Breaking Compliance News Blog

Using Social Media Safely During a Pandemic

Posted by Margaret Scavotto, JD, CHC on 5/14/20 9:20 AM

During a national public health emergency, healthcare providers will have many reasons to use social media. The community will likely turn to social media to learn what your organization is doing in response to COVID-19. Social media can be used to keep the public informed, ward off panic, advise patients and loved ones of new procedures or protocols, and show the public a strong response during the disaster. Social media is also being used to recruit staff, volunteers, and supplies.

Read More

Topics: Social Media, security, business associates, compliance, COVID-19, privacy

Stay informed with MPA's Monthly Compliance Newsletter

Posted by Margaret Scavotto, JD, CHC on 5/12/20 10:45 AM

MPA scours OIG, DOJ, FBI, and OCR enforcement updates and news headlines so you don't have to.

Every month, we summarize enforcement trends and deliver the latest compliance and HIPAA developments to your inbox with our Monthly Compliance News Report.

Coming to this month's issue:

  • DOJ stops phony COVID-19 "ozone therapy"
      
  • Rehab company pressured SNF therapists to provide Ultra High Therapy
      
  • Executives pay up for unnecessary tests
       
  • DOJ wants mandatory breach reporting
  • Some enforcers offer discretion during the pandemic

  • FBI warns of PPE scams

  • Nursing home sued for response to COVID-19
  • Hackers targeting small healthcare providers, executives

  • HIPAA reminder: Is your workforce changing during the pandemic?

Not yet a subscriber? click here to sign up.  

You can read a sample report here

Read More

Topics: Compliance Basics

OCR issues guidance on media access to patients

Posted by Margaret Scavotto, JD, CHC on 5/6/20 2:35 PM

On May 5, the OCR issued guidance addressing media access to PHI during the pandemic: OCR Issues Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities. The OCR’s purpose in issuing this guidance is: “reminding covered health care providers that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities where patients’ protected health information (PHI) will be accessible without the patients’ prior authorization.” 

During COVID-19, providers are still required to obtain HIPAA authorizations from patients BEFORE the media is given access to patient PHI. This includes film crew access, and access to parts of the facility where patient PHI is accessible to the media in written, electronic, oral, or other visual/audio form. The OCR makes clear that every patient who will be in an area accessed by the media must sign a HIPAA authorization BEFORE the media has access.

Providers CANNOT require a patient to sign a HIPAA authorization as a condition of receiving treatment.

Masking or blurring patient faces or voices (which occurs AFTER the media has access to patients) is NOT enough to comply with HIPAA, unless a HIPAA authorization is obtained BEFORE the media has patient access.

If HIPAA authorizations are obtained in advance, and the media is given access to your facility, the OCR recommends safeguards to protect PHI:

  • Use computer monitor privacy screens
  • Install opaque barriers to block film crew access to PHI of patients who did not sign an authorization

This new guidance elaborates on prior OCR guidance about communicating with the media, including film crews.

Prior to the pandemic, the OCR entered two settlements with providers who allowed film crews access to patients without a proper HIPAA authorization:

  • In 2016, New York Presbyterian Hospital entered a $2.2 million settlement for what the OCR called an “egregious disclosure.” The hospital allowed the ABC TV show NY Med to film two of its patients in the emergency room, without obtaining their authorization. One of the filmed patients was dying; the other was in distress. Filming continued after a medical professional objected. One of the patients filmed was Mark Chanko, a gentleman who was taken to the hospital after he was hit by a garbage truck. When NY Med aired, Mr. Chanko’s voice was muffled and his face was blurred – but he was still recognized by his widow
  • In 2018, the OCR entered a $999,000 settlement with three Boston hospitals who allowed film crews from ABC to film on the premises without obtaining HIPAA authorizations. 

HIPAA media breaches are not limited to film crews:

  • In 2017, a Texas health system entered a $2.4 million settlement with the OCR. A patient presented a fake ID at the system’s OB/GYN clinic. The clinic called the police, which complied with the Privacy Rule’s provisions for reporting a crime on the premises. But, then the health system issued a press release about the arrest – and the press release title included the patient’s name. 
  • In 2013, a medical center entered a $275,000 with the OCR after senior leaders of the medical center “met with media to discuss medical services provided to a patient” and “impermissibly shared details about the patient’s medical condition, diagnosis and treatment in an email to the entire workforce.” 

