For health care providers, although complex, compliance with HIPAA is especially important. The federal government can impose severe sanctions on organizations found in violation of HIPAA. Federal regulations for meaningful use and MACRA/QPP also require participating providers to perform a security risk assessment each year to be eligible for incentives or bonuses.
The Kentucky REC can help with navigating HIPAA’s requirements to safeguard the confidentiality, integrity and availability of patient information. We offer two services to aid health care organizations: Security Risk Analysis and Project Management services.
For more information on these services, click the boxes below or contact the Kentucky REC today.
Security Risk Analysis
A Security Risk Analysis is an accurate and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic patient health information (ePHI).
Project Management Services
Planning is essential to mitigating risks. Whether it’s a policy limiting the use of unencrypted portable devices or testing back-ups to ensure a disaster recovery plan is effective, having a strategy and a plan helps prevent the unauthorized access, use, or disclosure of ePHI.
WEEKLY HIPAA TIP
HIPAA Privacy & Security: Contingency Planning Series – Part 2
What should be included in your Contingency Plan?
The HIPAA Security Rule requires that Covered Entities and Business Associates have the following parts of a Contingency Plan: 45 CFR 164.308 (a)(7)(ii)(A-C)
-
- Data backup plan (required)- Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.
- A disaster recovery plan (required)- Establish (and implement as needed) procedures to restore any loss of data.
- Emergency mode operation plan (required)- Establish (and implement as needed) procedures to enable the continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.
Contingency planning can help your practice:- Mitigate patient safety issues such as the difficulty of sending prescriptions to the pharmacy for high-risk patients;
- Protect, and if necessary, recover patient records;
- Effectively protect and recover revenue.
Check out our Weekly HIPAA Tips next week for Part 3 of this series.
This reminder is part of a series of HIPAA Security Reminders from the Kentucky Regional Extension Center. These reminders can be used by covered entities and business associates looking to comply with the HIPAA Security Rule’s CFR §164.308(a)(5)(ii)(A), which states, “Security reminders (Addressable). Periodic security updates.”
Feel free to share this with your workforce/staff to remind them of the importance of safeguarding protected health information (PHI), especially PHI that is in electronic form (ePHI). A new security reminder is posted at the beginning of each week. If you have any questions or would like to speak to someone at the REC about HIPAA Privacy and Security please contact us at Kentucky REC or call (859) 323-3090.
Previous HIPAA Webinars
Recorded May 2023
Security incident response and reporting is a required standard of the HIPAA Security Rule. Ransomware is the #1 security threat for all healthcare organizations, making this security standard more important than ever. Kentucky REC HIPAA Team Lead Amy Daley, along with guest speaker Ryan Lewis, of CISA, share guidance and templates for creating a security incident response plan, focusing on cyberattacks.
RESOURCES
Recorded December 2022
Kentucky REC advisor Amy Daley focuses on the safeguards most organizations need to strengthen in order to be better prepared for protecting against and responding to a ransomware attack.
