HIPAA Changes in 2020 – Court Decisions, Regulations, and Enforcement

HIPAA Compliance has recently seen big changes in how the rules are enforced for individual access requests, long-overdue changes may be coming to regulations on Accounting of Disclosures of Protected Health Information (PHI), we can expect new rules regarding the HIPAA Notice of Privacy Practices and calling patients’ cell phones, and a little-used HIPAA right may become a hot topic if the Affordable Care Act is threatened.

And there have been calls for HIPAA expansions to cover new technologies and new uses of PHI. There is no shortage of critical topics for medical offices to respond to, to meet requirements and avoid penalties.

One potential impact is not a HIPAA change, but an increase in the demand for requests to exert rights to keep treatment secret from health plans, which could result from changes to the ACA.

The Health Insurance Portability and Accountability Act of 1996 has now been around for nearly a quarter century, and the regulations have evolved since the Privacy Rule first became enforceable in 2003.

There have been numerous enforcement settlements, there are new threats to the privacy and security of patient information, and still more changes in the rules are expected based on the HITECH Act and goals for greater patient access rights and integration of care services.

In addition, a recent Federal Court decision has changed the rules for providing access to patient information under the rules for indiudual access of PHI, and new guidance has been issued about the responsibilities of Business Associares for HIPAA compliance.

HIPAA Rules During the Coronavirus – COVID-19 – Outbreak

A widespread infectious disease outbreak like COVID-19 stresses the health care system.

HIPAA Rules regarding protected health information (PHI) are not suspended, but key provisions in the Privacy Rule manage the permitted and required uses and disclosures of PHI. And, if there is a Presidential Declaration of a Public Health Emergency, the Secretary of the U.S. Department of Health and Human Services can temporarily waive some HIPAA requirements.

The HIPAA Privacy Rule and OCR guidance clearly explain how Covered Entities and their Business Associates may collaborate and communicate with other Covered Entities and Public Health Authorities during the COVID-19 outbreak, and how to communicate with family, friends and others involved in the patient’s care.

Covered Entities and Business Associates can continue to serve their patients and wider communities with patient care, and protect themselves from HIPAA violations, and limited waivers if the President declares a Public Health Emergency.

Coordinate and collaborate with Public Health Authorities, and communicate with persons at risk for contracting the disease; in situations to prevent a serious and imminent threat; and with the media and others not involved in the patient’s care.

Learn more

 

 

Workplace Violence Plans, Policies & Procedures for Hospitals & Healthcare Facilities

 

How safe is your healthcare facility from workplace violence? Workplace violence against healthcare workers can be significantly reduced with a comprehensive violence prevention program.

Violence against health workers should never be considered as being acceptable or “just part of the job.” Not only is there a negative impact on the psychological and physical well being of health-care staff, but also affects their job motivation. The consequence of violence impacts the quality of care and may lead to major financial losses to a healthcare organization.These may include but are not limited to:

• Sanctions and fines from OSHA and other government agencies
• Additional difficulties maintaining credentials for the Joint Commission and other credentialing groups
• Increased difficulties in hiring and keeping good employees
• Higher insurance premiums
• Lawsuits by employees and other victims
• Lower employee morale
• Disruption in operations for extended periods of time for crime scene clean up and investigation

Many factors place healthcare workers above average risk for violence; they care for people with histories of violent behavior, who may be under the influence of drugs, or who may be delirious from medications, narcotics, or a medical condition such as dementia.

Learn more  on Effective Workplace Violence Program

The CMS Conditions of Participation for Discharge Planning: New Rules for 2020

 

Discharge planning has become more than just the movement of the patient out of the hospital. It is a “process” that starts at the point of admission and follows the patient beyond discharge.

The Centers for Medicare and Medicaid Services (CMS) have recently added more “teeth” to the process as it is outlined in the Conditions of Participation for Discharge Planning. Discharge planning is no longer a destination but a process that starts before the patient is admitted to the hospital and continues after they are discharged.

The Conditions of Participation (CoP) are the legal and regulatory requirements that hospitals and case management professionals must follow in order to be compliant in their role as discharge planners. It is important that all case management professionals, including both nurses and social workers, are familiar with the changes to the Conditions of Participation for Discharge Planning that were announced in October 2019 for Federal Fiscal Year 2020.

From here we will then discuss these most recent changes from the Medicare program and how they will impact the roles of the RN case manager and the social worker. Learn how to be sure that your processes address the complexities of the new healthcare environment and that your role as a case manager or social worker is designed and staffed to meet the changes ahead!

Are you compliant with these rules? The proposed rules that are still under consideration will be reviewed as they may have a profound effect on how case management departments organize their work. It will also affect the workloads of RN case managers and social workers. Patients in ambulatory settings such as out-patient surgery, outpatient procedures and emergency departments may need to be assessed for the purpose of creating a discharge plan. Family caregivers and physicians will be expected to be much more involved than they have in the past.

 

Learn about the rationale for telemedicine

Under the Social Security Act, reimbursement for telehealth under Medicare has been subject to stringent restrictions

Only patients in certain identified practice settings in rural, physician-underserved areas were eligible. Care into the patient’s home was not covered.

Only certain providers were eligible. With rare exceptions (demonstration sites in Hawaii and Alaska), only real-time, audio-video communications were eligible. And, only a rather modest number of CPT codes were eligible. These provisions are still good law. In 2015, however, the first modification of these rules appeared, allowing reimbursement, still subject to extensive restrictions, for chronic care management. Because a co-pay had to be charged, patient consent was required, for services that the patient had previously received at no charge.

Plenty of other limitations were imposed as well. For example, the patient has to have access to care management services 24/7, a comprehensive care plan has to be developed, only 1 practitioner/month is eligible for reimbursement, and providers have to document that clinical staff spent 20 minutes of non-in-person time in a given month.

For the first time, however, distance care services provided by staffers, as opposed to qualified HCPs, and delivered by email or phone, for example, as opposed to by videoconferencing, could satisfy Medicare’s requirements for reimbursement. In 2018, CMS developed the highly creative concept of communication technology-based services (“CBTS”), distinguished from Telemedicine on the theory that these are not simply substitutes for in-person care, but are inherently electronic in nature and thus outside the scope of the telemedicine reimbursement rules of the Social Security Act.

Consent and co-pay provisions attend these services also, as well as somewhat onerous “related visit rules” that to some degree limit the value of this new opportunity. Nevertheless, it is now possible to be reimbursed for remote evaluation of patient images and videos; for so-called “virtual check-ins,” designed to determine whether an in-person evaluation is necessary; and for interprofessional consultations. In addition, reimbursement for remote patient monitoring (“RPM”) is both more generous and easier to obtain under CBTS reasoning than it had been before this innovation. In particular, originating site and geographic restrictions on RPM reimbursement are now things of the past. By no means are these the only changes of note.

The Bipartisan Budget Act of 2018 and the SUPPORT Act have also expanded reimbursement opportunities as well. Under the BBA, Medicare Advantage plans may offer “additional telehealth benefits” as part of “basic benefits” not otherwise available in Original Medicare under Part C, and may “treat them as basic benefits for purposes of bid submission and payment by CMS.” Renal dialysis facilities and a beneficiary’s home may now serve as originating sites for dialysis and monthly ESRD-related clinical assessments.

Coverage is now available for acute stroke telehealth services in any hospital, CAH, mobile stroke unit, or any other site determined appropriate by the Secretary, in addition to the current telehealth originating sites. Under the SUPPORT Act, CMS adjusted the telehealth reimbursement rules for treating individuals anywhere in US with substance use disorder or a co-occurring mental health disorder.

The Agriculture Improvement Act of 2018 provides funding for both telehealth grants and for broadband expansion. In short, the reimbursement landscape has changed substantially, and these developments augur well for potential growth in telemedicine and all the benefits it will bring to both patients and providers.
Patients and employers are demanding distance care because it is convenient; it expands access to care, including specialty services often hard to obtain in many areas; it can save costs; and it improves patient satisfaction. Some 75% of all US hospitals now offer some form of telehealth service. Growing numbers of physicians are doing so as well, especially in such specialties as radiology, psychiatry, cardiology, and emergency medicine.

Knowing how to offer such care, and how to get paid for it, is no longer merely desirable; it has become essential. Unfortunately, however, reimbursement has long been a problem with this sort of care, especially for Medicare beneficiaries.

HIPAA, Consents, and 42 CFR Part 2 – Tracking the Release of Information Under Conflicting Rules

While HIPAA rules apply to all Protected Health Information, the rules under 42 CFR Part 2 place special limitations on substance use disorder-related information. HIPAA has controls on the release of health information, but once it’s released under HIPAA, the information is allowed to be used according to the regulations and obligations of the receiving party.

With information under Part 2, the obligations to protect the information travel with the information, placing recipients under obligations to provide further protection under Part 2 rules.

For decades, the rules under 42 CFR Part 2 have required that each and every release of information have a consent in place, but new rules allow release to “others involved in my care,” including re-release of information without a new consent.

While this new option promises to simplify the release and re-release of information, implementation requires that it be possible to report to the individual a list of parties to whom the information has been released. The accounting for these disclosures is similar to the HIPAA accounting of disclosures in principle, but applies to treatment disclosures all the way down the chain of releases.

HIPAA allows a number of disclosures, for treatment, payment, and healthcare operations purposes, without consent from the individual being treated.

SAMHSA rules, on the other hand, require consent for every disclosure or re-disclosure, and if the proper consents aren’t obtained, the provider can be in violation of the rules and subject to penalties.

 

MIPS Risk Assessment – What, How, Why?

Whatever the reason: MIPS or Meaningful Use the risk assessment is a foundational tripwire to you getting your reimbursement check. This risk assessment is a HIPAA risk assessment and is required every year, just like taxes.

Skip it and, 5 years later, you can get that request for more information or pay back the money they gave you. How much was that check? $5000? Avoid having to pay back all of that money by doing your risk assessment each year.

Each year a HIPAA risk assessment is required by your practice. It doesn’t matter if you are not seeking MIPS or Meaningful Use money the HIPAA regulations require an annual risk assessment anyway.

MIPS and Meaningful Use simply tie your reimbursement money to accomplishing this already required risk assessment, as they are well aware you will probably ignore this requirement otherwise.

The risk assessment should not be “pencil whipped”; attorneys are licking their chops for a chance to come after medical offices that don’t have their “HIPAA House” in order.

What may start as an innocent mistake can quickly escalate to a huge settlement once an attorney gets involved and begins digging into the level of HIPAA compliance at your office.

The other threat is the CMS hired guns who look back over many years seeking areas where you may have dropped the HIPAA ball, all in an attempt to claw back money that has been paid to you.

The risk assessment may feel like a big burden, but done correctly it is not a burden but a solid guideline to getting your practice to function in a more effective way.

 

HIPAA Rules in Patient Communication

With the new HIPAA random audit program now getting under way, and increases in enforcement actions following breaches, now is the time to ensure your organization is in compliance with the regulations and meeting the e-mail and texting communication needs and desires of its providers and patients.

You need the proper privacy protections for health information, and the necessary documented policies and procedures, as well as documentation of any actions taken pursuant to your policies and procedures.

Your policies and procedures will probably need major revisions to maintain compliance in areas such as individual access of records, accounting of disclosures, and breach notification. And, of course, you will need to train your staff in all the new policies and procedures.

 

 

• E-mail has long been a staple of people’s lives, but as we move into the new digital age, it seems everyone is moving to a new smart phone and wants to use it in all the incredible ways it can be used for health care purposes, including the use of e-mail and texting. Doctors are finding that texting is far more flexible, convenient, and effective than paging, and patients want to be able to use short message texting for handling of appointments, updates, and the like, where even e-mail or the telephone would seem inconvenient
• In order to integrate the use of e-mail and texting into patient communications, it is essential to perform the proper steps in an information security compliance process to evaluate and address the risks of using the technology.

