Today, OCR announced five new settlements under its “HIPAA Right of Access Initiative,” making right of access the most prominent area of HIPAA enforcement so far this year. In 2019, OCR indicated that it would prioritize claims involving individuals’ right to receive timely access to their health records at a reasonable cost under the HIPAA Privacy Rule. And it is making good on its promise. All providers must pay special attention to this issue as patient complaints in this area are high and provider compliance typically is not strong.
Conducting an effective internal investigation is a critical compliance function. A flawed investigation may result in a failure to identify a compliance issue or to implement appropriate remediation efforts. This post outlines six important steps to follow in every internal investigation.
HIPAA breaches happen. So long as humans are involved in handling protected health information (PHI), there will be mistakes that result in a breach (and, of course, this does not include hacking incidents or bad actor breaches). For compliance purposes, the response to a breach is key. Providers that respond swiftly, implement corrective measures and timely notify affected patients and file a thorough breach report with the Department of Health and Human Services (DHHS) are far more likely to avoid scrutiny.
Early in the COVID-19 pandemic, Governor Ned Lamont expanded the use of telehealth for Medicaid-enrolled providers and in-network providers through various executive orders (G, DD and FF (collectively, the “Telehealth Executive Orders”)). That expansion included permitting the use of audio-only (telephone) delivery of telehealth services. On Friday, July 31, 2020, the Governor signed legislation, An Act Concerning Telehealth, that codified many of the provisions in the Telehealth Executive Orders through March 15, 2021.
Less than one week after its last announced settlement, the Office for Civil Rights announced its first seven-figure HIPAA settlement of 2020. A non-profit healthcare system in Rhode Island, Lifespan, agreed to pay $1,040,000 for alleged systemic HIPAA violations. A 2017 breach involving an unencrypted stolen laptop triggered the investigation. OCR found HIPAA Security Rule violations and the lack of a business associate agreement with its parent corporation, which reported the 2017 breach.
Today, the Office for Civil Rights (OCR) announced a $25,000 settlement with a small federally qualified health center (FQHC) for systemic HIPAA Security Rule violations. Over 9 years ago, the FQHC reported a disclosure of patient information to an unknown email account affecting 1,263 patients. This breach report prompted an investigation revealing a near complete failure to comply with the HIPAA Security Rule.
We learned early in life from the Three Little Pigs that a house made of straw or sticks, while much easier to build, lacks the safety and security of a brick house. This fable’s lesson applies to many scenarios including the recent rapid deployment of telehealth services. While a pandemic, not laziness, caused the hurried telehealth services implementation for many, that’s irrelevant to the big bad wolf (and there is always a big bad wolf). He will come and he will huff, and he will puff, and he will compromise the privacy of patient information in a system without adequate protections.
Below is a piece I put together with Dayle Duran, CIPP/US, a contributing DMC Law blog author, as a brief guide to key aspects of the CCPA. Of course, the CCPA is a complex set of rules and requirements, so this post is intended only to be a very basic and high-level overview of important […]
Today, the United States Supreme Court issued its decision in Barr v. American Association of Political Consultants, Inc. concluding that an exception to the Telephone Consumer Protection Act (TCPA) constitutes a content-based speech restriction and violates the First Amendment. But, instead of invalidating the entire statute, the Court only severed the offending provision.
In guidance issued today, OCR explained that, with a few limitations, healthcare providers may use patient information to contact recovered COVID-19 patients and provide information about donating blood and plasma.