MPA’s HIPAA & COVID-19 Tool Kit has been updated to include a HIPAA & the Media Policy in response to this guidance.

Read more HIPAA & COVID-19 updates on the blog.

 

Read More

Topics: HIPAA, compliance, COVID-19, privacy

Sign up for MPA's May Compliance & COVID-19 Webinars

Posted by Margaret Scavotto, JD, CHC on 5/4/20 10:12 AM

I hope you can join me for MPA's upcoming complimentary webinars:

For all providers:

Keeping Compliant During COVID-19

May 19, 2020, 12 CST

Register

 

For nursing homes:

Phase 3 Compliance Webinar: Social Media Compliance During a Pandemic

May 27, 2020, 12 CST

Register now

 

Zoom will email you a link to access the webinar - and I will also send this link around the day before the webinar.

Have a great day!

COVID-19 Discounts:

  • All digital download HIPAA Tool Kits are 50% off until June.
  • Compliance program annual reviews are 25% off until June (call or email me for info)
  • Our HIPAA & COVID-19 Toolkit is available at the discounted price of $95.
  • MPA will continue putting out HIPAA announcements, news, and tips on the blog
  • MPA has free compliance and HIPAA resources on its Free Resources page.  

Read More

Topics: compliance, Phase 3, COVID-19

Protect your organization from skyrocketing COVID cyber scams

Posted by Scott Gima on 4/30/20 11:00 AM

Google’s Threat Analysis Group (TAG) is responsible for identifying online vulnerabilities and threats. The Group released a report on April 22, 2020 that describes their latest information on COVID-19 related threats. This report provides a timely reminder that cybersecurity concerns continue and everyone must remain cautious and vigilant with their email accounts.

COVID-19 Themed Attacks

In April, Google has detected 18 million COVID-19 related malware and phishing Gmail messages per day and more than 240 million COVID-related daily spam messages. If you use Gmail, 99.9% of these messages never reach your inbox. The TAG has found that these attacks are government sponsored. They have identified over a dozen government-backed attacker groups using COVID-19 related topics.

Type of Attacks

The attack tools are no different from what has been used in the past; phishing emails that lure you to click malicious links or download files that contain malware. Google provided the following examples:

Free meals and coupons in response to COVID-19.

Links to malicious websites disguised as online ordering and delivery options, where the recipient is asked to provide their Google account credentials.

Emails that impersonate the World Health Organization:


Emails luring users who may be working from home:


Stimulus package theme:



Best Practices Reminder

These types of attacks are not limited to Gmail and everyone must be vigilant with all email accounts, work and personal. For all your accounts, users should:

  • Never download file attachments - or, verify an email attachment with the recipient by voice or text before downloading – this is an old-fashioned version of two-factor authentication.
  • Don’t click on an email link. An alternative safe option is to go directly to the web-page or google the target described in the link. For example, if it is an email from your bank that could be legitimate, open a new browser page and type in the website or search for the website.
  • If possible, use or activate two-factor authentication.

MPA can help with your HIPAA Security Risk Analysis - contact me today to learn more.

Read More

Topics: HIPAA, security, COVID-19

What do we do about compliance now?

Posted by Margaret Scavotto, JD, CHC on 4/28/20 10:00 AM

How should COVID-19 affect your compliance program progress? Do we keep going? Halt? Or is the answer somewhere in between?

Read More

Topics: COVID-19

HIPAA & COVID-19 Toolkit UPDATED for new OCR Business Associate Guidance

Posted by Margaret Scavotto, JD, CHC on 4/2/20 3:08 PM

***To help providers with HIPAA compliance during the COVID-19 pandemic, all MPA HIPAA Tool Kits are now marked down to 50% off. 
 

