Patient health data breaches can cost healthcare providers and legal business associates up to $1.5 million for violations of a single HIPAA provision, and the HIPAA Omnibus Rule, which took effect on Sep. 23, 2013, changed the definition of what constitutes a breach of PHI, according to an Anesthesia Business Consultants blog post.
According to the Omnibus Rule, any disclosure of PHI that violates the HIPAA privacy rule is presumed to be a breach unless a covered entity or business associate demonstrates that there is a low probability the information was compromised by undertaking a risk assessment that meets certain requirements.
The blog post lays out action steps recommended by the law firm McDonald Hopkins to help anesthesiology and pain medicine practices avoid patient health data breaches:
1. Review and update written HIPAA privacy, security and breach notification policies and procedures.
2. Identify and review all business associate relationships and ensure that appropriate business associate agreements are in place.
3. Perform risk analysis to assess potential risks and vulnerabilities to the confidentiality, integrity and availability of all electronic PHI.
4. Take action on security gaps and promptly correct identified HIPAA violations.
5. Document HIPAA-related determinations and actions.
6. Train members of the workforce to comply with the HIPAA rules and identify, investigate and respond to possible data breaches.
7. Encrypt electronic PHI as much as possible.
8. Avoid unnecessary disclosures of PHI.
9. Obtain (or at least determine the feasibility of) cyber insurance.
More Articles on Anesthesia:
North Carolina Society of Anesthesiologists Elects Dr. Frank Sutton Secretary, Treasurer
Performing High Acuity Cases in ASCs: The Anesthesiologist's Role
5 Anesthesiology Practice Mergers, Acquisitions