 What Information is Protected by HIPAA? Protected health information ( PHI ) is individually identifiable health information about an individual that is transmitted or maintained in any form (electronic, oral or written) where the information: Is created or received by a health care provider, health plan, employer or health care clearinghouse; Relates to: An individual s health or condition Provision of health care to an individual Payment for health care to an individual; and Identifies an individual, or there is a reasonable basis to believe it can be used to identify an individual But not de-identified information 7
8 PHI Individual Identifiers What are the individual identifiers? Names Geographic subdivisions smaller than a state: Street address City County Precinct Zip code, except for the initial 3 digits Dates, except year Birth date Admission date Discharge date Date of death Telephone numbers 8
9 PHI Individual Identifiers (cont d) What are the individual identifiers (cont d)? Fax numbers addresses SSN Social Security Numbers Medical Record Numbers Health plan beneficiary numbers Account numbers Certificate/license numbers VIN and serial numbers, including license plate numbers Device identifiers and serial numbers Web universal resource locations Internet protocol (IP) address numbers Biometric identifiers, including finger and voice prints Full face photographic images and any comparable images Any other unique identifying number, characteristic or code 9
10 Who is Regulated by HIPAA? Covered Entities Business Associates (Including Subcontractors) 10
11 What is a Covered Entity? Health plans (HMOs, employer group health plans) Health care clearinghouses Health care providers that engage in standard electronic transactions (hospitals, medical groups) 11
12 Who Is a Business Associate? A person or entity, other than a member of a covered entity s workforce, that creates, receives, maintains or transmits PHI on behalf of a covered entity for a function or activity regulated by HIPAA. Under the HIPAA Final Rule, the definition of business associate includes subcontractors of business associates. May be a covered entity. Billing Firms Clearinghouses Management Firms Lawyers, Actuaries Covered Entity Consultants, Vendors Outsourcing Vendors Accountants, Auditors Financial Services Accreditation Organizations 12
13 When Organizations May Act as a Business Associate Some examples of ways in which an organization may act as a business associate: Providing data management services to HIPAA covered entity customers (e.g., hospitals or health plans) Providing cloud storage services to business associates Providing legal services to a HIPAA covered entity 13
14 Privacy/Security Officer SECURITY OFFICER: Under the HIPAA Security Rule, covered entities and business associates are required to designate a Security Officer. PRIVACY OFFICER: Under the HIPAA Privacy Rule, covered entities are required to designate a Privacy Officer. While not required, it is highly recommended that business associates designate a Privacy Officer as well. 14
15 Minimum Necessary Covered entities and business associates shall request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request use or disclosure, in accordance with HIPAA s minimum necessary standard Internal Requirements External Requirements Identify workforce who need access to PHI For each class/category of person identified, limit access based on need-toknow Limit access to what is needed to accomplish the purpose for which the request was made Each request that is nonroutine should be reviewed by the Privacy Officer 15
16 Uses and Disclosures Use: employment, application, utilization, examination or analysis of PHI within the covered entity/business associate. Disclosure: release, transfer, provision of access to, or divulging in any other manner, information outside of the covered entity/business associate. 16
17 Uses and Disclosures The HIPAA Privacy Rule permits a covered entity to use or disclose PHI without an authorization for the following purposes: Treatment Payment Health Care Operations These are often referred to as TPO 17
18 How May a Business Associate Use PHI? A Business Associate is generally limited to using PHI to provide services for a covered entity. this means that the business associate can use PHI ONLY for the purposes for which it was engaged by the covered entity client who provided such PHI. A business associate may expressly be permitted to: Provide data aggregation services De-identify PHI 18
19 Security Rule Compliance Necessary steps for Security Rule compliance: Conducting a formal security risk assessment; Implementing written policies and procedures with respect to Security Rule standards; Providing security training to workforce members Appointing a Security Officer to oversee Security Rule compliance efforts 19
20 The Dreaded Security Breach 20
21 The HIPAA Breach Notification Rule Breach is defined as the unauthorized acquisition, access, use or disclosure of PHI which compromises the security or privacy of such information. Unlike many state laws, applies to breaches involving both electronic and paper records. Risk analysis: HIPAA Final Rule: express presumption that incident is a breach UNLESS the covered entity/business associate can demonstrate that there is a low probability that the PHI has been compromised. 21
22 Four Factors of a Risk Analysis 1. Evaluate the nature and the extent of the PHI involved. 2. Who impermissibly used the PHI? To whom was the PHI disclosed? 3. Was PHI actually acquired or viewed or, did only the opportunity exist for the information to be acquired or viewed? 4. Consider the extent to which the risk to the PHI has been mitigated. 22
23 Covered Entity Reporting Obligations Covered Entities must notify: Individuals REPORTING TIMELINE: without unreasonable delay and no more than 60 days after discovery. Media (for breaches involving > 500 residents of a State or jurisdiction) REPORTING TIMELINE: without unreasonable delay and no more than 60 days after discovery. Secretary of HHS > 500 individuals: provide at same time as notice to indivs < 500 individuals: maintain a log, and provide annual notice to HHS 23
24 Business Associate Reporting Obligations Business Associates are required to notify covered entities whose unsecured PHI has been accessed, acquired or disclosed as a result of a breach. REPORTING TIMELINE: without unreasonable delay and no more than 60 days after discovery. Sometimes less depending upon the terms of the particular BAA. 24
25 Penalties Civil $100 to $50,000 per violation per person up to a maximum of $1,500,000 per person per year per standard violation Criminal Up to $50,000, 1 year in prison, or both, for inappropriate use of PHI Up to $100,000, 5 years in prison, or both for using PHI under false pretenses Up to $250,000, 10 years in prison or both, for the intent to sell or use PHI for commercial advantage, personal gain, or malicious harm 25
26 Drafting and Negotiating Business Associate Agreements DORIANN CAIN, ESQ. ASSOCIATE, BARNES & THORNBURG LLP
27 What is a Business Associate Agreement? A contract between a covered entity and business associate to ensure that the business associate will appropriately safeguard PHI. Also serves to clarify and limit the permissible uses and disclosures of PHI by the business associate A business associate may use or disclose PHI only as permitted or required by its business associate contract or as required by law.
