Leave No Stone Unturned, When it comes to BAA HIPAA Compliance
Staying on top of HIPAA’s long and ever changing list of compliance prerequisites for your facility is no mean task. What’s more, there is no scope of error, just as the price of HIPAA noncompliance has become astronomical, as seen in recent cases of HIPAA breaches.
Although introspection is a desirable virtue, you would need much more than self-perfection; and having impeccable facility standards of HIPAA compliance would not suffice. All of us do need to take precautionary control of our business associates work protocols, as applicable to our association with them. Here’s why.
Save Yourself From your BAA’s Innocent Ignorance
When it comes to HIPAA, ignorance can never be a bliss. In a recent case, a hospital and its BA ended up paying $90,000 and slapped with extensive corrective measures to set right a breach arising from the theft of a laptop that stored unencrypted patient information.
This Hospital had a contract with a Corporation to help with a hospital project. The BA in this case, gave the work to its employee, who was provided a laptop from the hospital, containing the data of 8,883 patients, which was not encrypted by the laptop owner. It was eventually stolen, thereby endangering the PHI of the hospital patients.
This case gives you yet another reason to refine your Business Associate agreements (BAAs) well in time, and ensure that you are entrusting invaluable patient PHI into the hands of vendors, who are well conversant with the HIPAA stakes and compliance protocols. Further, make sure that the BA retain PHI only for as long as your contract requires. Remember, a chain is as strong as its weakest link.
Pay attention: HIPAA and state laws are crystal clear, as far as the responsibilities of BA’s and Covered entities (CE’s) for safeguarding PHI is concerned. Both need to maintain proper internal controls and policies to make sure that PHI is kept secure.
Get Wiser and Safer with These Action Items
Perfect your BAAs. The contract or agreements with the BA, need to be properly executed by the vendors or the business associates. Further, the CE should implement minimum security and privacy pointers whenever sharing of PHI is to take place with a vendor.
Invest in HIPAA compliance training. Empower your employees and help them shed off their potentially lethal ignorance. Provide them with periodical training and frequent refreshers to help them stay up to date with recent updates, HIPAA requirements, and even the recent breach news updates, so that they stay vigilant - not to repeat other’s mistakes.
Apply multi-layered encryption methods. You must always use a combination of software and hardware to encrypt files or data that contains PHI prior to transmitting it from its source. Maintain risk assessment checklists, to nail down the deficiencies, before they can harm your PHI.
Create compliance policies. Going a step further, in your own interest, experts suggest you maintain a policy mandating encryption of all PHI that is stored in portable devices, including laptops, mobiles, and transmitted through wireless networks. Further, as a preventive action towards the leading cause of HIPAA breaches, develop reasonable protocols and policies for employees to follow regarding safe and secure access, storage and transfer of PHI outside the facility’s premises.
Food for thought: Physical security continues to be the single most significant reason for HIPAA breaches. You need to double your efforts to address the security and privacy aspects of your HIPAA compliance solutions. Ask yourself question to begin with- What if someone barges into the office where PHI is secured? Will the documents be easily available to the burglar? What about physical access to terminals? Are your systems hacking proof? Get going with these action items.
stormborns
origamiaround
vaporwave
dailybridgerton
s-u-f-j-a-n-s-t-e-v-e-n-s