Some of the top breaches happen due to unauthorized users accessing ePHI. What exactly is an unauthorized user? An unauthorized user is any individual(s) who have not been authorized or have not been given access to ePHI. It is the person or persons who used the protected health information or to whom the disclosure of protected health information was made. Under HIPAA, this is considered a breach and by law is reportable. Breaches of ePHI can be caused by mistakes (someone loses a laptop) or by a bad actor (hacker, rogue employee).

This video addresses the Tennessee Department of Commerce and Insurance’s recent position regarding dental service plans.

Bullying includes acts of cruelty, belittlement, degradation, yelling or screaming, excessive or unjustified criticism, public reprimand or behavior intended to punish, such as ignoring or excluding someone from workplace activities, intimidation, ridicule, threats, insults or sarcasm, humiliating or demeaning a person in front of others, trivialization of views and opinions, or unsubstantiated allegations of misconduct, sabotaging someone’s ability to do their job, unfairly blaming them for mistakes or stealing credit for their work, assigning an excess of work deliberately to cause stress to the individual, or physical violence such as pushing, shoving, or throwing of objects.

Center for Disease Control and Prevention (CDC) published new guidelines, Tuberculosis Screening, Testing, and Treatment of U.S. Health Care Personnel: Recommendations from the National Tuberculosis Controllers Association and CDC on May 17, 2019.  These revised recommendations update those published in year 2005. 

The goal in healthcare is to provide early identification and prophylactic treatment of personnel who convert a TB skin test and prevent the spread of nosocomial TB within the facility. 

According to the CDC, health care personnel working in the U.S. are no longer considered at an increased risk for latent tuberculosis infection (LTBI) and TB disease from occupational exposures.  Based on these findings, routine serial TB testing at any interval after baseline in the absence of known exposure or ongoing transmission is no longer recommended.  

All ePHI that is created, received, maintained, or transmitted by an organization is subject to the HIPAA Security Rule. What is the HIPAA Security Rule exactly? “The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity.” https://www.hhs.gov/hipaa/for-professionals/security/index.html

It’s no secret that HIPAA regulatory compliance can be very time consuming and substantially increase costs. Confusing, obtuse regulations written in difficult to understand language can be bewildering and overwhelming for healthcare organizations, especially small to midsize organizations with limited management resources. HIPAA compliance is no exception. According to the Office of Civil Rights, covered entities must make a ‘good faith effort’ in the following areas of compliance: 1) Recent Security Risk Assessment; 2) Active Risk Management Process (Work Plan); 3) Current policies and procedures for protection of patient data; 4) Signed Business Associate Agreements; and 5) Employees having been trained within the last year.

A recent study in the Journal of the American Medical Association showed that over half of data breaches are caused by internal issues – many of which are directly related to a lack of effective employee training. You can read more about the recent study at https://www.hcinnovationgroup.com/cybersecurity/news/13030905/study-internal-negligence-not-hackers-responsible-for-half-of-data-breaches. Clearly employee training should not be taken lightly.

We get a lot of questions from our clients and thought we would share some of the most frequent with you:

Q. When can we say we are HIPAA compliant?
A. We get this question a lot. There is no definitive answer on this. However, based on what we see from the Office of
Civil Rights, an organization will be considered HIPAA compliant if they make a “good faith” effort, which would
generally, include the following:

As we approach the end of the year, please be sure your entire team has satisfied continuing
education (CE) requirements. The Board of Dentistry requires strict compliance. Additionally, verify that the dental licenses are current. Failure to maintain a current license is a costly mistake that has a negative impact on your team member and you.

Display the dental licenses in a conspicuous place as required by the board. In this manner, you can ascertain that the licenses are current. Calendar the renewal dates to ensure that there is no lapse. Otherwise, maintain a spreadsheet with everyone’s names and renewal dates.