 

• But the process must also include consideration of various patient access requirements in the HIPAA Privacy Rule. There are new requirements to provide patients electronic access of electronically held PHI which raise new questions of how that access will be provided and how the information will be protected during and after access. And there has long been a HIPAA requirement for covered entities to do their best to meet the requests of their patients for particular modes of communication, and using e-mail or texting is no exception
• The stakes are high – any improper exposure of PHI may result in an official breach that must be reported to the individual and to the US Department of Health and Human Services, at great cost and with the potential to bring fines and other enforcement actions if a violation of rules is involved. Likewise, complaints by a patient if they are not afforded the access they desire can bring about HHS inquiries and enforcement actions, so it is essential to find the right balance of access and control
• HHS compliance audit activity and enforcement penalties are both increased, especially in instances of willful neglect of compliance, if, for instance, your organization hasn’t adopted the complete suite of policies and procedures needed for compliance, or hasn’t adequately considered the impact of e-mail or texting on your compliance
• Smart phones and the Internet have changed the way people communicate and introduced new risks into the process. Now patients want to be able to communicate with their health care providers, and providers want to communicate with each other using these devices, and to be able to access, send, and receive health information. But communications using mobile devices has some inherent privacy and security risks that may put providers out of compliance
• E-mail and texting present new challenges to health care providers, as there are simultaneously new requirements to share information with patients, and a new enforcement effort to ensure the privacy and security of Protected Health Information (PHI). Meeting both challenges requires careful consideration of all the regulations and technologies, as well as patient preferences and work flow
• Most HIPAA covered entities now face difficult choices between compliance and ease of communication. Most organizations haven’t updated their information security risk analysis or policies and procedures and run the risk of breaches, rule violations, and fines in the event of mishandling of PHI using these new technologies

Legal Issues Raised by Deploying AI in Healthcare

The unthinkable and unimaginable changes that Artificial Intelligence (AI) is bringing into the field of healthcare is unprecedented in terms of both scale and extent. There is no denying that AI will completely alter the way healthcare is going to work a few years from now.

While this may seem like sweet music to the ears of patients and others in the healthcare sector, there is one nagging issue it brings in its wake: law. The legal issues raised by deploying AI in healthcare are enormous and extremely pertinent for our times, because areas of AI, such as Machine Learning, throw up points such as:

• Who will pay for healthcare services dependent on AI, and who will be entitled to such payments?
• With whom will the ownership of the massive bank of data that AI learns from and bases decisions on lie? What are the ways in which the rights of these owners are protected?
• Which governmental agencies will have a say when it comes to regulating the use of AI in healthcare, and on what basis will they rule, since precedent, a foundational requirement of law, is missing? How will federalism issues be addressed?
• Who will own the AI system’s intellectual property, and how will that owner’s rights be protected?
• When a machine acquires learning in the manner it was programmed to, will be considered as a creator, or as an inventor? Can these machines be granted intellectual property rights over its own creations, and if yes, how will those be protected, and who will benefit from them? If machines cannot be given these rights, who will be?
• How does AI impact competition, and how will antitrust authorities be implicated?
• What are the implications if a patient is injured, or even killed, while getting AI-influenced or AI-controlled diagnosis or treatment?
• What defenses, if any, will be available to defendants?
• Could AI aggravate health disparities, or itself be a source of bias, and if so, what if anything should or can be done about it?
• Can AI be deployed in those jurisdictions that prohibit the corporate practice of medicine? If so, what are the implications for patients in those jurisdictions?

Joseph P. McMenamin, a physician-attorney with McMenamin Law Offices in Richmond, Virginia, will seek to set all these doubts at rest at a webinar that is being organized by MentorHealth, a leading provider of professional training for all the areas of healthcare, on April 20.

Please register for this invaluable learning by visiting Mentorhealth .

—————————————————————————————————————–

The core learning this webinar will impart will equip its participants to know what to look for, to understand what developments in AI mean. The expert will give them the understanding needed for taking action to reduce their risk, which could improve their future. Participants will get an understanding of the implications AI has on competition law, and the ways in which antitrust authorities be implicated.

He will cover the following areas at this session:

• AI’s healthcare capabilities
• AI tech 101
• Research
• Practicing medicine
• Corporate practice of medicine
• Negligence
• Product liability
• Privacy
• Reimbursement
• Regulation
• Intellectual property

——————————————————————————————————–

About the expert:

Joseph P. McMenamin’s practice concentrates exclusively on the law of health care, with special emphasis on digital health. With respect to the legal issues pertinent to this form of care, he has advised providers, hospital associations, consultancies, private equity firms, insurers, telecoms and several organizations facilitating telemedical services.

He presently serves as general counsel to the Virginia Telemedicine Network and as a member of the Legal Resource Team of CTeL, the Center for Telemedicine and eHealth Law. An associate professor of Legal Medicine at VCU, he is board-certified in Legal Medicine and a Fellow of the College of Legal Medicine. He lectures and publishes widely on topics pertinent to his practice.

HIPAA Boot Camp

HIPAA in its original form is heavy text and filled with legalese. This is fine from the lawmakers’ perspective, but as a HIPAA-administered entity, do you understand its many complicated parlance? Many Covered Entities and Business Associates are often confused by even such basic terminologies as penalties. How many are aware that there are civil and criminal penalties even for the rank and file staff member? How many are clear about what to do and not to do with Protected Health Information?

A webinar being organized on April 1 by MentorHealth, a leading provider of professional training for all the areas of healthcare, will seek to simplify the understanding of HIPAA in regard to areas such as these. MentorHealth brings Senior healthcare IT professional, Brian Tuttle, as the expert at this webinar. To gain valuable insights into these and related crucial areas of HIPAA, please register for this webinar by visiting Mentorhealth.

—————————————————————————————————————

Knowledge of the new changes going on at Health and Human Services (HHS) about the aspects of HIPAA enforcement, as it pertains to portable devices, texting, and emailing of PHI, is very vital for both Covered Entities and Business Associates. Lack of this knowledge can expose them to audit risk. They could also get sued by individuals who have had their PHI wrongfully discloses due to bad IT practices. Most of this is due to lack of clarity about the way HIPAA works. There is a lot of misinformation about HIPAA doing the rounds on the worldwide web.

The aim of this webinar is to instill clarity about the various aspects of HIPAA, so that Covered Entities and Business Associates are aware of the myths and realities of this law, and don’t get carried away by false information about the law.

Brian will use multiple real life scenarios and explain what could happen in various situations and conditions when this law is not properly understood by the typical staff member. He will also use the example of multiple court cases that he has been associated with during the course of his career, where a staff member of a hospital or clinic has been sued or even imprisoned.

The examples will be drawn from the real life audits conducted by the Federal government, of which Brian has appeared for both sides. This gives him the insight to explain to participants what actions of theirs attract the highest risks for being fined, some of which may appear outright incredulous.

Another very important area Brian is going to cover is the highest risk factors among CE’s and BA’s for being sued for wrongful disclosures of PHI and the manner in which patients are now using State laws to sue for wrongful disclosures. He will clear the various doubts that many people could have after reading online about HIPAA, especially as it relates to encryption and IT.

