Description

Overview: New regulations modifying the HIPAA Privacy and Security Regulations have been proposed and/or finalized to meet the privacy and security mandates within the HITECH Act in the American Recovery and Reinvestment Act of 2009.

New requirements for business associates of HIPAA covered entities and requirements to notify individuals in the event of a breach are only two of the many areas affected in the new law, including new requirements for restricting and accounting of disclosures and increased enforcement activity. All kinds of covered entities, and now, business associates of covered entities and their subcontractors as well, need to review their HIPAA compliance, policies, and procedures to see of they are prepared to meet the changes in the rules. Covered entities that use electronic health records (EHRs) will need to meet new access and disclosure rules and all kinds of business associates and their subcontractors will need to establish compliance programs. And the regulations include new requirements for audits by the US Department of Health and Human Services and mandatory penalties in the event of willful neglect of the regulations. This teleconference will help health information professionals understand what they have to do, and when, and what to keep in mind as they move forward, in order to be prepared for compliance with the new regulations. The teleconference will provide a comprehensive look at the changes in the law and prepare attendees for the process of incorporating the changes into how they do business in their facilities.Business associates are now directly covered by the HIPAA privacy and security regulations and are liable for fines and penalties if they do not comply. In addition, there are new kinds of businesses that are considered to be business associates, such as Health Information Exchanges and e-Prescribing Gateways, but also patient safety organizations and any subcontractors of business associates, putting thousands of businesses under regulation that were not regulated before now. We will explain what a Business Associate needs to do differently under the new regulations, including providing a policy framework for information security. Penalties for violations have been increased, including a new, four-tier penalty structure and new mandatory penalties for willful neglect that begin at a minimum of $10,000 and can go up to $1.5 million or more. The definitions of the penalty levels include new definitions for reasonable cause and reasonable diligence, as well as willful neglect, which have a direct impact on the amount of penalty a violation may be subject to. Electronic records have new demands placed on them, in both providing access and in accounting for all disclosures of health information - the electronic age in health care brings new obligations to serve individuals as well as manage health information for healthcare professionals. We will discuss how disclosures must be tracked.

Why you should attend: The HIPAA Privacy and Security Regulations have been modified by language in the HITECH Act within the American Recovery and Reinvestment Act of 2009 and the resulting changes in the regulations issued as interim final rules (IFRs) and notices of proposed rule making (NPRMs) by the US Department of Health and Human Services (USDHHS). All kinds of covered entities, and now, business associates of covered entities and their subcontractors as well, now covered directly under the regulations, need to review their HIPAA compliance, policies, and procedures to see of they are prepared to meet the changes in the rules. Some subcontractors of business associates may not even be aware that they handle protected health information and now fall under the regulations. Not only are the compliance rules changed, but the enforcement rules have changed, with a new four-tier violation schedule with increased minimum and maximum fines, and mandatory fines for willful neglect of compliance that start at $10,000 even if the problem is corrected within 30 days of discovery. Violations that are not promptly corrected carry mandatory minimum fines starting at $50,000 and can reach $1.5 million for any particular violation. And any reports of willful neglect are required to be investigated under the law. Even violations for a reasonable cause or with reasonable diligence taken are subject to penalty. Whereas the former practice of USDHHS has been to audit compliance only in instances where a violation was reported, the law now requires USDHHS to conduct a regular HIPAA compliance audit program, and soon those individuals harmed by a violation will have the right to a share in any settlements or penalty collections. With the far reaching changes in the rules and the new enforcement and penalty levels, it s never been more important to review your HIPAA compliance and meet the new requirements.

Areas Covered In the Seminar: