MDNews - Mid Hudson

++++++++++++++++++++++++++++++ +++ + +++ PRACTiCE MANAgEMENT+ ++++++++++++++++++++++++++++++ us rule: 's omnib hIPA A s? reache r Your B oo Big fo T services' healTh healTh and human u.s. deparTmenT of fT pracTice e of The a) breach rule le The January releas unTabiliTy acT (hipa iliTy and acco T nearly as long. insurance porTab on and a To -do lis ges of legal Jarg pa managers wiTh 138 "The most important things a covered Now, defending a covered entity against entity can do to safeguard against a breach u B B e D " T h e m o S T sweepa compromise that could lead to breach is to pay attention to the rules, endeavor to ing change" to HIPAA patient means analyzing every disclosure of PHI comply, reach out to vendors for security, privacy rules since the law was with a four-factor test. Practice managers and have policies and procedures in place introduced in 1996, the omnibus should be able to determine: for preventing breach," recommends Alden rule gives patients more control than ever + Extent and nature of PHI disclosed in Bianchi, Member of Mintz, Levin, Cohn, over their protected health information each case Ferris, Glovsky, and Popeo, P.C. "If policies (PHI). As a result, health care organizations are in place and a policy official is employed are swimming in new breach liabilities. + Who received the PHI with the practice, the penalties for willful "Until the passage of the omnibus rule, neglect are out of the picture." covered entities such as physician offices + Whether the recipient of the PHI actuTo follow Bianchi's recommendations, and medical centers decided whether ally acquired and viewed it practices can start by conducting a risk a disclosure of information included assessment. The law requires this assesssignificant risk of harm, but the new rule + Post-disclosure risk mitigation ment, which gives practices a chance to uses external factors to determine that strategies used find weak links in the PHI chain that probability," explains Robert Tennant, make them vulnerable to breach — usually Senior Policy Advisor with the Medical The four-factor test must apply to business remote access devices that store electronic Group Management Association. "This associates that come into contact with PHI health records. By beginning with the makes proving a lack of risk more stringent as well. If covered entities can't determine risk assessment, covered entities begin on covered entities, so a disclosure is more these factors for business associates, they'll defending against breach and meeting likely to constitute a breach under the be just as liable for the breach as if it had some of the omnibus requirements at the new rule." occurred within their own organizations. same time. ■ D "Breaches can have horrific consequences, so regulators were wise to look into any unauthorized disclosures of personal health information. as the Department of health and human services begins investigating breaches under the new rule, covered entities will need to train their colleagues and associates over and over on privacy policies and procedures." — alden Bianchi, Member of Mintz, Levin, Cohn, Ferris, glovsky, and Popeo, P.C. mDNeWS.Com ■ MD News Mid Hudson | 23

• Cover