This webinar will cover these areas:

• Updates for 2020
• Do’s and Don’ts
• Portable devices
• New laws relating to patient legal remedies
• Emailing of PHI
• Texting of PHI
• Real life scenarios
• HIPAA and legal cases

———————————————————————————————————–

About the expert: Brian Tuttle is a Certified Professional in Health IT (CPHIT), Certified HIPAA Professional (CHP), and Certified Business Resilience Auditor (CBRA), who brings over 15 years’ experience in Health IT and Compliance Consulting. He carries with them the experience of having carried over 1000 risk assessments as well as having directly dealt with the Office of Civil Rights HIPAA auditors.

He has served in multiple litigated court cases serving as an expert witness offering inputs related to best practices and requirements for securing and providing patient access to Protected Health Information. Brian has also worked directly with the Office of Civil Rights (OCR) both in defending Covered Entities and Business Associates as well as being asked by the Federal government to audit covered entities and business associates on behalf of the OCR.

Burning Up While Burning Out – Compassion Fatigue Awareness & Burnout Prevention for Practitioners

All the joy and love of working in their professions notwithstanding, healthcare professionals have to undergo enormous stress while discharging their daily work. The unending pain and suffering that patients undergo, to which healthcare professionals are exposed day in and day out, can ruffle the calmest of minds. Witnessing this is an inevitable byproduct of this highly respected and noble profession.

In addition, healthcare professionals that work in an economy such as the US, where the healthcare sector is totally privatized and is hyper competitive, face colossal stress from another source: their organization. Healthcare practitioners are expected to be completely professional at their work and meet their organization’s ROI expectations.

Juggling with these two high pressure areas can take a heavy toll on healthcare practitioners. It can severely dent their ability to deal with pressure from such strong areas.

It is to help healthcare professionals overcome the pressures of their work from these perspectives that MentorHealth, a leading provider of professional training for the areas of healthcare, is organizing a three-hour webinar on April 10 on the topic, “Burning Up While Burning Out – Compassion Fatigue Awareness & Burnout Prevention for Practitioners”.

Founder of Smart Practice Central, a healthcare business-building platform, Howard Baumgarten, will be the expert at this marathon session. Kindly join in for this valuable learning by registering for this course at Mentorhealth.

—————————————————————————————————————–

One of the serious fallouts of the highly competitive healthcare industry is the tremendous pressure it puts on healthcare organizations to improve the quality of healthcare. Most organizations put severe pressures on these professionals to improve their super-thin margins and augment revenues. It is only through compassionate and complete care and prompt implementation of the processes that they can think of achieving this. Getting a thorough understanding of their roles and responsibilities and the challenges attendant with them is the first step for healthcare professionals to learn to face burnout. This can be acquired through training.

The commonly known factor among healthcare practitioners, compassion fatigue, should constitute a vital part of this learning. This course will familiarize its participants with knowledge of this aspect of their work. The expert will show how to recognize the signs and symptoms of fatigue and weakness and suggest ways to overcome them. Participants will also get an understanding of what kind of work-life balance a stressed healthcare worker can bring in.

A few strategies and techniques, which will arm them with the ability for managing and preventing conflicts, will be imparted at this course. Howard will dwell at length on a core technique, namely mindfulness training. He will explain this, a primary behavior with which the frequency of fatigue and prevent burnout can be reduced, in detail. An important benefit that participants will get from attending this webinar is how to tailor this learning to their own management and prevention plan.

These are the areas this webinar will cover over the three hours of its duration:

• Definition of Burnout
• Causes of Burnout
• Signs & Symptoms of Burnout
  • Physical Signs
  • Mental/Emotional Signs
  • Behavioral Signs
• What is Compassion Fatigue
• Causes of Compassion Fatigue
• General Strategies & Tools
  • Mentorship
  • Finding Your ZENS
  • Mind/Body
• Invent & Burn Up

—————————————————————————————————————–

About the speaker: A Licensed Professional Counselor, author, consultant, speaker, wellness and small business-training expert, Howard has lectured throughout the country on the integration of mental health and business, focusing on practice development, working within managed care systems and the impacts of the Affordable Care Act on mental healthcare.

He is the author of Private Practice Essentials: Business Tools for Mental Health Professionals, a guide to starting and successfully managing mental health practice. In 2003, he developed and implemented the first practice building business curriculum in a graduate level-counseling program in the country at the University of Colorado, where he taught this curriculum for twelve years.

 

 

Contingency and Disaster Recovery Plan – Not What you Think

A disaster can be what it is for any business-disastrous. However, for a HIPAA-administered Covered Entity or Business Associate, it can be catastrophic. It can wreak complete and irreparable loss to the most vital documents in their possession: their PHI, or any such others. This makes the putting in place of both a Contingency Operations Plan and a Disaster Recovery Plan an absolute must for a CE and its BA. This is also a strict HIPAA requirement. And, for information, HIPAA does not consider a cloud-based EHR a Disaster Recovery Plan or a part of it.

This makes it absolutely necessary for a CE and a BA to have total knowledge of precisely what to do and how to organize things when a natural disaster hits them. This natural disaster can be in the form of a hurricane, flood, tornado, fire, or simply any natural event that affects their practice. The contingency plan should be such that it should enable them to rapidly resume their practice and put their revenue-generating avenues back on track at the earliest.

Want to understand how to put such a contingency plan in place? This is the learning you will gain from a webinar that MentorHealth, a leading provider of professional training for the areas of healthcare, is organizing on March 24.

John Brewer, Founder of Med Tech USA, LLC and a former Air Force Computer Security Officer, will be the expert at this webinar, and he will explain the ways by which practices can put a contingency plan in place that effectively safeguards PHIs in the event of natural disasters.

To enroll for this very useful learning, please visit MentorHealth

—————————————————————————————————————–

A Contingency plan goes hand in hand with a Disaster plan. This being the case, the expert at this webinar will show how to understand the areas in which they converge and overlap. This understanding will go a long way in working out a comprehensive plan that includes the core parts of both these.

Practices can show practicality by deciding what will be the first three things they will be doing, the next five things they will be doing, and chalking up many other possibilities and options that need to be exercised in case of a disaster. John will explain all these aspects at this webinar.

HIPAA security officers, Practice Managers and Business Associates, are the personnel who will benefit primarily from this webinar, which will cover the following areas:

• The HIPAA Requirement
• Data Backup Plan (for those not on the cloud)
• Data Access Plan (for those on the cloud)
• Your Contingency Plan Location
• Your Contingency Team
• Alternate Practice Sites
• The Immediate Utilities (phones/internet)
• Your (old fashioned) Paper Process
• Who do you contact at your EHR?
• What if you can’t contact your IT person
• Patient Contact Plan
• Equipment Replacement.

