Episode 406: Key Takeaways from the HIPAA Regulators Annual Reports

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we summarize what group practice owners should know about the Office of Civil Rights Annual Reports to Congress and explain how understanding them can inform risk management.

We discuss the compliance report from the Office of Civil Rights (OCR); how complaints filed were resolved; compliance reviews vs. audits; reframing the (very common) fear of HIPAA complaints; the unsecured PHI report from the OCR; risk management for avoiding large breaches; the importance of reporting breaches; and the primary sources of breaches and ways to minimize them.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

References

Annual Report to Congress on Breaches of Unsecured Protected Health Information

Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance

PCT Resources

Group Practice Care Premium

weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

+ assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

+ assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

PCT's Group Practice PCT Way HIPAA Compliance Manual & Materials -- comprehensive customizable HIPAA Security Policies & Procedure and materials templates specifically for mental health group practices. with a detailed step-by-step project plan and guided instructions for adopting & implementing efficiently **includes policy prohibition on use of BCC and CC; workforce forwarding emails from their practice email account to personal email account; data entry checking/not using autofill suggestions for recipients -- the P&P components that address the email gone awry situations we discussed in the podcast episode

Policies & Procedures include:

Customizable templates that address each of the HIPAA Security Rule Standards. Ready for plug-and-play real practice application.

Computing Devices and Electronic Media Technical Security Policy

Bring Your Own Device (BYOD) Policy

Communications Security Policy

Information Systems Secure Use Policy

Risk Management Policy

Contingency Planning Policy

Device and Document Transport and Storage Policy

Device and Document Disposal Policy

Security Training and Awareness Policy

Passwords and Other Digital Authentication Policy

Software and Hardware Selection Policy

Security Incident Response and Breach Notification Policy

Security Onboarding and Exit Policy

Sanction Policy Policy

Release of Information Security Policy

Remote Access Policy

Data Backup Policy

Facility/Office Access and Physical Security Policy

Facility Network Security Policy

Computing Device Acceptable Use Policy

Business Associate Policy

Access Log Review Policy

Forms & Logs include:

Workforce Security Policies Agreement

Security Incident Report

PHI Access Determination

Password Policy Compliance

BYOD Registration & Termination

Data Backup & Confirmation

Access Log Review

Key & Access Code Issue and Loss

Third-Party Service Vendors

Building Security Plan

Security Schedule

Equipment Security Check

Computing System Access Granting & Revocation

Training Completion

Mini Risk Analysis

Security Incident Response

Security Reminder

Practice Equipment Catalog

+ Workforce Security Manual & Leadership Security Manual -- the role-based practical application oriented distillation of the formal Policies & Procedures

+ 2 complimentary seats of the Security Officer Endorsement Training Program (1 for Security Officer; 1 for Deputy (or future Deputy) Security Officer.