28 Required Terms Establish the permitted and required uses and disclosures of PHI by the business associate; Provide that the business associate will not use or further disclose the information other than as permitted or required by the contract or as required by law; Implement appropriate privacy and security safeguards;
29 Required Terms Report unauthorized disclosures to the covered entity; Make available PHI under access, amendment and account of disclosures rights; Incorporate any amendments; To the extent the business associate is to carry out a covered entity s obligation under the Privacy Rule, require the business associate to comply with the requirements applicable to the obligation;
30 Required Terms Make available its practices, books and records to HHS for determining the covered entity s compliance; Return/destroy PHI upon termination of arrangement, if feasible; If not feasible, extend BAA protections Ensure subcontractors comply with the same BAA requirements as the business associate; and Authorize termination by covered entities.
31 Business Associate Agreement Form Templates HHS released a template in January of last year es/contractprov.html Beware of particular biases in the forms Language should be changed to more accurately reflect the services being provided by the business associate
32 HIPAA Omnibus Final Rule & BAAs Old Rule BA not directly liable for violations Contractually liable CE must have a written contract with BA that requires BA to safeguard PHI and not use or disclose PHI other than as provided by the contract BA must ensure that any subcontractors agree to the same restrictions New Rule BA directly liable for violations of applicable provisions of HIPAA Contract between CE and BA still necessary Now BA must comply with the Security Rule requirements Report to CE any breach of unsecured PHI If CE delegates Privacy Rule obligation to BA, BAA must require BA to perform in compliance with the Rule BAA between BA and subcontractor mandated Must be as stringent as the CE-BA contract
33 Business Associates and the Security Rule Business associates now mandated to comply with the Security Rule s requirements and implement policies and procedures in the same manner as a covered entity Requires business associates to implement safeguards in compliance with the Security Rule Business associates must conduct risk assessment and be more proactive and diligent to monitor new rules, regulations and guidance
34 Subcontractors and Business Associate Agreements Subcontractors now defined as business associates Obligation to enter into a BAA with a subcontractor will rest solely with the business associate, not the covered entity Business associate liability flows downstream Does not change parties to the BAAs Covered entity must have BAA with its business associate Business associate must have BAA with its subcontractor Downstream contract must be as stringent as the one above
35 Amending Business Associate Agreements Evaluate entities identity Business Associate? Covered Entity? Assess how PHI is being used Does the entity already have a BAA in place?
36 Compliance Dates For any BAA entered into on or after 1/25/13, compliance date was 9/23/13 If was BAA was in effect prior to 1/25/13 and HIPAA compliant at the time Compliance date is 9/23/14 if BAA was not renewed or modified between 3/26/13 and 9/23/13
37 Covered Entities & Negotiation of BAAs Manage risk and avoid liability Business associate held to a higher level of accountability Indemnification, insurance and other assurances from business associate beyond what is mandated under HIPAA for BAAs Business associate responsible for all costs associated with breach Review underlying agreement
38 Covered Entities & Negotiation of BAAs Assistance from business associate in event of breach Automatic termination of BAA for material breach Small timeframe for reporting a breach Right to review BAAs between business associates and subcontractors Right to inspect/audit/investigate
39 Business Associates & Negotiation of BAAs Provide notice to business associate of any limitation in NPP that may effect its use or disclosure of PHI Notify business associate of changes/revocation of individual permissions Notify business associate of restrictions to which covered entity has agreed No covered entity requests for business associate to act in a non-permissible manner
40 Business Associates & Negotiation of BAAs Contract limited to terms required under HIPAA Least restrictions on its use and disclosure of PHI obtained from the covered entity Minimize liability; no indemnification Chance to cure material breach Review underlying agreement