—————————————————————————————————————–

About the speaker: John’s unique background in technology and experience in dealing with government regulations gives him the edge in HIPAA implementation and training. His organization takes the complicated volumes of HIPAA regulations and breaks them down into simple to understand nuggets.

 

 

 

 

 

 

HIPAA Texting and Emailing: Do’s and Don’ts

One can think of the HIPAA policy on texting as an evolving body of work. Why this is so is that it is fluid, because of which changes are made to it every now and then. Some of the areas The Department of Health and Human Services (HHS) keeps implementing changes into HIPAA policy include portable devices, texting, and emailing of Protected Health Information (PHI). Quite naturally, these changes have a bearing on the enforcement of HIPAA for both Covered Entities and Business Associates.

Although absolutely necessary, getting a full understanding of the intricacies of these changes and implementing them in a manner that enables compliance with the requirements set out by HIPAA can be arduous for many Covered Entities and Business Associates. Whenever clarity on the crucial areas of this law is lacking, one sees gaps in implementation, which can invite sharp penalties.

All of the confusing aspects of HIPAA implementation will be cleared at a webinar that is being organized on March 19 by MentorHealth, a leading provider of professional training for all the areas of healthcare. Senior healthcare IT professional, Brian Tuttle, will be the expert at this webinar.  Want to gain perspicacity on how to implement a HIPAA-compliant texting and emailing system? Then, kindly join in for this learning by visiting mentorhealth .

—————————————————————————————————————–

Brian will primarily help the participants differentiate between myth and reality of this at-times loosely worded law. He will detail the workings of a practice or business information technology and how these relate to the HIPAA Security Rule, in particular portable devices.

HIPAA and texting in healthcare, encryption, medical messaging, voice data, personal devices, and risk factors are some of the areas that Brian will explain and clarify. Lack of knowledge or proper perspective of these areas will lead to BA’s and CE’s inviting hefty HIPAA penalties.

Brian will show participants how they can limit their risks. He will explain what proactive steps they should take and what best practices they should implement for doing this. This is the basis to helping them understand the ways in which patients are now able to get cash remedies for wrongful disclosures of PHI.

Other core areas that have given way to misunderstanding and dispute, namely HIPAA texting and emailing, will also be explained. He will highlight the various confusions that CE’s and BA’s could have about transmission of PHI.

The bad IT practices from CE’s and BA’s that invite audit risks, one of the primary reasons for being sued for wrongful disclosure of their PHI, will be listed.

Brian Tuttle will cover these areas at this webinar:

• Emailing of PHI
• Texting of PHI
• Updates for 2020
• BYOD
• Portable Devices
• Doctors and Texting
• Practical Solutions
• Business Associates and the increased burden
• Federal Audit Process

This webinar is aimed at the benefit of personnel who closely work with HIPAA, such as Practice Managers, any Business Associates who work with medical practices or hospitals (i.e. billing companies, transcription companies, IT Companies, answering services, home health, coders, attorneys, etc.), and MD’s and other medical professionals.

 

———————————————————————————————————–

About the expert: Brian Tuttle is a Certified Professional in Health IT (CPHIT), Certified HIPAA Professional (CHP), and Certified Business Resilience Auditor (CBRA), who brings over 15 years’ experience in Health IT and Compliance Consulting. He carries with them the experience of having carried over 1000 risk assessments as well as having directly dealt with the Office of Civil Rights HIPAA auditors.

He has served in multiple litigated court cases serving as an expert witness offering inputs related to best practices and requirements for securing and providing patient access to Protected Health Information. Brian has also worked directly with the Office of Civil Rights (OCR) both in defending Covered Entities and Business Associates as well as being asked by the Federal government to audit covered entities and business associates on behalf of the OCR.

 

HIPAA Training for the IT Manager

One of the various confusions that abound HIPAA is what a HIPAA-Covered Entity or its Business Associate can or cannot do vis-à-vis technological tools. Although a lot of information about HIPAA is available online, it is not really helpful, because much of it is confusing, all the more when it comes to ambiguous areas such as encryption and IT.

There is a glut of information available online, but not much of it is useful. It is imperative for Covered Entities and Business Associates to realize the importance of understanding the new changes that the Health and Human Services (HHS) is bringing in relation to enforcement of HIPAA for both Covered Entities and Business Associates. This is all the truer and more relevant in areas such as portable devices, texting, and emailing of PHI.

Lack of proper understanding can make them vulnerable to enforcement actions from the HHS, which can run into business-changing figures, all of which can be avoided with the right grasp of the nuances of HIPAA by the IT managers in the HIPAA-governed entity.

It is to clear the many confusions of the sections of HIPAA relating to technology that MentorHealth, a leading provider of professional training for all the areas of healthcare, is organizing a webinar on March 27.

At this webinar, Brian Tuttle, a very senior health IT professional, will be the expert. Please log on to Mentorhealth to register for this valuable learning.

—————————————————————————————————————

The main objective of this webinar is to offer a proper understanding of the roles and responsibilities of a HIPAA Compliance Officer. The expert will show how to put a thorough HIPAA compliance program in place. The new laws, funding, and enforcement have increased the risk for both Covered Entities and Business Associates. This year is expected to build on the previous successive ones where records were set for enforcements and fines.

Brian will explain how IT managers and HIPAA Security Officers should be prepared, should the audits occur. He will also delve into the major changes under the Omnibus Rule and any other applicable updates for this year. Texting, email, encryption, medical messaging, voice data and risk factors as they relate to IT are some of the areas he will approach.

The main purpose of this session is to educate the participants about the myths and the realities of HIPAA. This is all the more important in the current scenario where a lot of misleading information regarding the do’s and don’ts with HIPAA keep circulating all over the www. The expert will clarify what compliance officers should do to best implement their HIPAA program. Over the course of the ninety minutes of this webinar, Brian will cover the following topics:

• Updates for 2019
• Requirements of HIPAA Security Officers and IT Managers
• New definition of what constitutes protected health information
• Real life litigated cases
• BYOD
• Portable devices
• Business associates and the increased burden
• Emailing of PHI
• Texting of PHI
• Federal Audit Process
• HIPAA and suing – how this works
• Risk Assessment
• Ransomware and how to avoid
• What to do when a breach occurs
• Best resources

————————————————————————————————————

About the expert: Brain Tuttle brings over 18 years’ experience in Health IT and Compliance Consulting. He serves as compliance consultant and has conducted onsite and remote risk assessments for over 1000 medical practices, hospitals, health departments, insurance plans, and business associates throughout the United States.

