Hipaa Privacy Awareness Articles

HITECH Act Changes Game For HIPAA Compliance VARs

These days, health-care security solution providers are on the precipice of something that many channel partners only wish they had -- a potential windfall of business driven by federal mandates and backed up by government funding.

Specifically, the federally mandated Health Insurance Portability and Accountability Act (HIPAA), which governs medical data protection, is gaining enforcement powers through President Barack Obama's stimulus plan, spurring small doctors' offices and large hospitals alike to start conversations about becoming compliant and transferring sensitive patient data to Electronic Health Records (EHRs). And the channel is reaping the rewards.

The key factor driving these changes is recently enacted legislation -- the Health Information Technology for Economic and Clinical Health [HITECH] Act , which arms HIPAA with tough new enforcement capabilities as well as more funding.

“The main catalyst is in the HITECH Act, and the additional pressures that are being put on physician practices and their business associates to become compliant,” said HIPAA Security Specialist Joe Dylewski, president of ATMP Solutions , a southeast Michigan-based solution provider. “Up until HITECH came out in 2009, there were never any teeth in HIPPA enforcement. There wasn’t a lot of attention paid to the organizations that violated it.”

The federally mandated HIPAA emerged in 1996 as a way to make health insurance portable from one provider to another, to reduce health-care costs, provide general administrative efficiencies and offer privacy and security around the exchanged information. However, it lacked enforcement, solution providers said.

HITECH contains incentives related to health-care IT designed to accelerate the adoption of EHR systems among providers and deepen privacy and security protections available under HIPAA by increasing the potential legal liability for non-compliance and providing more tools for enforcement.

Buddy Hickman, EVP/CIO, Albany Medical Center, Discusses His ...

The transformation of HIPAA from a toothless herbivore into a fierce meat-eater began with a few high-profile prosecutions that concluded in significant fines. Since that time, the government has been working to add ever more claws to this growing beast. The most recent of those has been an accounting of disclosures NPRM, which seeks to define exactly what type of information a patient is entitled to regarding access to their EHR after their hospital stay. The NPRM created a firestorm of response, largely critical, due to the onus it would place on IT and compliance departments. But more than this one rule, healthcare organizations can see the writing on the wall, with CIOs understanding that security needs to be shored up, quickly and efficiently. To gauge what others are doing with respect to staff education on the dos and don’ts of security, Albany Medical Center EVP/CIO Buddy Hickman issued a survey to his fellow CHIMErs. To learn more about his motivation for issuing the survey, the results, and how he plans to turn lessons-learned into policies, healthsystemCIO.com caught up with the New York-based CIO.

(Click Here To Download The Survey Results)

I think the position that we’re now starting to move toward is how do we set up our own proactive compliance algorithms so we know our behaviors are where they need to be and that folks aren’t going where they shouldn’t go.

And what about the data itself that has to be included in the report? Well, we would like to see it be the data that’s available from the electronic health records and from its logging capability. We don’t want to have to implement a third party tool on top of that additional cost and additional effort to have that tool do all those captures if EHR can’t do it itself.

if someone leaves paper records behind, that’s a privacy issue; if someone leaves a hard drive behind which is not appropriately encrypted, that’s an IT security issue because there are measures that we can take on the technical security side to assure these assets.