41 Questions?
HIPAA, 42 CFR PART 2, AND MEDICAID COMPLIANCE STANDARDS POLICIES AND PROCEDURES
SALISH BHO HIPAA, 42 CFR PART 2, AND MEDICAID COMPLIANCE STANDARDS POLICIES AND PROCEDURES Policy Name: BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date:
More informationACC Compliance and Ethics Committee Presentation February 19, 2013
ACC Compliance and Ethics Committee Presentation February 19, 2013 Melinda G. Murray Associate General Counsel, Holy Cross Hospital and Jill M. Girardeau Partner, Womble Carlyle Sandridge & Rice, LLP HIPAA
More informationHIPAA Training. HOPE Health Facility Administrators June 2013 Isaac Willett and Jason Schnabel
HIPAA Training HOPE Health Facility Administrators June 2013 Isaac Willett and Jason Schnabel Agenda HIPAA basics HITECH highlights Questions and discussion HIPAA Basics Legal Basics Health Insurance Portability
More informationChoiceNet/InterCare Health Plans Getting Your Arms Around HIPAA Compliance
ChoiceNet/InterCare Health Plans Getting Your Arms Around HIPAA Compliance The enclosed packet includes basic HIPAA Privacy Rule information, Amendments for your health care plan, identified action items
More informationNorth Shore LIJ Health System, Inc. Facility Name. CATEGORY: Effective Date: 8/15/13
North Shore LIJ Health System, Inc. Facility Name POLICY TITLE: HIPAA Marketing and Sale of Protected Health Information Policy ADMINISTRATIVE POLICY AND PROCEDURE MANUAL POLICY #: 800.43 System Approval
More informationEffective Date: 08/2013
POLICY/GUIDELINE TITLE: HIPAA Marketing and Sale of Protected Health Information Policy POLICY #: 800.43 System Approval Date: 5/18/18 Site Implementation Date: 6/17/18 Prepared by: ADMINISTRATIVE POLICY
More informationCompliance Steps for the Final HIPAA Rule
Brought to you by The Alpha Group for the Final HIPAA Rule On Jan. 25, 2013, the Department of Health and Human Services (HHS) issued a final rule under HIPAA s administrative simplification provisions.
More informationHIPAA COMPLIANCE ROADMAP AND CHECKLIST FOR BUSINESS ASSOCIATES
HIPAA COMPLIANCE ROADMAP AND CHECKLIST FOR BUSINESS ASSOCIATES The Health Information Technology for Economic and Clinical Health Act (HITECH Act), enacted as part of the American Recovery and Reinvestment
More informationDetermining Whether You Are a Business Associate
The HIPAApotamus in the Room: When Lawyers and Law Firms are Subject to HIPAA Enforcement, And How to Comply with the Law by Leslie R. Isaacman, J.D., M.B.A. The Omnibus Final Rule 1 of the Health Information
More informationHIPAA Compliance Guide
This document provides an overview of the Health Insurance Portability and Accountability Act (HIPAA) compliance requirements. It covers the relevant legislation, required procedures, and ways that your
More informationLimited Data Set Data Use Agreement For Research
Limited Data Set Data Use Agreement For Research This Data Use Agreement is dated,, and is between the ( Recipient ) and University of Miami, ( Covered Entity ). This Data Use Agreement is made in accordance
More informationThe wait is over HHS releases final omnibus HIPAA privacy and security regulations
The wait is over HHS releases final omnibus HIPAA privacy and security regulations The Department of Health and Human Services (HHS) published long-anticipated (and longoverdue) omnibus regulations under
More informationOmnibus Components. Not in Omnibus. HIPAA/HITECH Omnibus Final Rule
Office of the Secretary Office for Civil Rights () HIPAA/HITECH Omnibus Final Rule April 12, 2013 HHS Office for Civil Rights Omnibus Components Final Rule on HITECH Privacy, Security, & Enforcement Provisions
More informationHayden W. Shurgar HIPAA: Privacy, Security, Enforcement, HITECH, and HIPAA Omnibus Final Rule
Hayden W. Shurgar HIPAA: Privacy, Security, Enforcement, HITECH, and HIPAA Omnibus Final Rule 1 IMPORTANCE OF STAFF TRAINING HIPAA staff training is a key, required element in a covered entity's HIPAA
More informationBreach Policy. Applicable Standards from the HITRUST Common Security Framework. Applicable Standards from the HIPAA Security Rule
Breach Policy To provide guidance for breach notification when impressive or unauthorized access, acquisition, use and/or disclosure of the ephi occurs. Breach notification will be carried out in compliance
More informationMEMORANDUM. Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know
1801 California Street Suite 4900 Denver, CO 80202 303-830-1776 Facsimile 303-894-9239 MEMORANDUM To: Adam Finkel, Assistant Director, Government Relations, NCRA From: Mel Gates Date: December 23, 2013
More informationAFTER THE OMNIBUS RULE
AFTER THE OMNIBUS RULE 1 Agenda Omnibus Rule Business Associates (BAs) Agreement Breach Notification Change Breach Reporting Requirements (Federal and State) Notification to Care1st Health Plan Member
More informationHuman Research Protection Program (HRPP) HIPAA and Research at Brown
Human Research Protection Program (HRPP) and Research at Brown Version Date: 12/03/2018 I. and Research at Brown A. The Health Insurance Portability and Accountability Act of 1996 () and its regulations,
More informationHIPAA: Final Omnibus Rule is Here Arizona Society for Healthcare Risk Managers November 15, 2013
HIPAA: Final Omnibus Rule is Here Arizona Society for Healthcare Risk Managers November 15, 2013 Pat Henrikson, Banner Health HIPAA Compliance Program Director, Chief Privacy Officer Agenda Background
More informationRegenstrief Center for Healthcare Engineering HIPAA Compliance Policy
Regenstrief Center for Healthcare Engineering HIPAA Compliance Policy Revised December 6, 2017 Table of Contents Statement of Policy 3 Reason for Policy 3 HIPAA Liaison 3 Individuals and Entities Affected
More informationThe Impact of Final Omnibus HIPAA/HITECH Rules. Presented by Eileen Coyne Clark Niki McCoy September 19, 2013
The Impact of Final Omnibus HIPAA/HITECH Rules Presented by Eileen Coyne Clark Niki McCoy September 19, 2013 0 Disclaimer The material in this presentation is not meant to be construed as legal advice
More informationBusiness Associate Contracts: Time Is Running Out...