 

Patient Communications, E-mail, and Texting – How to Meet Patient Requests for Information and Stay Within the HIPAA Rules

As mobile phones witness a spurt in their growth, they are fast becoming the preferred mode of communication in the healthcare sector. If flexibility, convenience, and effectiveness in texting vis-à-vis emailing or paging are some of the reasons for which physicians prefer them; they are a favorite among patients too. The latter prefer the short message texting feature in mobile phones for handling vital aspects of their health updates such as appointments, updates, and related services over e-mail or the telephone.

Even as mobile phones are taking centerstage in distributing information in the healthcare sector, it is very important for those in its ambit to know how HIPAA governs this aspect. Random audits are the mechanism by which HIPAA enforces its rules. Through these audits, HIPAA enforces actions when it discovers breaches in its rules concerning the use of email and texting for patient communication.

The penalties for noncompliance with HIPAA requirements are very steep. The only way by which HIPAA-regulated healthcare organizations that use email and texting for disseminating patient communications can avoid being penalized is by understanding the measures that they should put in place to ensure compliance with HIPAA requirements.

In addition to having a grasp of the appropriate privacy protections for health information and possessing the knowledge of what documented policies and procedures are necessary for healthcare providers, knowing what documentation they need for any actions that follow from their own policies and procedures is also vital.

This requires HIPAA-regulated healthcare organizations to put a comprehensive information security compliance process in place. Such an information security process rests on the cornerstone of a compliant patient and email texting system into which the principles of risk assessment and risk management are built.

At a webinar that it is organizing on March 20, MentorHealth, a leading provider of professional training for the areas of healthcare, will show the ways by which a healthcare organization can implement such an information security compliance process.

The expert at this webinar is Jim Sheldon-Dean, founder and director of compliance services at Lewis Creek Systems, LLC. Kindly visit Mentorhealth to enroll for this valuable learning.

—————————————————————————————————————–

The expert at this session will explain the methods of working and the elements of the information security compliance process. This will enable the participants to determine the ways by which they can integrate e-mail and texting into their organization in a compliant way. They will gain a complete grasp of the ways by which to use an information security management process to evaluate risks and make decisions about how best to protect PHI and meet patient needs and desires in a manner that also addresses the various patient access requirements in the HIPAA Privacy Rule. This will better equip them with how to avoid the hefty penalties that result from HIPAA violations.

Jim will cover these areas at this session:

• Find out the ways that patients want to use their e-mail and texting to communicate with providers, and the ways providers want to use e-mail and texting to enable better patient care
• Learn what are the risks of using e-mail and texting, what can go wrong, and what can result when it does
• Find out about HIPAA requirements for access and patient preferences, as well as the requirements to protect PHI
• Learn how to use an information security management process to evaluate risks and make decisions about how best to protect PHI and meet patient needs and desires
• Find out what policies and procedures you should have in place for dealing with e-mail and texting, as well as any new technology
• Learn about the training and education that must take place to ensure your staff uses e-mail and texting properly and does not risk exposure of PHI
• Find out the steps that must be followed in the event of a breach of PHI
• Learn about how the HIPAA audit and enforcement activities are now being increased and what you need to do to survive a HIPAA audit.

———————————————————————————————————–

About the speaker:

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm he founded in 1982. His firm has been providing information privacy and security regulatory compliance services to a wide variety of healthcare entities.

Jim Sheldon-Dean has more than 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of healthcare related websites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems.

In addition to serving on the HIMSS Information Systems Security Workgroup and co-chairing the Workgroup for Electronic Data Interchange Privacy and Security Workgroup; Sheldon is a recipient of the WEDI 2011 Award of Merit.

 

 

 

Burning up while Burning out – Compassion Fatigue Awareness & Burnout Prevention for Practitioners

Healthcare professionals endure enormous stress in the course of their daily work. Being constant witness to pain and suffering is surely the most serious downside of this highly respected profession. Apart from having to see these as part of their routine, healthcare professionals are under pressure from another quarter: that of being professional at their work to the extent that they fulfill the organization’s ROI expectations.

Having to balance the pain of having to see suffering continuously on the one hand and having to carry out their work professionally can result in enormous stress and can heavily impact the healthcare professional’s ability to deal with pressure.

But there is a way out. Healthcare professionals can learn the ways of doing this by joining in for a valuable learning session that is being organized on March 19 by MentorHealth, a leading provider of professional training for the areas of healthcare.

Imparting this profound knowledge is Howard Baumgarten, the Founder of Smart Practice Central, a healthcare business-building platform. Want to understand the ways by which healthcare professionals can overcome burning out at work? Please enroll for this session by visiting Mentorhealth.

—————————————————————————————————————–

Serious competition in the healthcare industry has put tremendous pressure on healthcare organizations to improve the quality of healthcare and raise wafer-thin margins and raise revenues. The only real way by which to do this is through offering complete care, prompt implementation of the processes, and utterly complete professionalism. It is necessary for healthcare professionals to first get a full understanding of their roles and responsibilities and the challenges attendant with them for them to learn to face burnout. This requires a degree of training.

This training should include what is called compassion fatigue. The ways of dealing with it should be integral to this training. This course will give its participants an understanding of this aspect of healthcare professionals’ work. It will show how to recognize the signs and symptoms of fatigue and weakness and the ways by which they can be overcome. The expert will show how a stressed healthcare worker can bring in work-life balance.

He will impart a few strategies and techniques which will arm them with the ability for managing and preventing conflicts. One such technique is mindfulness training, a primary behavior that helps to reduce the frequency of fatigue and prevent burnout. One of the key takeaways of this webinar is an understanding of how the participants can customize their own management and prevention plan.

At this webinar, the expert will cover these areas:

• Definition of Burnout
• Causes of Burnout
• Signs & Symptoms of Burnout
  • Physical Signs
  • Mental/Emotional Signs
  • Behavioral Signs
• What is Compassion Fatigue
• Causes of Compassion Fatigue
• General Strategies & Tools
  • Mentorship
  • Finding Your ZENS
  • Mind/Body
• Invent & Burn Up

—————————————————————————————————————–

About the speaker: A Licensed Professional Counselor, author, consultant, speaker, wellness and small business-training expert, Howard has lectured throughout the country on the integration of mental health and business, focusing on practice development, working within managed care systems and the impacts of the Affordable Care Act on mental healthcare.

He is the author of Private Practice Essentials: Business Tools for Mental Health Professionals, a guide to starting and successfully managing mental health practice. In 2003, he developed and implemented the first practice building business curriculum in a graduate level-counseling program in the country at the University of Colorado, where he taught this curriculum for twelve years.

 

Documentation protocols to protect clients and practitioners, and prevent litigation and licensing board complaints

The spurt in the growth of automation technologies in the recent past has brought down the need for documentation, but is yet to eliminate it. In the area of healthcare, documentation continues to be a challenge. While the whole of this sector faces this challenge, this issue is all the more pronounced in one of the sections of the healthcare industry: behavioral health.

The operational and the ethical aspects of behavioral health that pose problems for professionals in the area are the prime reason for this situation. These are some of the questions that behavioral health professionals are most commonly confronted with:

• When is it appropriate to be vague in a clinical note in order to protect clients?
• Should parents of minor clients have a right to access clinicians’ records?
• How should practitioners respond to subpoenas that demand disclosure of records?
• Under what circumstances should clients have access to their own records?

Addressing these issues calls for the exercise of acute professional judgment, as well as putting in place a system of proper and systematic documentation. MentorHealth, a leading provider of professional training for all the areas of healthcare, will organize a webinar on March 25, at which all these issues will be clarified and placed in the right perspective.

The expert at this webinar is Frederic Reamer, professor in the graduate program, School of Social Work, Rhode Island College. Please visit Mentorhealth to gain thorough insights into how to address the challenges of documentation in the behavioral health arena.

—————————————————————————————————————-

In offering an overview and making an in-depth examination of most of the compelling documentation issues in behavioral health, the expert at this webinar will help the participants explore high-risk ethical issues and practical strategies that are designed to protect clients and practitioners.

Offering perspectives on the ways by which the participants can approach the various challenges relating to documentation in the healthcare areas, Dr. Reamer will suggest ways of implementing the practical steps, which will help them handle ethical issues skillfully and minimize risk.

A substantial portion of this learning session is dedicated to the core areas of behavioral health documentation. The relevant ethical standards, statutes, regulations, and case law, and national practice standards are among these.

These are the core areas that Dr. Reamer will help the participants of this webinar explore:

• The content of documentation
• Documentation wording
• Credibility issues related to documentation
• Accessing confidential records
• Record retention
• Responding to subpoenas
• Managing records in integrated health settings.

At this webinar, he will cover the following areas:

• Documentation challenges in behavioral health: Compelling examples
• Common documentation challenges: A typology
• Documentation decision-making: Ethical and risk-management considerations
• Documentation protocols to protect clients and practitioners, and prevent litigation and licensing board complaints

Professionals in the healthcare sector whose work involves heavy documentation in behavioral science, such as psychologists, social workers, mental health counselors, marriage and family therapists, psychiatrists, and psychiatric nurses, will benefit from this course.

—————————————————————————————————————-

About the expert: Dr. Reamer chaired the national task force that wrote the code of ethics adopted by the National Association of Social Workers. Author of more than 20 books and 140 journal articles, encyclopedia entries, and book chapters, Dr. Reamer has been a social worker in correctional and mental health settings who specializes in professional ethics.

Dr. Reamer has gained knowledge of these areas while being an expert witness and ethics consultant in a large number of court cases and licensing board cases throughout the US and abroad. Reamer has been an expert witness and ethics consultant in more than 100 court (litigation) cases and licensing board cases involving ethical and risk-management issues.

 

Upcoming Changes with HIPAA -2020

What does HIPAA hold for 2020? It is bringing in changes that will affect you, a Covered Entity or Business Associate. A session with an expert on HIPAA will go a long way in helping you get sound understanding of this aspect, so that you can avoid getting penalized.

It is with the intention of offering knowledge of this very important area that MentorHealth, a leading provider of professional training for all the areas of healthcare, is organizing a webinar on February 19.

Brian Tuttle, an accomplished healthcare IT professional, will be the expert at this session, at which he will discuss some of the changes taking place in Washington with the Health and Human Services (HHS) with regard to the enforcement of the HIPAA laws.

Please visit Mentorhealth to join in for this valuable learning.

—————————————————————————————————————–

Brian will explain the new changes that will have an impact on the way in which Covered Entities and Business Associates work. He will show what kinds of actions by these entities can invite an unwanted visit or letter from the Office of Civil Rights (OCR) and how to prepare for the audit and deal with the federal authorities.

With HIPAA implementation getting stricter and the penalties that follow from noncompliance becoming higher, it is imperative for practice/business managers, or compliance officers, to know how to stay compliant.

Brian will also address major changes under the Omnibus Rule and any other applicable updates for 2019 and beyond. He will properly explain how patients are now able to get cash remedies for wrongful disclosures of Protected Health Information (PHI), and will clarify on how CE’s and BA’s can limit those risks by taking proactive steps and implementing best practices.

He will cover the following areas at this session:

• Updates for 2019
• Fines
• Portable Devices
• Emailing and Texting
• Business Associates and the increased burden
• Breach Notification
• Paperwork that needs to be Updated
• Risk Factors

—————————————————————————————————————–

About the expert: Brian Tuttle is a Certified Professional in Health IT (CPHIT), Certified HIPAA Professional (CHP), and Certified Business Resilience Auditor (CBRA), who brings over 15 years’ experience in Health IT and Compliance Consulting. He carries with them the experience of having carried over 1000 risk assessments as well as having directly dealt with the Office of Civil Rights HIPAA auditors.

He has served in multiple litigated court cases serving as an expert witness offering inputs related to best practices and requirements for securing and providing patient access to Protected Health Information. Brian has also worked directly with the Office of Civil Rights (OCR) both in defending Covered Entities and Business Associates as well as being asked by the Federal government to audit covered entities and business associates on behalf of the OCR.

 

New HIPAA Rules for Text Messaging & Email

 

The US government has a federal law that regulates the way by which physicians who treat patients that come to them under Medicare get paid for doing so: The Medicare Access and CHIP Reauthorization Act of 2015 (MACRA).

Created with the primary purpose of engendering patient engagement, MACRA uses many technologies used in smart devices for bringing this about. Technologies that are appropriate for the healthcare sector have been put in place. Sending out messages electronically by unencrypted email and text messaging is one of them. MACRA regulates the way by which healthcare providers use the social media for transmitting patient-centric and patient-related pieces of information.

