Practical Application of HIPAA Risk Analysis

Why Should You Attend:

The webinar will discuss the HIPAA audit and enforcement regulations and processes, and how they apply to HIPAA covered entities and business associates. It will explain the recent changes that increased fines and created new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000. The course will explore what kind of issues and what kind of entities had the most problems, and show where entities need to improve their compliance the most, and also explore the typical risk issues that lead to breaches of health information and see how those issues may be a target for auditors in 2018.

The results of prior enforcement actions and HHS audits (and their penalties), especially those relating to risk analysis, will be discussed, including recent actions involving multi-million dollar fines and settlements. In addition, new trends in information security risks will be discussed so you can start to plan for the work you'll need to do to stay in compliance and keep patient information private and secure.

There are tools freely available that can help in the performance of a risk analysis, but a risk analysis takes more than tools, it takes an understanding of what to examine and how to consider what you find, to create a coherent analysis of the risks to your electronic PHI. This session will focus on how you can use the tools as part of an analysis process to give you actionable plans and documentation of considerations made in the process.

Areas Covered in the Webinar:

• What the HIPAA Security Rule requires
• What meaningful use Objective 15 requires
• What a good risk analysis is and isn’t
• Risk analysis tools and methods
• The policies you should have for security compliance
• Finding and filling any gaps in your policies and procedures
• How to perform risk assessment and analysis
• Planning the continuing management of your risks
• Planning your next reviews and your information security management process

Who Will Benefit:

This webinar will benefit professionals working in medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, billing services, etc.). The titles are:

• Compliance Director
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/Lawyer
• Office Manager
• Contracts Manager

Jim Sheldon-Dean
Principal and Director of Compliance Services, Lewis Creek Systems, LLC

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a variety of health care providers, businesses, universities, small and large hospitals, urban and rural mental health and social service agencies, health insurance plans, and health care business associates. He serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Electronic Data Interchange Privacy and Security Workgroup, currently serves on the WEDI Breach Notification sub-workgroup, and is a recipient of the 2011 WEDI Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at AHIMA national and regional conventions and WEDI national conferences, and before regional HFMA chapter meetings and state hospital associations.

Mr. Sheldon-Dean has nearly 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related websites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Mr. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master's degree from the Massachusetts Institute of Technology.

Topic Background:

Being in compliance with HIPAA involves not only ensuring you provide the appropriate patient rights and controls on your uses and disclosures, but also that you ensure you have the right policies, procedures, and documentation, and have performed the appropriate analysis of the risks to the confidentiality, integrity, and availability of electronic protected health information (PHI).

Using risk analysis can help you make defensible, documented decisions about your compliance in a variety of circumstances, for a variety of regulations. Risk analysis is the key to making your health information privacy and security regulatory compliance work more sensible as well as defensible.

HIPAA enforcement is on the increase and random audits of HIPAA compliance have begun. In addition, audits of meaningful use attestations are examining compliance with Objective 15, which calls for a HIPAA Security Rule risk analysis. Failures in any of these reviews or audits can lead to significant penalties and fines. Your HIPAA covered entity or business associate needs to have the right reviews and documentation right now.

Any organization subject to HIPAA needs to compare its information-handling practices to the requirements of HIPAA in order to identify gaps between current and required practices. HIPAA requires a risk analysis to determine security risks to electronic information and implementation of measures to reduce those risks and vulnerabilities to a reasonable and appropriate level. But what is that risk analysis, how do you conduct one, and what might the result look like? It is essential to perform an accurate and thorough entity-wide risk analysis to avoid incidents and penalties for violations of the rules.

The meaningful use requirements also require eligible hospitals and eligible professionals to conduct or review a HIPAA Security Rule risk assessment of the certified electronic health record (EHR) technology annually, and implement security updates and correct identified security deficiencies as part of its risk management process. And the policies reviewed, risk analysis performed, and mitigation actions taken must all be documented so that they can withstand the scrutiny of investigators from the US Department of Health and Human Services.

Compliance with HIPAA rules requires being able to make decisions about how to implement the rules in your own circumstances, and using a risk analysis approach can make that process more logical and better documented. The HIPAA Security Rule requires that all entities periodically evaluate the risks to the confidentiality, integrity, and availability of Protected Health Information, and the rules are backed up by new fines, and penalties, and a new enforcement effort. The changes to the rules create new challenges for HIPAA entities, and new risks for non-compliance and penalties.

Follow us :