Business Associate Contracts: Time Is Running Out... Rebecca L. Williams, RN, JD Partner Seattle, WA beckywilliams@dwt.com 206-628-7769 ... Or April Angst, Again April 2003: First deadline April 14, 2004:
More informationHIPAA HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT
HIPAA HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT HIPAA OMNIBUS FINAL RULE HITECH GINA TERMINOLOGY OMNIBUS FINAL RULE Issued January 23, 2013 Effective March 26, 2013 Modified HIPAA privacy and security
More informationCompliance Steps for the Final HIPAA Rule
Compliance Steps for the Final HIPAA Rule On Jan. 25, 2013, the Department of Health and Human Services (HHS) issued a final rule under HIPAA s administrative simplification provisions. The final rule
More informationHIPAA 102a. Presented by Jack Kolk President ACR 2 Solutions, Inc.
HIPAA 102a What You Don t Know About HIPAA Privacy and Security Can Really Hurt You! Revision 2015 Presented by Jack Kolk President ACR 2 Solutions, Inc. Todays Agenda: 1) About Myself - Jack Kolk, CEO
More informationHIPAA OMNIBUS RULE. The rule makes it easier for parents and others to give permission to share proof of a child s immunization with a school
ASPPR The omnibus rule greatly enhances a patient s privacy protections, provides individuals new rights to their health information, and strengthens the government s ability to enforce the law. The changes
More informationHighlights of the Omnibus HIPAA/HITECH Final Rule
Highlights of the Omnibus HIPAA/HITECH Final Rule Health Law Whitepaper Katherine M. Layman 215.665.2746 klayman@cozen.com Gregory M. Fliszar 215.665.7276 gfliszar@cozen.com Judy Wang Mayer 215.665.4737
More informationHIPAA PRIVACY REQUIREMENTS. Dana L. Thrasher Constangy, Brooks & Smith, LLP (205)
HIPAA PRIVACY REQUIREMENTS Dana L. Thrasher Constangy, Brooks & Smith, LLP dthrasher@constangy.com (205) 226-5464 1 REASONS FOR HIPAA PRIVACY RULES Perceived need for protection of individual health information
More informationTHE CITY AND COUNTY OF SAN FRANCISCO SECTION 125 CAFETERIA PLAN HIPAA PRIVACY POLICIES & PROCEDURES
THE CITY AND COUNTY OF SAN FRANCISCO SECTION 125 CAFETERIA PLAN HIPAA PRIVACY POLICIES & PROCEDURES Effective: November 8, 2012 Terms used, but not otherwise defined, in this Policy and Procedure have
More informationNOTIFICATION OF PRIVACY AND SECURITY BREACHES
NOTIFICATION OF PRIVACY AND SECURITY BREACHES Overview The UT Health Science Center at San Antonio (Health Science Center) is required to report all breaches of protected health information and personally
More informationUAMS ADMINISTRATIVE GUIDE NUMBER: 2.1
UAMS ADMINISTRATIVE GUIDE NUMBER: 2.1.12 DATE: 04/01/2003 REVISION: 3/1/2004; 12/28/2010; 01/02/2013 PAGE: 1 of 18 SECTION: HIPAA AREA: HIPAA PRIVACY/SECURITY POLICIES SUBJECT: HIPAA RESEARCH POLICY PURPOSE
More informationPreparing for a HIPAA Audit & Hot Topics in Health Care Reform
Preparing for a HIPAA Audit & Hot Topics in Health Care Reform 2013 San Francisco Mid-Sized Retirement & Healthcare Plan Management Conference March 17-20, 2013 Elizabeth Loh, Esq. Copyright Trucker Huss,
More informationBusiness Associate Agreement
This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: Vendor: Business Associate Agreement This Business Associate Agreement
More informationEffective Date: 4/3/17
HIPAA AND HITECH ADM 067.4 Attachment D Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule Health Information Technology for Economic and Clinical Health (HITECH)
More informationTexas Tech University Health Sciences Center HIPAA Privacy Policies
Administration Policy 1.1 Glossary of Terms - HIPAA Effective Date: January 15, 2015 Reviewed Date: August 7, 2017 References: http://www.hhs.gov/ocr/hippa HSC HIPAA website http://www.ttuhsc.edu/hipaa/policies_procedures.aspx
More informationTexas Tech University Health Sciences Center El Paso HIPAA Privacy Policies
Administration Policy 1.1 Glossary of Terms - HIPAA Effective Date: January 15, 2015 References: http://www.hhs.gov/ocr/hipaa TTUHSC El Paso HIPAA website: http://elpaso.ttuhsc.edu/hipaa/ Policy Statement
More informationTitle: HP-53 Use and Disclosure of Protected Health Information for Purposes of Research. Department: Research
Title: HP-53 Use and Disclosure of Protected Health Information for Purposes of Research Department: Research I. STATEMENT OF POLICY In order for an investigator to use or disclose protected health information
More informationLong-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates
Long-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates March 7, 2013 Brad M. Rostolsky Partner Reed Smith LLP brostolsky@reedsmith.com Nancy E.
