Contact Us
Categories
- Medical Spas
- medical billing
- No Surprises Act
- Mandatory vaccination policies
- Workplace health
- Coronavirus Aid, Relief and Economic Security Act
- Code Enforcement
- Department of Labor ("DOL")
- Employment Law
- FFCRA
- CARES Act
- Nursing Home Reform Act
- COVID-19
- SB 150
- Acute Care Beds
- Clinical Support
- Coronavirus
- Emergency Medical Services
- Emergency Preparedness
- Families First Coronavirus Response Act
- Family and Medical Leave Act (“FMLA”)
- KBML
- medication assisted therapy
- Department of Health and Human Services
- Legislative Developments
- Corporate
- United States Department of Justice ("DOJ")
- Employee Contracts
- Non-Compete Agreement
- Opioid Epidemic
- Sexual Harassment
- Health Resource and Services Administration
- Litigation
- Medical Malpractice
- House Bill 333
- Senate Bill 79
- locum tenens
- Physician Prescribing Authority
- Senate Bill 4
- Chronic Pain Management
- HIPAA
- Prescription Drugs
- "Two Midnights Rule"
- 340B Program
- EHR Systems
- Hospice
- Kentucky minimum wage
- Minimum wage
- Skilled Nursing Facilities (“SNFs”)
- Uncategorized
- Drug Screening
- Electronic Health Records (“EHR")
- ICD-10
- Mental Health Care
- Primary Care Physicians ("PCPs")
- Urinalysis
- Affordable Insurance Exchanges
- Compliance
- Department of Health and Human Services (HHS)
- Federally Qualified Health Centers (“FQHCs”)
- Fraud
- Health Care Fraud
- HIPAA Risk Assessment
- HPSA
- KASPER
- Kentucky Board of Medical Licensure
- Kentucky’s Department for Medicaid Services
- Office for Civil Rights ("OCR")
- Office of Inspector General of the United States Department of Health and Human Services (OIG)
- Pharmacists
- Physician Assistants
- Qui Tam
- Rural Health Centers (“RHCs”)
- Stark Laws
- Telehealth
- Accountable Care Organizations (“ACO”)
- Affordable Care Act
- Alternative Payment Models
- Anti-Kickback Statute
- Centers for Medicare & Medicaid Services (“CMS”)
- Certificate of Need ("CON")
- Charitable Hospitals
- Data Breach
- Electronic Protected Health Information (ePHI)
- False Claims Act
- Fee for Service
- Health Information Technology for Economic and Clinical Health Act (HITECH Act)
- Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- Health Professional Shortage Area ("HPSA")
- Hospitals
- HRSA
- Limited Services Clinics
- Medicaid
- Medical Staff By-Laws
- Medically Underserved Area ("MUA")
- Medicare
- Mid-Level Practitioners
- Part D
- Patient Protection and Affordable Care Act (“ACA”)
- Rural Health Clinic
- American Telemedicine Association (“ATA”)
- Criminal Division of the Department of Justice (“DOJ”)
- Health Care Fraud Prevention and Enforcement Action Team (“HEAT”)
- Hydrocodone
- Kentucky Board of Nursing
- Kentucky Pharmacists Association
- Qualified Health Care Centers (“FQHC”)
- Telemedicine
- Webinar
- Agreed Order
- APRNs
- Chain and Organization System (“PECOS”)
- Douglas v. Independent Living Center of Southern California
- Drug Enforcement Agency ("DEA")
- Hinchy v. Walgreen Co.
- Jimmo v. Sebelius
- Maintenance Standard
- Overpayments
- United States ex. Rel. Kane v. Continuum Health Partners
- Vitas Innovative Hospice Care
- 2014 Medicare Physician Fee Schedule (“PFS”)
- 501(c)(3)
- All-Payer Claims Database ("APCD")
- Chiropractic services
- Chronic Care Management
- Clinical Laboratory Improvement Amendments of 1988 (“CLIA”)
- Compliance Officer
- Compounding
- CPR
- Drug Quality and Security Act (“DQSA”)
- Emergency Rooms
- Enrollment
- Essential Health Benefits
- House Bill 3204
- ICD-9
- Kentucky Senate Bill 7
- Medicare Part D
- Minors
- New England Compounding Center ("NECC")
- Ophthalmological services
- Outsourcing facility
- Physician Compare website
- Re-validation
- Sustainable Growth Rate (“SGR”)
- Texting
- Affinity Health Plan
- Appeal
- Arbitration
- Cadillac tax
- Centers for Disease Control and Prevention
- Community health needs assessment (“CHNA”)
- Condition of Participation ("CoP")
- Denied Claims
- Department of Medicaid Services’ (“DMS”)
- Dispenser
- Employer Mandate
- Federation of State Medical Boards (“FSMB”)
- Food and Drug Administratio
- Form 4720
- Grace Period
- Health Professional Shortage Areas (“HPSA”)
- HealthCare.gov
- Home Health Prospective Payment System
- Home Medical Equipment Providers
- Hospitalists
- Individual mandate
- Inpatient Care
- Kentucky Health Benefit Exchange
- Kentucky Medical Practice Act
- Kindred v. Cherolis
- Kynect
- Licensure Requirements
- LLC v. Sutter
- Long-term care communities
- Long-Term Care Providers ("LTC")
- Low-utilization payment adjustment ("LUPA")
- Medicare Shared Saving Program (MSSP)
- Mobile medical applications ("apps")
- Model Policy for the Appropriate Use of Social Media and Social Networking in Medical Practice (“Model Policy”)
- National Drug Code ("NDC")
- National Institutes of Health
- Network provider agreement
- Nonprofit hospitals
- Nonroutine medical supplies conversion factor (“NRS”)
- Payors
- Personal Service Entities
- Physician Payments
- Physician Recruitment
- Physician shortages
- Ping v. Beverly Enterprises
- Power of Attorney ("POA")
- Prescriber
- Qualified Health Plan ("QHP")
- Quality reporting
- Residency Programs
- Social Media
- Spousal coverage
- State Health Plan
- Upcoding
- UPS
- “Superuser”
- "Plan of Correction"
- Advanced Practice Registered Nurses
- Audit
- Autism/ASD
- Business Associate Agreements
- Business Associates
- Call Coverage
- Daycare centers
- Decertification
- Division of Regulated Child Care
- Doe v. Guthrie Clinic
- EHR vendor
- Employer Group Health Plans
- ERISA
- Fair Labor Standards Act (FLSA)
- False Billings
- Genetic Information Nondiscrimination Act ("GINA")
- Group Purchasing Organizations ("GPO")
- Health Reform
- House Bill 104
- Intermediate Sanctions Agreement
- Kentucky House Bill 159
- Kentucky House Bill 217
- Licensed practical nurses (LPN)
- List of Excluded Individuals and Entities
- Meaningful use incentives
- Medicare Administrative Coordinators
- Medicare Benefit Policy Manual
- Nurse practitioners (NP)
- Office of the National Coordinator for Health Information Technology (“ONC”)
- Part A
- Part B
- Patient Autonomy
- Patient Privacy
- Personal Health Information
- Provider Self Disclosure Protocol
- Registered nurses (RN)
- Self-Disclosure Protocol
- Senate Bill 39
- Senate Finance Committee Report
- State Medicaid Expansion
- Statement of Deficiency ("SOD")
- Trade Association Group Coverage
- Abuse and Waste
- Center for Disease Control
- Compliance Programs
- Consumer Operated and Oriented Plan programs (“CO-OPS”)
- Critical Access Hospitals (“CAHs”)
- Essential Health Benefits (“EHBs”)
- Healthcare Information and Management Systems Society (HIMSS)
- Kentucky Cabinet for Health and Family Services
- Kentucky Health Care Co-Op
- Kentucky Health Cooperative (“KYHC”)
- Kentucky Primary Care Centers (“PCCs”)
- Managed Care Organizations (“MCOs”)
- Medicare Audit Improvement Act of 2012
- Occupational Safety and Health Administration (“OSHA”)
- Recovery Audit Contractors (“RAC”)
- Small Business Health Options Program (“SHOP”)
- Sunshine Act
- Employee Agreement
- Free Conference Committee Report
- Health Care Fraud and Abuse Control Program
- House Bill 1
- House Bill 4
- Kentucky “Pill Mill Bill”
- Pain Management Facilities
- Health Care Law
- Health Insurance
- Healthcare Regulation
McBrayer Blogs
OCR Offers “Lessons Learned” Regarding HIPAA Compliance
Two recent reports issued by the HHS Office for Civil Rights (“OCR”), pursuant to the HITECH Act, reveal some interesting information about HIPAA data breaches. The Annual Report to Congress on Breaches of Unsecured Protection Information (“Breach Report”) and the Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance (“Compliance Report”) should remind covered entities and their business associates about the many risks associated with HIPAA and the importance of compliance.
The Breach Report describes the types and numbers of reported breaches for a two year period (2011 and 2012) and provides some cumulative data on breaches reported after the breach notification requirements went into effect. During this two year period, the OCR received reports of 458 big HIPAA breaches affecting 500 or more individuals and a staggering 46,899 small HIPAA breaches affecting less than 500 individuals. OCR investigated all of the 458 large HIPAA breaches and investigated a number of the smaller HIPAA breaches.
Interestingly, OCR imposed its first Resolution Agreement for a small breach, which affected 441 individuals, after the theft of an employee laptop at Hospice of North Idaho in December 2012. For the larger breaches, OCR has entered into Resolution Agreements with seven (7) of the covered entities. The Breach Report revealed that:
- Under these agreements, the covered entities have agreed to pay more than $8 million.
- Nearly two (2) million individuals were affected by these breaches;
- Four (4) of these cases involved the theft of laptops or other electronic devices containing unsecured ePHI and the number one cause of security breaches in both years was theft; and,
- In addition to the settlements, OCR has entered into corrective action plans (“CAPs”) that require specific corrective actions on the part of the covered entities.
Breach Report, p. 20
As the Breach Report points out, CAPs can require a variety of corrective actions, including:
- Revising policies and procedures;
- Training or retraining workforce members who handle PHI;
- Conducting and documenting a risk assessment
- Changing passwords;
- Adopting encryption technologies; or,
- Performing a new risk assessment, among other things.
Breach Report, p. 20-24.
Because investigations and the subsequent agreements, settlements, and corrective actions can be costly to finances and reputations, the Breach Report concludes with a “Lessons Learned” section meant to help covered entities avoid some of the more common type of breaches. To read about the “Lessons Learned” section, check back on Thursday.
Services may be performed by others.
This article does not constitute legal advice.