Business Associate Agreements (BAAs) are a very important requirement of HIPAA compliance and should not be overlooked.  Organizations have gotten into trouble because of lack of a BAA and Business Associates (BAs) are quite often the source of breaches.  This tip is written from the point of view of a Covered Entity, although the same concepts apply to BAs as well (Note: a BA can also have a BA! This is called a “downstream” BA – see below.)

Many people believe that a HIPAA breach automatically leads to investigations and fines.  This is not necessarily the case. The purpose of the HIPAA Security Rule and the goal of HIPAA compliance is to position your organization to minimize the chance of a breach and to properly deal with a breach if one occurs.  That said, it is impossible to eliminate all possibility of a breach. For example, the actions of your employees and Business Associates are completely out of your control. Again, HHS (Health & Human Services) and the OCR (Office for Civil Rights) are not expecting perfection.  In fact, it is estimated that if you have 10,000 records in your office, chances are 1 in 3 that you will have a breach – so odds are you will have one sooner or later. This article is designed to examine security incidents and breaches and determine how to deal with them.

This article provides useful tips for HIPAA security officers. As a HIPAA security officer, you can divide your list of tasks into two categories: “ad-hoc” tasks and maintenance tasks. Examples of dealing with “ad-hoc” tasks include remediating gaps
identified on a Risk Assessment and dealing with a security incident. There are also maintenance tasks that must be performed on a regular basis. One example is tracking Employee Training. Another maintenance task example is a vulnerability scan.

The key to having confidence in your compliance program is preparation. This article is designed to help you prepare for an OSHA visit. The Occupational Safety and Health Administration (OSHA) is an agency of the U.S. Department of Labor. Tennessee OSHA is an agency of the Tennessee Department of Labor and Workforce Development. In addition to Tennessee, there are other states who have OSHA-approved State Plans. (1)

There are different types of audits:

Many dental offices are scrambling to achieve OSHA compliance with the recent announcement of random audits as part of TOSHA’s Local Emphasis Program. Numerous dental offices across the state of Tennessee have been randomly audited. There has been much confusion and quite a bit of stress resulting.

This article explores common violations we commonly see in dental offices in Tennessee. We hope you will find this information helpful in closing the gaps in your compliance program.

Effective October 1, 2017, all dentists licensed in Tennessee will be subject to a random OSHA inspection. This is part of the Local Emphasis Program.

According to OSHA, they analyzed data collected over a 10-year period. The results indicate that 319 serious hazards were identified with an average of 11.8 per facility. The Local Emphasis Program will focus primarily on exposure to blood and other potentially infectious materials and exposure to hazardous chemicals. Each year, the OSHA area offices will be expected to inspect at least five (5) dental offices and this includes offices with less than ten (10) employees.

Millions of dollars are spent on costly HIPAA settlements due to violations and a lack of compliance.  Overlooking risk can result in a security breach.  

Covered entities are required to not only make a security risk assessment to safeguard the electronic protected health information (ePHI) but also to act on those assessments.  This article explores the maintenance of computer logs and how this procedure can detect an unauthorized access.

Keep it Real:
How to Avoid HIPAA Marketing Scams
By Olivia Wann, JD

Has your dental office received a phone call stating the following: “My name is XX. I’m calling your office today to conduct your mandatory HIPAA Security Risk Assessment that’s required by the Department of Health and Human Services…”

We have received a number of support calls from dental offices regarding the Section 1557 compliance. If you accept Medicaid, Medicare Advantage and/or received funding under the HITECH Act, please read this letter carefully.

Section 1557 of the Affordable Care Act protects individuals from discrimination in health care based on race, color, national origin, age, disability and sex including pregnancy, gender identity, and sex stereotyping.

A critical component of a dental office’s HIPAA compliance program is obtaining business associate agreements from their business associates. A business associate is a person or an entity that provides services for the covered entity (dental office) involving protected health information (PHI) and electronic protected health information (ePHI).

Examples of business associates include electronic claims vendors, information technicians (IT), practice management software companies, appointment confirmation companies, marketing companies, trainers, consultants, bookkeepers, accountants, lawyers and others.