More informationCOLUMBIA UNIVERSITY DATA CLASSIFICATION POLICY
COLUMBIA UNIVERSITY DATA CLASSIFICATION POLICY I. Introduction Published: October 2013 Revised: November 2014, April 2016, October 2017 As indicated in the Columbia University Information Security Charter
More informationUNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER INSTITUTIONAL REVIEW BOARD USE OF PROTECTED HEALTH INFORMATION WITHOUT SUBJECT AUTHORIZATION
UNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER INSTITUTIONAL REVIEW BOARD USE OF PROTECTED HEALTH INFORMATION WITHOUT SUBJECT AUTHORIZATION I. PURPOSE To provide guidance to investigators regarding the
More informationHIPAA PRIVACY REQUIREMENTS. Dana L. Thrasher Robert S. Ellerbrock, III Constangy, Brooks & Smith, LLP
HIPAA PRIVACY REQUIREMENTS Dana L. Thrasher Robert S. Ellerbrock, III Constangy, Brooks & Smith, LLP dthrasher@constangy.com (205) 226-5464 1 Reasons for HIPAA Privacy Rules Perceived need for protection
More informationIt s as AWESOME as You Think It Is!
It s as AWESOME as You Think It Is! Fine Print This presentation and any materials and/or comments are training and educational in nature only. They do not establish an attorney-client relationship, are
More informationHIPAA Omnibus Rule. Critical Changes for Providers Presented by Susan A. Miller, JD. Hosted by
HIPAA Omnibus Rule Critical Changes for Providers Presented by Susan A. Miller, JD Hosted by agenda What the Omnibus Rule includes + Effective and Compliance Dates Security Breach Notification Enforcement
More informationGetting a Grip on HIPAA
Getting a Grip on HIPAA Privacy and Security of Health Information in the Post-HITECH Age Jean C. Hemphill hemphill@ballardspahr.com 215.864.8539 Edward I. Leeds leeds@ballardspahr.com 215.864.8419 Amy
More informationUniversity of Mississippi Medical Center Data Use Agreement Protected Health Information
Data Use Agreement Protected Health Information This Data Use Agreement ( DUA ) is effective on the day of, 20, ( Effective Date ) by and between University of Mississippi Medical Center (UMMC) ( Data
More informationARTICLE 1. Terms { ;1}
The parties agree that the following terms and conditions apply to the performance of their obligations under the Service Contract into which this Exhibit is being incorporated. Contractor is providing
More informationHIPAA 2014: Recent Changes from HITECH and the Omnibus Rule. Association of Corporate Counsel Houston Chapter October 14, 2014.
HIPAA 2014: Recent Changes from HITECH and the Omnibus Rule Association of Corporate Counsel Houston Chapter October 14, 2014 Jeffery P. Drummond Jackson Walker L.L.P. 901 Main Street, Suite 6000 Dallas,
More informationLong-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates
Long-Awaited HITECH Final Rule: Addressing the Impact on Operations of Covered Entities and Business Associates November 7, 2013 Brad M. Rostolsky Partner Reed Smith LLP brostolsky@reedsmith.com Nancy
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) by and between (hereinafter known as Covered Entity ) and Office Ally, Inc., a clearinghouse Covered Entity under HIPAA, providing
More informationHIPAA Privacy Overview
HIPAA Privacy Overview Benefit Advisors Network Stacy H. Barrow sbarrow@marbarlaw.com February 8, 2017 2017 Marathas Barrow Weatherhead Lent LLP. All Rights Reserved. 1 Overview of Presentation HIPAA Overview
More informationHIPAA The Health Insurance Portability and Accountability Act of 1996
HIPAA The Health Insurance Portability and Accountability Act of 1996 Results Physiotherapy s policy regarding privacy and security of protected health information (PHI) is a reflection of our commitment
More informationHIPAA COMPLIANCE. for Small & Mid-Size Practices
HIPAA COMPLIANCE for Small & Mid-Size Practices Golden State Web Solutions 619.825.GSWS (4797) INTRODUCTION Most individuals reading this are interested in HIPAA, GSWS, or some combination of the two;