Although the terms and expectations for the use of these technologies have been set clearly in HIPAA; providers and Covered Entities, as well as their Business Associates, are seen to frequently violate these. Of all the violations, those regarding communicating with patients by unencrypted email and text message take the prime position. The main reason this is so is that there is a knowledge deficit among the Business Associates and Covered Entities, all the more in matters relating to their understanding of what a PHI is, as defined by HIPAA.

Knowledge of the existence of this problems has prompted HIPAA to come up with suggestions aimed at mitigating this problem. These safeguards are mentioned in the HIPAA Rules and HHS/OCR guidance. The highlight of this guidance is a simple, easy-to-use Safe Harbor for using unencrypted email and text messaging in engaging patients. This is a simple three-step guidance, knowledge of which can help BA’s and CE’s overcome the problem concerning patient information sent out by unencrypted email and text message.

A thorough understanding of the three-step Safe Harbor

Precise and lucid understanding and knowledge of this HIPAA three-step Safe Harbor is the objective of a webinar that is being organized on February 27 by MentorHealth, a well-known provider of professional training for all the areas of healthcare. The expert at this session is the expert on HIPAA Privacy, Security, Breach notification and Enforcement Rules, Paul Hales.

To gain complete knowledge of this topic and gain mastery of the New HIPAA Rules for text messaging and email, please register for this ninety minute webinar at Mentorhealth.

—————————————————————————————————————

It is a fact that most patients prefer using non-secure communication tools like text messaging and email, even though secure patient portals and encrypted text message and email products are available. When it comes to transmitting most patient engagement tools such as appointment reminders, healthcare instructions, patient satisfaction surveys, health and wellness newsletters, and recall reminders, electronic regular (unencrypted) email and text messaging continue to be the preferred mode.

This preference has been continuing despite the fact of HIPAA having issued a series of rules for sending Protected Health Information (PHI) by unencrypted electronic transmission. Starting with the HIPAA Omnibus Rule in September 2013; this series of rules got further strengthened and clarified with the guidance published in 2014 and 2016 by the US Department of Health and Human Services (HHS).

The only real antidote to the current situation relating to improper PHI transmission is making the Covered Entities, Business Associates and providers aware of the HIPAA Rules, which actually are simple to implement step-by-step. At this webinar, Paul will help the participants get an understanding of just this process, which can go a long way in ensuring that they become HIPAA compliant. He will facilitate their understanding of these steps by breaking down them down into smaller parts.

Paul will cover the following areas at this webinar:

• A clear explanation of the simple 3 Step HIPAA Safe Harbor that protects Covered Entities and Business Associates acting on their behalf from liability related to Patient Engagement by unencrypted email and text messaging
• What makes an email or text message subject to HIPAA law
• A clear explanation of how HIPAA defines PHI – it’s not just information about, for example, a diagnosis, disease, surgery or prescribed treatment
• How a 2015 Federal Communications Commission Order about health care text messages added to confusion and what it really means – the 3 Step HIPAA Safe Harbor is the only text message Safe Harbor for Covered Entities and Business Associates
• The interconnected liability of Covered Entities and Business Associates that provide unencrypted electronic patient engagement services like appointment reminders – and both can protect themselves.

—————————————————————————————————————

About the speaker: Paul R. Hales is an expert on HIPAA Privacy, Security, Breach notification and Enforcement Rules with a national HIPAA consulting practice based in St. Louis. He is the author of all content in The HIPAA E-Tool, an Internet-based, Software as a Service product for health care providers and Business Associates.

 

 

HIPAA, Consents, and 42 CFR Part 2 – Tracking the Release of Information Under Conflicting Rules

While HIPAA sets the standards for how to manage uses and disclosures of Protected Health Information (PHI) for most areas of healthcare; its rule is different when it comes to information pertaining to the treatment of substance use disorders.  It is in the Substance Abuse and Mental Health Services Administration (SAMHSA) under 42 CFR Part 2 that its regulations for this information are contained.

While HIPAA controls only the release aspect of health information, SAMHSA places very tight controls on the release and re-release of patient information. After the release of this health information, it can be used according to the regulations and obligations of the receiving party. Part 2 places obligations on the recipients to provide further protection under Part 2 rules.

42 CFR Part 2 has framed rules, right from the beginning, which have made consent obligatory for each and every release of information. Its recent rules allow release to what it describes as “others involved in my care”. This could include re-release of information without a new consent.

Why did HIPAA introduce this new option? It wants to make the release and re-release of information as simple as it can. Despite this, implementation is considered arduous. One of the requirements HIPAA has placed is in making the source releasing the information responsible for making it possible to report to the individual a list of parties to whom the information has been released. So, while in principle, the accounting aspect for these disclosures is similar to the HIPAA accounting of disclosures, it is a lot deeper by applying to treatment disclosures all the way down the chain of releases.

A webinar that MentorHealth, a leading provider of professional training for the areas of healthcare, is organizing on February 20, will offer thorough understanding of the ways by which HIPAA, Consents, and 42 CFR Part 2 work, and go to make tracking of the release of information under conflicting rules easier.

Jim Sheldon-Dean, the founder and director of compliance services at Lewis Creek Systems, LLC, is the expert at this webinar. Please visit Mentorhealth to register for this session.

—————————————————————————————————————

The main areas on which Jim will clarify on the differences between HIPAA and SAMHSA are the one relating to disclosures and other important elements. These are the chief ones among them:

• While HIPAA allows a number of disclosures, for treatment, payment, and healthcare operations purposes without requiring consent from the individual being treated, SAMHSA requires consent for every disclosure or re-disclosure
• If the right consents are not obtained, SAMHSA rules make the provider responsible for the violation of the rules and subjects it to penalties.

At this very crucial learning session, Jim will cover these areas:

• What HIPAA allows, what SAMHSA requires, and the differences will be explained
• We will examine how to determine if the services you provide place you under 42 CFR Part 2
• We will explore the means for making sure substance abuse treatment information receives the appropriate protections
• The Consent and Release Requirements under HIPAA will be explained
• The consent and Release Requirements under 42 CFR Part 2 will be explained
• Re-release of Information released under 42 CFR Part 2 will be discussed
• Sharing of information with family and friends in an overdose incident will be explored
• Requirements for Providing an accounting of disclosures of Part 2 information will be explained
• Challenges in managing mixed records with some Part 2 and some non-Part 2 data will be discussed.

—————————————————————————————————————-

About the speaker: Jim Sheldon founded his Vermont-based firm in 1982. It has since been providing information privacy and security regulatory compliance services to a wide variety of health care entities. Sheldon-Dean has more than 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development.

He serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and is a recipient of the WEDI 2011 Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences.