Tag Archives for: "Omnibus rule"

The Newest Standard for Notifying Patients of a PHI Breach

Before the HIPAA Omnibus Rule went into effect last year, the standard for determining whether or not patients needed to be notified in the event of a breach of Protected Health Information (PHI) was pretty subjective.  If, for instance, a computer with PHI  of 3000+ patients was stolen from a small practice, it was the responsibility of the practice’s Privacy Officer to assess whether the theft was likely to result in harm to any patient’s reputation or bank account. If the answer was “yes,” then the breach had to be reported and the patients notified. The trouble with that standard […]

Read more »

Recent Changes in the Notice of Privacy Practices: What You Need to Know

If there’s one aspect of HIPAA compliance it seems every office implements, it’s the Notice of Privacy Practices (NPP) — the document that informs patients of the permitted uses and disclosures of their Protected Health Information (PHI) and also spells out their rights as patients regarding their own access to their PHI. I can vouch for the widespread use of NPPs from my own experience as a healthcare consumer. At every first-time visit to a doctor’s or dentist’s office in recent memory, I’ve been handed a clipboard with a lengthy, legal-sounding NPP to read, along with a pen to sign […]

Read more »

Basics of a Good Business Associate Agreement for HIPAA

When it comes to safeguarding Protected Health Information (PHI), you could say, “It takes a village.”  The Omnibus Rule underscores the fact that protecting patients’ health information and their right to privacy is the responsibility today not only of healthcare providers, but also of their business associates (BAs) whose work requires them to access PHI.  And the Business Associate Agreements mandated by HIPAA play an important role in that shared responsibility. Get your free BAA template here! (Not.) In this post I’d like to offer a handy BAA template that would work for all your business associates, as defined by […]

Read more »

Having Business Associate Agreements Can Save a Healthcare Office Boku Bucks

“The times they are a changin’,” Bob Dylan sang in the Sixties. And they still are, especially when it comes to HIPAA and its regulaltions regarding Business Associate Agreements. The Omnibus Rule that went into effect in September of 2013 makes it clear that business associates of healthcare practices now have to comply with many of the provisions of the HIPAA Privacy Rule, all of the HIPAA Security Rule, and HIPAA’s Breach Notification Rule. While Business Associate Agreements have been part of HIPAA since it began, the big changes since the passage of the Omnibus Rule include: An expanded definition […]

Read more »

Most HIPAA Checklists Are a Waste of Time. Here’s Why.

Just now, out of curiosity, I Googled the words “HIPAA compliance checklist.” Within .20 seconds I got 2,470,000 results. Page after Google page of businesses, legal firms, healthcare organizations, and government agencies offering everything from “Ten-Point HIPAA Checklists” to “$89 Compliance Checklists.” The appeal of such lists is undeniable. Knowing what I know about HIPAA and its complexity, I can easily understand how a simple checklist might be viewed as a possible compliance solution. Putting “X’s” in little boxes next to questions on a checklist downloaded from an official-looking website sure beats reading the 500+ pages of the Omnibus Rule. […]

Read more »