Business Associate Disclosures during COVID-19

On April 2, 2020, the OCR issued a Notification of Enforcement Discretion under HIPAA to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19

This Notification, effective immediately, announces that the OCR will NOT impose HIPAA penalties against a business associate or covered entity under the following Privacy Rule provisions, in some circumstances. Enforcement is waived for the following Privacy Rule sections:

  • 45 CFR 164.502(a)(3): Business Associates: Permitted Uses and Disclosures
  • 45 CFR 164.502(e)(2): Disclosures to Business Associations: Documentation
  • 45 CFR 164.504(e)(1): Business Associate Contracts
  • 45 CFR 164.504(e)(5): Business Associate Contracts with Subcontractors

Enforcement of these sections will not occur in the following circumstances:

  • A business associate makes a good faith use or disclosure of the covered entity’s PHI for public health activities consistent with 45 CFR 164.512(b) or health oversight activities consistent with 45 CFR 164.512(d); AND
  • The business associate informs the covered entity within 10 calendar days after the use or disclosure occurs (or commences, with respect to uses or disclosures that will repeat over time).

If a business associate makes one of these disclosures, and the covered entity and business associate have not had time to update their business associate agreement to allow for such disclosures, OCR will not impose penalties.

An example of how this waiver might apply to you might be:

  • If a business associate is contacted by the local public health department and asked questions during a health investigation related to a COVID-19 patient. The business associate will be permitted to disclose information to the public health department. This type of disclosure is not typically permitted, if it is not specifically outlined in the BAA. However, under this waiver, the business associate may disclose the requested information to the public health department. Within 10 days of the disclosure to the public health department, the business associate must inform the covered entity that the disclosure was made. 

Business associates are STILL expected to comply with the Security Rule. For example, ePHI must be securely transmitted to the public health authority or health oversight agency.

MPA's HIPAA & COVID-19 Toolkit was updated April 2 for the new OCR guidance on business associates.

HIPAAtrek and MPA are here to help navigate and guide HIPAA compliance. Our priority is you – our clients, our healthcare providers, and healthcare administrators. We understand that this is a confusing and scary time. Now more than ever, please reach out with your compliance questions. We are here to help alleviate your compliance burden both now and in the future. Stay healthy.

Sincerely,

Margaret and Sarah

Check out our other HIPAA & COVID-19 blogs:

Read More

Topics: HIPAA, data breach, security, COVID-19, privacy

HIPAA & COVID-19: telehealth

Posted by Margaret Scavotto, JD, CHC on 3/27/20 12:00 AM

Blog Series: Staying HIPAA Compliant During COVID-19

Sarah Badahman, CHPSE, Founder/CEO, HIPAAtrek, St. Louis 

Read More

Topics: HIPAA, data breach, security, COVID-19, privacy

HIPAA & COVID-19: What HIPAA requirements are waived during COVID-19?

Posted by Margaret Scavotto, JD, CHC on 3/26/20 10:01 AM

Blog Series: Staying HIPAA Compliant During COVID-19

Sarah Badahman, CHPSE, Founder/CEO, HIPAAtrek, St. Louis 

Bethany Baty, Digital Marketing Director, HIPAAtrek, St. Louis

Margaret Scavotto, JD, CHC, President, MPA, St. Louis 

***To help providers with HIPAA compliance during the COVID-19 pandemic, all MPA HIPAA Tool Kits are now marked down to 50% off. 
 
A HIPAA & COVID-19 Telehealth policy was added to the Privacy and Security Tool Kits on 3/24 ***

Today is day four of a five day blog series on HIPAA issues that are relevant during COVID-19. Our goal is to help you remain compliant during these challenging times. ~ MPA and HIPPAtrek.

 

What HIPAA requirements are waived during COVID-19?

On March 16, the Office for Civil Rights (OCR) issued a bulletin in response to the COVID-19 outbreak: Limited Waiver of HIPAA Sanctions and Penalties During a Nationwide Public Health Emergency. For providers who followed the OCR’s waivers during Hurricanes Irma or Michael, this waiver should look familiar to you.

Who is covered by the waiver?

This waiver only applies to covered hospitals. All other providers must continue to follow HIPAA fully (with some leeway given under the Telehealth Waiver).

What’s waived

Under this waiver, as of March 15, 2020, the OCR waives sanctions and penalties against hospitals that do not follow these HIPAA Privacy Rule provisions:

  • the requirements to obtain a patient's agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).
  • the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).
  • the requirement to distribute a notice of privacy practices. See 45 CFR 164.520.
  • the patient's right to request privacy restrictions. See 45 CFR 164.522(a).
  • the patient's right to request confidential communications. See 45 CFR 164.522(b)

The waiver ONLY applies to the COVID-19 public health emergency. To get the benefits of the waiver. Hospitals must:

  • have a disaster protocol in place
  • use the waiver for a maximum of 72 hours from the time the disaster protocol is implemented
  • resume complying with the Privacy Rule when the public health emergency ends.

