Idaho Non-Profit Agrees to Pay $50,000 for HIPAA Violation
01/03/2013 –In a first of its kind settlement, a non-profit medical facility in Idaho will pay the U.S. Department of Health and Human Services (HHS) $50,000 for HIPAA violations surrounding potential exposure of patient information.
The settlement is the first involving a breach of electronic protected health information affecting fewer than 500 individuals.
“This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients’ health information.” said OCR Director Leon Rodriguez in an HHS press release published Wednesday.
In February 2010, Hospice of North Idaho (HONI) reported to HHS that an unencrypted laptop containing information on 441 patients was stolen from inside an employee’s car.
An OCR investigation found that HONI had no policies or procedures in regard to mobile device security as required by HIPAA. Additionally, HONI had never done any type of electronic protected health information risk analysis.
The laptop was never recovered.
When a breach impacts more than 500 individuals, companies are required tonotify all major media outlets in their state, as well as the government. A notice is included on the Department of Health and Human Services Web site in accordance with the Health Information Technology for Economic and Clinical Health (HITECH) Act.
For breaches that affect fewer than 500 people, organizations keep a log that is turned in to the Secretary of Health and Human Services annually.
In addition to the fine, the December 28th agreement includes a two-year corrective action plan that mandates that the facility immediately report any future breaches to HHS.
“The theft of the laptop was out of our hands, but the measures we have taken since then to ensure the security and privacy of our patients’ information have been numerous,” Brenda Wild, Hospice of North Idaho Board President said in a written statement.
Since the incident, the facility has increased security on any equipment that contains patient information, including encryption and increased password protection, and scheduled security training.
HONI’s staff of more than 100 people is North Idaho’s only inpatient hospice facility. The organization serves members of the community regardless of their ability to pay.
It’s here…Therap’s first South Carolina Regional Conference!
The conference will be a good place for prospective users to learn about individual support documentation and reporting, electronic health records (EHR) and training management. Event highlights will include:
- Hands-on training on different Therap modules including incident reports, health tracking and billing (see below)
- Sessions focused on implementation and effective use
- User presentations, brainstorming and discussions
- User group meeting and discussions
The conference will be especially beneficial for Therap users in South Carolina and agencies from surrounding states would also find it useful.
Registration Fee: $100
Register by March 30, 2013 for the Early Bird
Discount and pay $80 only!
Holiday Inn & Suites Columbia-Airport
110 McSwain Drive
West Columbia, South Carolina 29169
Phone: (803) 391-4000
Note: Ask the hotel for the Therap Block Rate of $99.00+Tax
(Includes hot breakfast buffet and complimentary Airport Shuttle
service to/from airport 4am-11pm daily)
In preparation for Therap Services pre-conference meetings on Monday, some of us came in early on Sunday to catch the Superbowl at a local Sports Bar-Redds, right across the street from the Met-Life Stadium where the Giants and Jets play! It was sweet victory for New York and very exciting to be in the middle of it all!
We had a great conference with around 350 attendees, 3 days of over 35 sessions including: Basic to Advanced User sessions, Provider Organizations Special Topic sessions and Brainstorming with Therap Programmers!
Of course, being New York, we always take a trip to “The City” and what a great time of eating pizza, walking around Manhattan to look at the sites!
If you missed it, you can still get to one of our Regional Conferences this year. Check out when we are coming to a town near you!
September 21st & 22nd, Florida ARF and Respect of Florida celebrated their Annual Meeting in Clearwater Beach Florida.
As a Gold Sponsor of FARF, Therap Services Exhibited our product and I gave a brief presentation on the status of Therap working with the Agency for Persons with Disabilities, to test the export data from Therap to the Florida APD CCR system. The number of organizations using Therap in Florida continues to grow with many organisations coming from FARF membership. These provider agencies share with each other the tremendous benfits and positive experiences using Therap, and so, we continuento grow from Coast to Coast. An additonal benefit for FARF members, is a 15% discount off of the List Price. In financially challenging times like this, with Therap already being so affordable and saving providers time & money, this is a fantastic deal! So, give me a call or come visit me at our next meeting.
Barry Pollack 386-212-3201 firstname.lastname@example.org www.therapservices.net
Check out this Webinar in Justin’s Blog about “Unification” and tracking outside referrals made from Service Coordinators, Case Managers, Etc. This release makes Therap functionality very good for Coordinating Services and Referrals and includes some nice new Admin features as well. It is very cool!!!
For Immediate Release:
|Tuesday, July 13, 2010|
|Contact:||CMS Office of Public Affairs
SECRETARY SEBELIUS ANNOUNCES FINAL RULES TO SUPPORT MEANINGFUL USE OF ELECTRONIC HEALTH RECORDS
Secretary Sebelius Announces Final Rules To Support
‘Meaningful Use’ of Electronic Health Records
WASHINGTON – U.S. Department of Health and Human Services Secretary Kathleen Sebelius today announced final rules to help improve Americans’ health, increase safety and reduce health care costs through expanded use of electronic health records (EHR).
“For years, health policy leaders on both sides of the aisle have urged adoption of electronic health records throughout our health care system to improve quality of care and ultimately lower costs,” Secretary Sebelius said. “Today, with the leadership of the President and the Congress, we are making that goal a reality.”