More informationCLIENT UPDATE. HIPAA s Final Rule: The Impact on Covered Entities, Business Associates and Subcontractors
CLIENT UPDATE February 20, 2013 HIPAA s Final Rule: The Impact on Covered Entities, Business Associates and Subcontractors On January 25, 2013, the U.S. Department of Health and Human Services ( DHHS )
More informationCOMPLIANCE TRAINING 2015 C O M P L I A N C E P R O G R A M - F W A - H I P A A - C O D E O F C O N D U C T
COMPLIANCE TRAINING 2015 QUALITY MANAGEMENT COMPLIANCE DEPARTMENT 2015 C O M P L I A N C E P R O G R A M - F W A - H I P A A - C O D E O F C O N D U C T Compliance Program why? Ensure ongoing education
More informationEmma Eccles Jones College of Education & Human Services. Title: Business Associate Agreements
POLICY INFORMATION Document # 900 Revision # 1.0 Safeguard: Administrative Title: Business Associate Agreements Prepared by: J. Black Approved by: Dean Beth E. Foley Print Date: 8/29/2016 Date Prepared:
More informationAGREEMENT PURSUANT TO THE TERMS OF HIPAA ; HITECH ; and FIPA (Business Associate Agreement) (Revised August 2015)
AGREEMENT PURSUANT TO THE TERMS OF HIPAA ; HITECH ; and FIPA (Business Associate Agreement) (Revised August 2015) THIS AGREEMENT made the day of, 20, by and between HOSPICE OF MARION COUNTY, INC., a Florida
More informationSDM Health Insurance Portability and Accountability Act (HIPAA) Terms and Conditions For Business Associates
Policy and Procedure: SDM HIPAA Terms and Conditions for (Adapted from UPMC s HIPAA Terms and Conditions for at http://www.upmc.com/aboutupmc/supplychainmanagement/documents/terms.pdf) Effective: 03/30/2012
More informationARRA s Amendments to HIPAA Privacy & Security Rules
ARRA s Amendments to HIPAA Privacy & Security Rules Georgina L. O Hara Jessica R. Bernanke April 29, 2009 www.morganlewis.com Amended HIPAA Privacy and Security Rules HIPAA Amendments are in The Health
More informationHIPAA Enforcement Under the HITECH Act; The Gloves Come Off
HIPAA Enforcement Under the HITECH Act; The Gloves Come Off Leeann Habte, Esq. Michael Scarano, Esq. December 6, 2011 Attorney Advertising Prior results do not guarantee a similar outcome Models used are
More informationHIPAA PRIVACY AND SECURITY RULES APPLY TO YOU! ARE YOU COMPLYING? RHODE ISLAND INTERLOCAL TRUST LINN F. FREEDMAN, ESQ. JANUARY 29, 2015.
HIPAA PRIVACY AND SECURITY RULES APPLY TO YOU! ARE YOU COMPLYING? RHODE ISLAND INTERLOCAL TRUST LINN F. FREEDMAN, ESQ. JANUARY 29, 2015. PURPOSE OF PRESENTATION To Discuss Laws Governing Use and Disclosure
More informationCROOK COUNTY POLICY AND PROCEDURES FOR COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
CROOK COUNTY POLICY AND PROCEDURES FOR COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 Update 2-17-2016 CROOK COUNTY RECORD OF CHANGES 2 TABLE OF CONTENTS Introduction HIPAA
More informationHITECH and HIPAA: Highlights for Health Departments. Aimee Wall UNC School of Government
HITECH and HIPAA: Highlights for Health Departments Aimee Wall UNC School of Government When Congress enacted sweeping legislation in February designed to stimulate the nation s economy, it incorporated
More information8/14/2013. HIPAA Privacy & Security 2013 Omnibus Final Rule update. Highlights from Final Rules January 25, 2013
HIPAA Privacy & Security 2013 Omnibus Final Rule update Dan Taylor, Infinisource Copyright 2013 All rights reserved. Highlights from Final Rules January 25, 2013 Made business associates directly liable
More informationSUBCONTRACTOR BUSINESS ASSOCIATE AGREEMENT
SUBCONTRACTOR BUSINESS ASSOCIATE AGREEMENT (Revised on March 1, 2016) THIS HIPAA SUBCONTRACTOR BUSINESS ASSOCIATE AGREEMENT (the BAA ) is entered into on (the Effective Date ), by and between ( EMR ),
More informationCoping with, and Taking Advantage of, HIPAA s New Rules!! Deven McGraw Director, Health Privacy Project April 19, 2013!
