Preventing a HIPAA Violation in 2012

The government’s HIPAA Audit Program has been underway since November 2011, but it is scheduled to continue through the end of 2012. With more awareness and data breaches reported than ever, here are a few areas your company should be sure to evaluate this year in order to reduce your risk of a HIPAA violation.

Mobile Device Security
The infamous Ponemon Institute study on data breaches reports that 81 percent of healthcare organizations use mobile devices to collect, store and transmit patient data. Yet 49 percent take no security precautions to ensure those devices and patient data are protected, and less than 24 percent use encryption.

According to a Jackson & Coker report, four out of five physicians use smartphones, tablets and other mobile devices and apps in daily practice in order to collect patient data from patient exams and easily enter it into their digital EHR/EMR (electronic health or medical records) systems.

The top three healthcare specialties that use mobile devices most frequently include:

40% Emergency department physicians
33% Cardiologists
31% Urologists and Nephrologists

However, the use of mobile devices can increase the potential for a HIPAA breach, especially if the device is lost and not protected by a PIN or encrypted – see our previous blog post on Mobile Security: How Safe is Your Data? for more information.

Another way to protect sensitive data is to have it removed from devices before being transferred from a healthcare facility. A combination of technical security and establishing proper policies and procedures is important to keep up with HIPAA compliant standards.

Read more about our recommended security measures to achieve HIPAA compliance and pass an audit, and about the rise of mobile devices in the healthcare industry.

Business Associate Agreements
To save on capital costs and take advantage of expert knowledge, many turn to professional organizations that offer services to healthcare providers, including data hosting and billing companies. To a covered entity (a physician’s office or hospital collecting patient data), these companies are known as business associates.

But carefully choosing a vendor is extremely important to keeping compliance – business associate-related data breaches topped 62% of total number of patient records breached according to the Dept. of Health and Human Services.

How do you know your HIPAA hosting provider is credible? Ask them if they’re willing to sign a business associate agreement, or BAA, which is a contract that clearly outlines each party’s responsibility when it comes to data protection.

According to an InformationWeek.com article, only a third of organizations transferring patient data externally had signed data-sharing contracts with all of their contractors.

Online Tech signs a BAA with every healthcare client with patient data since we have possible access to or could affect the availability of patient data on their servers in our data centers. Although we never access patient or client data, the signed document codifies our commitment to follow HIPAA compliant rules.

Read more about business associates and business associate agreements.

Internal Operations
Check out your own staff and internal operations – often human error or mistrained/not-at-all-trained employees can be the root cause of a HIPAA violation. Those with access privileges can mishandle sensitive data.

In the case of the TRICARE/SAIC military healthcare contractor incident, an employee drove off government property and left their car unattended, during which time a thief made off with 4.9 million patient records on unencrypted backup tapes. A resulting lawsuit points out the DoD’s lack of employee training as one of the major offenses.

A survey report by PricewaterhouseCoopers (PwC) shows that slightly more than half of respondents reported a privacy or security issue in the past two years attributed most incidents to the improper use of patient health information by employees. Employee training on HIPAA policies and procedures as they affect day-to-day operations is key to eliminating any points of weakness within a company.

Online Tech was found to be 100% HIPAA compliant as a result of our HIPAA audit, and has undergone complete HIPAA employee training in our updated policies and procedures.

Watch our informative webinar, Impact of HIPAA Compliance on Business Associates, for more information from the perspective of our Director of Operations and Risk Management and Security Officer on the day-to-day operations of a HIPAA compliant data center.

References:
80% of Doctors Use Mobile Devices At Work
Smartphones Partly to Blame for HIPAA Compliance Issues
Integrated Security Reduces Health IT Data Breaches
Staying Vigilant Key to Meeting Regulatory Compliance Standards