Under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, eligible health care professionals and hospitals can qualify for Medicare and Medicaid incentive payments when they adopt certified EHR technology and use it to achieve specified objectives. One of the two regulations announced today defines the “meaningful use” objectives that providers must meet to qualify for the bonus payments, and the other regulation identifies the technical capabilities required for certified EHR technology.
Announcement of today’s regulations marks the completion of multiple steps laying the groundwork for the incentive payments program. With “meaningful use” definitions in place, EHR system vendors can ensure that their systems deliver the required capabilities, providers can be assured that the system they acquire will support achievement of “meaningful use” objectives, and a concentrated five-year national initiative to adopt and use electronic records in health care can begin.
“This is a turning point for electronic health records in America, and for improved quality and effectiveness in health care,” said David Blumenthal, M.D., National Coordinator for Health Information Technology. “In delivering on the goals that Congress called for, we have sought to provide the leadership and coordination that are essential for a large, technology-based enterprise. At the same time, we have sought and received extensive input from the health care community, and we have drawn on their experience and wisdom to produce objectives that are both ambitious and achievable.”
Two companion final rules were announced today. One regulation, issued by the Centers for Medicare & Medicaid Services (CMS), defines the minimum requirements that providers must meet through their use of certified EHR technology in order to qualify for the payments. The other rule, issued by the Office of the National Coordinator for Health Information Technology (ONC), identifies the standards and certification criteria for the certification of EHR technology, so eligible professionals and hospitals may be assured that the systems they adopt are capable of performing the required functions.
As much as $27 billion may be expended in incentive payments over ten years. Eligible professionals may receive as much as $44,000 under Medicare and $63,750 under Medicaid, and hospitals may receive millions of dollars for implementation and meaningful use of certified EHRs under both Medicare and Medicaid.
The CMS rule announced today make final a proposed rule issued on Jan, 13, 2010. The final rule includes modifications that address stakeholder concerns while retaining the intent and structure of the incentive programs. In particular, while the proposed rule called on eligible professionals to meet 25 requirements (23 for hospitals) in their use of EHRs, the final rules divides the requirements into a “core” group of requirements that must be met, plus an additional “menu” of procedures from which providers may choose. This “two track” approach ensures that the most basic elements of meaningful EHR use will be met by all providers qualifying for incentive payments, while at the same time allowing latitude in other areas to reflect providers’ needs and their individual path to full EHR use.
“CMS received more than 2,000 comments on our proposed rule,” said Marilyn Tavenner, Principal Deputy Administrator of CMS. “Many comments were from those who will be most immediately affected by EHR technology – health care providers and patients. We carefully considered every comment and the final meaningful use rules incorporate changes that are designed to make the requirements achievable while meeting the goals of the HITECH Act.”
Requirements for meaningful use incentive payments will be implemented over a multi-year period, phasing in additional requirements that will raise the bar for performance on IT and quality objectives in later years. The final CMS rule specifies initial criteria that eligible professionals (EPs) and eligible hospitals, including critical access hospitals (CAHs), must meet. The rule also includes the formula for the calculation of the incentive payment amounts; a schedule for payment adjustments under Medicare for covered professional services and inpatient hospital services provided by EPs, eligible hospitals and CAHs that fail to demonstrate meaningful use of certified EHR technology by 2015; and other program participation requirements.
Key changes in the final CMS rule include:
Greater flexibility with respect to eligible professionals and hospitals in meeting and reporting certain objectives for demonstrating meaningful use. The final rule divides the objectives into a “core” group of required objectives and a “menu set” of procedures from which providers may choose any five to defer in 2011-2012. This gives providers latitude to pick their own path toward full EHR implementation and meaningful use.
- An objective of providing condition-specific patient education resources for both EPs and eligible hospitals and the objective of recording advance directives for eligible hospitals, in line with recommendations from the Health Information Technology Policy Committee.
- A definition of a hospital-based EP as one who performs substantially all of his or her services in an inpatient hospital setting or emergency room only, which conforms to the Continuing Extension Act of 2010
- CAHs within the definition of acute care hospital for the purpose of incentive program eligibility under Medicaid.
CMS’ and ONC’s final rules complement two other recently issued HHS rules. On June 24, 2010, ONC published a final rule establishing a temporary certification program for health information technology. And on July 8, 2010 the Office for Civil Rights announced a proposed rule that would strengthen and expand privacy, security, and enforcement protections under the Health Insurance Portability and Accountability Act of 1996.
As part of this process, HHS is establishing a nationwide network of Regional Extension Centers to assist providers in adopting and using in a meaningful way certified EHR technology.
“Health care is finally making the technology advances that other sectors of our economy began to undertake years ago,” Dr. Blumenthal said. “These changes will be challenging for clinicians and hospitals, but the time has come to act. Adoption and meaningful use of EHRs will help providers deliver better and more effective care, and the benefits for patients and providers alike will grow rapidly over time.”
A CMS/ONC fact sheet on the rules is available at http://www.cms.gov/EHRIncentivePrograms/
Technical fact sheets on CMS’s final rule are available at http://www.cms.gov/EHRIncentivePrograms/
A technical fact sheet on ONC’s standards and certification criteria final rule is available at http://healthit.hhs.gov/standardsandcertification