Coping with, and Taking Advantage of, HIPAA s New Rules!!! Deven McGraw Director, Health Privacy Project April 19, 2013! Status of Federal Privacy Regulations! Omnibus Rule (Data Breach, Enforcement, HITECH,
More informationPrivacy Rule Primer. 45 CFR Part 160 and Subparts A and E of Part CFR , 45 CFR CFR
Resource provided by Page 1 of 10 Contents I. The Privacy Rule The Fundamental HIPAA Rule... 1 II. Privacy Rule Overview... 1 III. Privacy Rule Standards and Implementation Specifications Covered in Section
More informationInterpreters Associates Inc. Division of Intérpretes Brasil
Interpreters Associates Inc. Division of Intérpretes Brasil Adherence to HIPAA Agreement Exhibit B INDEPENDENT CONTRACTOR PRIVACY AND SECURITY PROTECTIONS RECITALS The purpose of this Agreement is to enable
More informationThe Privacy Rule. Health insurance Portability & Accountability Act
The Privacy Rule Health insurance Portability & Accountability Act Enacted on August 21, 1996 to amend the Internal Revenue Code of 1986 To improve portability and continuity of health insurance coverage
More informationHIPAA OMNIBUS FINAL RULE
HIPAA OMNIBUS FINAL RULE Webinar Series Part 3 Breach Notification April 16, 2013 I. BACKGROUND 2 1 Background > HIPAA Omnibus Final Rule: Announced on January 17, 2013 Published in Federal Register on
More informationHIPAA BUSINESS ASSOCIATE AGREEMENT BEST PRACTICES: A COMPLIANCE SOLUTION FOR THE TICKING CLOCK AND THE DRACONIAN CIVIL AND CRIMINAL PENALTIES
HIPAA BUSINESS ASSOCIATE AGREEMENT BEST PRACTICES: A COMPLIANCE SOLUTION FOR THE TICKING CLOCK AND THE DRACONIAN CIVIL AND CRIMINAL PENALTIES January 23, 2014 I. Executive Summary I: The HIPAA Final Rule
More informationWhat Brown County employees need to know about the Federal legislation entitled the Health Insurance Portability and Accountability Act of 1996.
What Brown County employees need to know about the Federal legislation entitled the Health Insurance Portability and Accountability Act of 1996. HIPAA stands for Health Insurance Portability and Accountability
More informationHIPAA Omnibus Final Rule and Research
Office of the Secretary Office for Civil Rights () HIPAA Omnibus Final Rule and Research Federal Demonstration Partnership September 17, 2013 Christina Heide, JD Senior Health Information Privacy Policy
More informationHIPAA Privacy & Security Considerations Student Orientation
Health Insurance Portability and Accountability Act (HIPAA) HIPAA Privacy & Security Considerations Student Orientation The information in this presentation is designed to provide an overview of the HIPAA
More informationThe HIPAA Omnibus Rule and the Enhanced Civil Fine and Criminal Penalty Regime
HIPAA BUSINESS ASSOCIATE AGREEMENT BEST PRACTICES: UPDATE 2015 February 20, 2015 I. Executive Summary HIPAA is a federal law passed by Congress to protect medical patient data privacy from misuse or disclosure
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (this Agreement ) is made effective as of the of, (the Effective Date ), by and between day hereafter referred to as ( Business Associate
More information1. Does the plan exist for purposes of providing or paying for the cost of medical care?
HUMAN RESOURCES & BENEFITS INFORMATION HIPPA FLOW CHART Questions and Answers 1. Does the plan exist for purposes of providing or paying for the cost of medical care? A health plan could be an individual
More informationUCLA Health System Data Use Agreement
UCLA Health System Data Use Agreement The federal Health Insurance Portability and Accountability Act and the regulations promulgated thereunder (collectively referred to as the Privacy Rule ) permit the
More informationHEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) BUSINESS ASSOCIATE AGREEMENT
Attachment G HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) BUSINESS ASSOCIATE AGREEMENT Health Insurance Portability and Accountability Act (HIPAA) Compliance This HIPAA Business Agreement
More informationHIPAA Redux 2013 Kim Cavitt, AuD Audiology Resources, Inc. Expert e-seminar 4/29/2013. HIPAA Redux Presented by: Kim Cavitt, AuD
HIPAA Redux 2013 Presented by: Kim Cavitt, AuD Moderated by: Carolyn Smaka, Au.D., Editor-in-Chief, AudiologyOnline Expert e-seminar TECHNICAL SUPPORT Need technical support during event? Please contact
More informationHILLSBOROUGH COUNTY HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) PROCEDURES
HILLSBOROUGH COUNTY HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) PROCEDURES July 1, 2017 Table of Contents Section 1 - Statement of Commitment to Compliance... 3 Section 2 General Guidelines
More informationO n Jan. 25, the Office for Civil Rights (OCR) of the. Privacy and Security Law Report
Privacy and Security Law Report Reproduced with permission from Privacy & Security Law Report, 12 PVLR 168, 02/04/2013. Copyright 2013 by The Bureau of National Affairs, Inc. (800-372-1033) http://www.bna.com
More informationPATTERSON MEDICAL SUPPLY, INC. HIPAA BUSINESS ASSOCIATE AGREEMENT WITH CUSTOMERS
PATTERSON MEDICAL SUPPLY, INC. HIPAA BUSINESS ASSOCIATE AGREEMENT WITH CUSTOMERS This HIPAA Business Associate Agreement ( BA Agreement ), effective as of the last date written on the signature page attached
