Why You Need a HIPAA Expert
Are you an organization that works with protected health information (PHI)? If the answer is yes, you need to comply with the rules set forth by the HIPAA regulation. But figuring out what exactly you need to do to comply with HIPAA can be difficult. Since HIPAA applies to a variety of different sized organizations, the law states that organizations need to implement “reasonably appropriate” measures for their organization. You may be thinking, what is considered reasonably appropriate for your organization? This is where the HIPAA expert comes in.
What is a HIPAA Expert?
A HIPAA expert is a consultant that is contracted to help your organization implement a HIPAA compliance program, that answers HIPAA questions, and offers audit support. Depending on the size of your organization and the type of organization (covered entity, business associate, managed service provider) your compliance needs will differ. A policy or procedure that is right for a large hospital group may not be right for a small business associate.
Determining what your organization should and shouldn’t implement can be difficult. Consulting a HIPAA expert allows you to implement an effective HIPAA compliance program, eliminating the guesswork.
Compliancy Group’s HIPAA Compliance Software
An effective HIPAA compliance program consists of several components. The main function of HIPAA is to ensure the confidentiality, integrity, and availability of PHI.
This is done by:
◈ Assessing the safeguards that you have in place protecting PHI;
◈ Creating plans to address gaps in safeguards;
◈ Creating policies and procedures in line with HIPAA standards;
◈ Training employees;
◈ Implementing business associate management;
◈ Monitoring access to PHI; and
◈ Reporting unauthorized access to PHI.
Compliancy Group’s HIPAA compliance software, the GuardTM, is a full service compliance tracking software. The Guard stores all of the documentation that you need to prove your “good faith effort” towards compliance. Our software also allows you to conduct all of your required HIPAA training, and tracks employees progress. Within the training module, employees legally attest that they have read and understood the material, and they agree to adhere to it. Employees can also anonymously report a breach or suspected HIPAA violation.
The following are included in our HIPAA compliance software:
◈ Risk Assessments. Covered entities are required to conduct six self-audits annually, while business associates and MSPs must complete five. Completing self-audits measures your administrative, physical, and technical safeguards against HIPAA standards.
◈ Gap Identification and Remediation. Upon completion of self-audits, your gaps in safeguards are identified. To be HIPAA compliant, you must address gaps with remediation plans. Remediation efforts close gaps so that your safeguards are adequately securing PHI.
◈ Policies and Procedures. A major component of HIPAA now is illustrating compliance through documentation. As such, you must have customized policies and procedures dictating how you adhere to the HIPAA Security, Privacy, and Breach Notifications Rules.
◈ Employee Training. To ensure that employees properly use and disclose PHI, they must be trained annually. HIPAA training should include HIPAA basics, your organization’s policies and procedures, proper use of social media, and cybersecurity.
◈ Business Associate Management. Before working with a vendor, it is essential to assess their safeguards. Vendors (business associates) are required to be HIPAA compliant to work with healthcare clients. They must also be willing to sign a business associate agreement (BAA). A BAA must be signed before it is permitted to share PHI with the business associate. A BAA is a legal document that dictates the safeguards the business associate is required to have in place, it also requires each party to be responsible for maintaining their compliance.
◈ Incident Response. If you experience a breach, you have an obligation to report it. Additionally, employees must have a means to report breaches anonymously. Our HIPAA software allows this, while also allowing administrators to track reported incidents.
HIPAA Expert: Compliance Coaches
Compliancy Group’s Compliance Coaches™ are guides that assist clients through every step of creating, implementing, and maintaining their HIPAA compliance program.
Compliance Coaches meet with clients virtually:
◈ Walking them through conducting risk assessments;
◈ Creating remediation plans;
◈ Creating policies and procedures;
◈ Training employees;
◈ Vetting vendors and sending them business associate agreements; and
◈ How to report a suspected breach.
HIPAA Expert: Audit Response Program
Organizations that work with PHI are obligated to report a breach should one occur. Depending on the size of the breach, reporting requirements differ. Breaches affecting 500 or more patients must be reported to the Department of Health and Human Services (HHS), affected patients, and the media within 60 days of discovery. Breaches that affect less than 500 patients must be reported to the HHS and affected patients within 60 days from the end of the calendar year in which the breach was discovered (March 1st).
In some instances, organizations that experience a breach may be audited by the HHS’ Office for Civil Rights (OCR). To absolve you of any wrongdoing, OCR will ask for documented proof of your compliance efforts. This is where the Audit Response ProgramTM comes in. Compliancy Group’s Audit Response Program provides all of the documentation and reports required by the HHS’ OCR to prove your “good faith effort” towards compliance. In this case, “good faith effort” refers to implementing an effective HIPAA compliance program that is “reasonably appropriate” for your organization.
Compliancy Group’s clients can have confidence in their compliance program, and the Audit Response Program, as we have never failed an audit on behalf of our clients!