What’s not waived?

The OCR’s waiver alert provides guidance on HIPAA practices that are not waived, and should be followed during the COVID-19 pandemic. Here is what is NOT waived:

  • The REST of the Privacy Rule. All Privacy Rule provisions not listed in the waiver must still be followed. Perhaps most importantly, providers must continue to follow the Minimum Necessary Rule wen making disclosures.
  • The waivers do NOT change how providers can communicate with the media. Follow your directory. For all other requests, get an authorization.
  • The Security Rule is NOT waived. Providers must still safeguard patient information with administrative, physical, and technical safeguards. With employees working from home and cyber scams on the rise, provider should take extra security precautions.

We encourage you to read the OCR’s Alert in its entirety to familiarize yourself with all of the OCR’s recommendations and reminders.

***To help providers with HIPAA compliance during the COVID-19 pandemic, all MPA HIPAA Tool Kits are now marked down to 50% off. 
 
A HIPAA & COVID-19 Telehealth policy was added to the Privacy and Security Tool Kits on 3/24 ***

Read More

Topics: HIPAA, data breach, security, COVID-19, privacy

HIPAA & COVID-19: Watch out for COVID-19 cyber scams

Posted by Margaret Scavotto, JD, CHC on 3/25/20 9:56 AM

Blog Series: Staying HIPAA Compliant During COVID-19

Sarah Badahman, CHPSE, Founder/CEO, HIPAAtrek, St. Louis 

Bethany Baty, Digital Marketing Director, HIPAAtrek, St. Louis

Margaret Scavotto, JD, CHC, President, MPA, St. Louis 

***To help providers with HIPAA compliance during the COVID-19 pandemic, all MPA HIPAA Tool Kits are now marked down to 50% off.
 
A HIPAA & COVID-19 Telehealth policy was added to the Privacy and Security Tool Kits on 3/24.***

 

Today is day three of a five day blog series on HIPAA issues that are relevant during COVID-19. Our goal is to help you remain compliant during these challenging times. ~ MPA and HIPPAtrek.

Watch out for COVID-19 cyber scams

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about increased hacker activity during the coronavirus pandemic: Defending Against COVID-19 Cyber Scams.

In this Alert, CISA warns the nation to be on guard against an increase in malicious cyber activity:

Cyber actors may send emails with malicious attachments or links to fraudulent websites to trick victims into revealing sensitive information or donating to fraudulent charities or causes. Exercise caution in handling any email with a COVID-19-related subject line, attachment, or hyperlink, and be wary of social media pleas, texts, or calls related to COVID-19.

Likewise, the FBI addressed an “unprecedented wave” of cyber-attacks in the U.S.

Sadly, hackers are focusing their efforts on the three states hit the hardest by coronavirus: California, New York, and Washington – and hackers are targeting employees working from home. As the virus spreads in more states, this focus could broaden.

On Monday, the OIG sent out a Fraud Alert warning the public about a new fraud scheme preying on COVID-19 fears. Individuals are using telemarketing, social media, and in-person solicitation to offer COVID-19 tests to Medicare beneficiaries. The scammers obtain patients' personal information and Medicare information, and use it to submit fraudulent Medicare claims and commit identity theft. Individuals who think they need to be tested for COVID-19 should contact their physician or the health department, rather than responding to a solicitation.

CISA outlines precautions you can take to increase your security defense against COVID-19 inspired cyber-attacks:

In addition, now would be a good time to increase training on phishing scams and other malicious attacks. Consider providing staff with examples of malicious emails for training purposes, or use phishing drills.

HIPAAtrek and MPA can help make HIPAA compliance easier with policy downloads, training, and HIPAA software. Let us know if we can help. 

***To help providers with HIPAA compliance during the COVID-19 pandemic, all MPA HIPAA Tool Kits are now marked down to 50% off. 
 
HIPAA & COVID-19  Telehealth policy was added to the Privacy and Security Tool Kits on 3/24 ***

Read More

Topics: HIPAA, data breach, security, COVID-19, privacy

    Privacy Policy           Terms of Use