More informationBusiness Associate Agreement For Protected Healthcare Information
Business Associate Agreement For Protected Healthcare Information This Business Associate Agreement ( Agreement ) is entered into this 24th day of February 2017, between PRACTICE-WEB, Inc., a California
More informationChanges to HIPAA Privacy and Security Rules
Changes to HIPAA Privacy and Security Rules STEPHEN P. POSTALAKIS BLAUGRUND, HERBERT AND MARTIN 300 WEST WILSON BRIDGE ROAD, SUITE 100 WORTHINGTON, OHIO 43085 SPP@BHMLAW.COM PERSONNEL COUNCIL FRANKLIN
More informationHEALTHCARE BREACH TRIAGE
IAPP Privacy Academy September 30 October 2, 2013 HEALTHCARE BREACH TRIAGE Theodore P. Augustinos EDWARDS WILDMAN PALMER LLP Kenneth P. Mortensen CVS/CAREMARK 2013 Edwards Wildman Palmer LLP & Edwards
More informationHIPAA Omnibus Final Rule Has Important Changes for Business Associates and Covered Entities
Health Care Focus March 2013 HIPAA Omnibus Final Rule Has Important Changes for Business Associates and Covered Entities Peggy L. Barlett 608.284.2214 pbarlett@gklaw.com M. Scott LeBlanc 414.287.9614 sleblanc@gklaw.com
More informationHIPAA Business Associate Agreement
HIPAA Business Associate Agreement ICANotes LLC doing business at 1600 St Margarets Rd, Annapolis MD 21409 and, doing business at are parties to a Business Associate arrangement as defined under the Health
More informationUniversity of California Group Health and Welfare Benefit Plans HIPAA Privacy Rule Policies and Procedures (Interim)
Group Insurance Regulations Administrative Supplement No. 19 April 2003 University of California Group Health and Welfare Benefit Plans HIPAA Privacy Rule Policies and Procedures (Interim) The University
More informationHIPAA Background and History
Agenda Jeffery P. Drummond Lawyers as HIPAA Business Associates: Ethical Obligations and Practical Tips for Compliance Dallas Bar Association January 17, 2018 Jamie Sorley An Overview of HIPAA The Privacy
More informationHIPAA & HITECH Privacy & Security. Volunteer Annual Review 2017
HIPAA & HITECH Privacy & Security Volunteer Annual Review 2017 HIPAA In 1996, state and federal governments enacted protection for patient health information by signing into law the Health Insurance Portability
More information2013 HIPAA Omnibus Regulations: New Rules for Healthcare Providers and Collections Partners
2013 HIPAA Omnibus Regulations: New Rules for Healthcare Providers and Collections Partners Providers, and Partners 2 Editor s Foreword What follows are excerpts from the U.S. Department of Health and
More informationHIPAA BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATES AND SUBCONTRACTORS
HIPAA BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATES AND SUBCONTRACTORS This HIPAA Business Associate Agreement ( BAA ) is entered into on this day of, 20 ( Effective Date ), by and between Allscripts
More informationHIPAA and Lawyers: Your stakes have just been raised
HIPAA and Lawyers: Your stakes have just been raised October 16, 2013 Presented by: Harry Nelson e: hnelson@fentonnelson.com Claire Marblestone e: cmarblestone@fentonnelson.com AGENDA Statutory & Regulatory
More informationAssessing and Mitigating Risk Under the HIPAA Omnibus Rule
Compliance Institute San Diego, CA April 1, 2014 Assessing and Mitigating Risk Under the HIPAA Omnibus Rule Darrell W. Contreras, Esq., LHRM, CHPC, CHC, CHRC Chief Legal & Compliance Officer PlusDelta
More informationAssessing and Mitigating Risk Under the HIPAA Omnibus Rule
Compliance Institute San Diego, CA April 1, 2014 Assessing and Mitigating Risk Under the HIPAA Omnibus Rule Darrell W. Contreras, Esq., LHRM, CHPC, CHC, CHRC Chief Legal & Compliance Officer PlusDelta
More informationThis form cannot act as an authorization to assign commissions. Appointment Form Only. Steps to obtain an Appointment:
Appointment Form Only Steps to obtain an Appointment: Complete the Personal Information Sheet Entirely The Personal Information Sheet is used to obtain information necessary to establish an appointment
More informationManagement Alert Final HIPAA Regulations Issued
Management Alert Final HIPAA Regulations Issued After much anticipation, the Department of Health and Human Services (HHS) has issued its omnibus set of final regulations modifying and clarifying the privacy,
More informationExecutive Policy, EP HIPAA. Page 1 of 25
Executive Policy, EP 2.217 HIPAA Page 1 of 25 Executive Policy Chapter 2, Administration Executive Policy EP 2.217, HIPAA Policy Effective Date: June 2017 Prior Dates Amended: None Responsible Office:
More informationBUSINESS ASSOCIATE AGREEMENT W I T N E S S E T H:
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT ( this Agreement ) is made and entered into as of this day of 2015, by and between TIDEWELL HOSPICE, INC., a Florida not-for-profit corporation,
More informationSaturday, April 28 Medical Ethics: HIPAA Privacy and Security Rules
Saturday, April 28 Medical Ethics: HIPAA Privacy and Security Rules Gina Campanella, JD HIPAA & The Medical Practice Requirements for Privacy, Security and Breach Notification Gina L. Campanella, Esq.
More information