HIPAA compliance requires special focus and effort as failure to comply carries significant risk of damage and penalties. A practice with multiple separate systems for patient scheduling, electronic medical records, and billing, requires multiple separate HIPAA management efforts. This article presents an integrated approach to HIPAA compliance and outlines key HIPAA terminology, principles, and requirements to help the practice owner to ensure HIPAA compliance by medical billing service and software vendors.
The last decade of the previous century witnessed accelerating proliferation of digital technology in health care, which, along with reduced costs and greater service quality, introduced new and greater risks for accidental disclosure of personal health information.
The Health insurance Portability and Accountability Act (HIPAA) was passed in 1996 by Congress to establish national standards for privacy and security of personal health data. The Privacy Rule, written by the US Department of Health and Human Services took effect on April 14, 2003.
Failure to comply with HIPAA risks accreditation and reputation damage, lawsuits by federal government, financial penalties, ranging from 0 to 0,000, and imprisonment, ranging from one year to ten years.
Protected Health Information (PHI)
The key term of HIPAA is Protected Health Information (PHI), which includes anything that can be used to identify an individual and any information shared with other health care providers or clearinghouses in any media (digital, verbal, recorded voice, faxed, printed, or written). Information that can be used to identify an individual includes:
Name Dates (except year) Zip code of more than 3 digits, telephone and fax numbers, email Social security numbers Medical record numbers Health plan numbers License numbers Photographs
Information shared with other healthcare providers or clearinghouses
Nursing and physician notes
Billing and other treatment records
Principles of HIPAA
HIPAA intends to allow smooth flow of PHI for healthcare operations subject to patient's consent but prohibit any flow of unauthorized PHI for any other purposes. Healthcare operations include treatment, payment, care quality assessment, competence review training, accreditation, insurance rating, auditing, and legal procedures.
HIPAA promotes fair information practices and requires those with access to PHI to safeguard it. Fair information practices means that a subject must be allowed
Access to PHI,
Correction for errors and completeness, and
Knowledge of others who use PHI
Safeguarding of PHI means that the persons that hold PHI must
Be accountable for own use and disclosure
Have a legal recourse to combat violations
HIPAA Implementation Process
HIPAA implementation begins upon making assumptions about PHI disclosure threat model. The implementation includes both pre-emptive and retroactive controls and involves process, technology, and personnel aspects.
A threat model helps understanding the purpose of HIPAA implementation process. It includes assumptions about
Threat nature (Accidental disclosure by insiders? Access for profit? ),
Source of threat (outsider or insider?),
Means of potential threat (break in, physical intrusion, computer hack, virus?),
Specific kind of data at risk (patient identification, financials, medical?), and
Scale (how many patient records threatened?).
HIPAA process must include clearly stated policy, educational materials and events, clear enforcement means, a schedule for testing of HIPAA compliance, and means for continued transparency about HIPAA compliance. Stated policy typically includes a statement of least privilege data access to complete the job, definition of PHI and incident monitoring and reporting procedures. Educational materials may include case studies, control questions, and a schedule of review seminars for personnel.
Technology Requirements for HIPAA Compliance
Technology implementation of HIPAA proceeds in stages from logical data definition to physical data center to network.
Role Based Access Control (RBAC)
RBAC improves convenience and flexibility of systems management. Greater convenience helps reducing the errors of commission and omission in granting access privileges to users. Greater flexibility helps implement the policy of least privilege, where the users are granted only as much privileges as required for completing their job.
RBAC promotes economies of scale, because the frequency of changes of role definition for a single user is higher than the frequency of changes of role definitions across entire organization. Thus, to make a massive change of privileges for a large number of users with same set of privileges, the administrator only makes changes to the role definition.
Hierarchical RBAC further promotes economies of scale and reduces the likelihood of errors. It allows redefining roles by inheriting privileges assigned to roles in the higher hierarchical level.
RBAC is based on establishing a set of user profiles or roles according to responsibilities. Each role has a predefined set of privileges. The user acquires privileges by receiving membership in the role or assignment of a profile by the administrator.
Every time when the definition of the role changes along with the set of privileges that is required to complete the job associated with the role, the administrator needs only to redefine the privileges of the role. The privileges of all of the users that have this role get redefined automatically.
Similarly, if the role of a single user is changed, the only operation that needs to be performed is the reassignment of the user profile, which will redefine user's access privileges automatically according to the new profile.
Summary
HIPAA compliance requires special practice management attention. A practice with multiple separate systems for scheduling, electronic medical records, and billing, requires multiple separate HIPAA management efforts. An integrated system reduces the complexity of HIPAA implementation. By outsourcing technology to a HIPAA-compliant vendor of vericle-like technology solution on an ASP or SaaS basis, HIPAA management overhead can be eliminated (see companion papers on ASP and SaaS for medical billing).
Electronic Medical Billing Software, HIPAA Compliance, and Role Based Access Control Check For The New Release in Health, Fitness & Dieting Category of Books NOW!
Check What Are The Top Cooking Books in Last 90 Days Best Cheap Deal!
Check For Cookbooks Best Sellers 2012 Discount OFFER!
Check for Top 100 Most Popular Books People Are Buying Daily Price Update!
Check For 100 New Release & BestSeller Books For Your Collection
Know any health care providers who complain about shrinking insurance payments and increasing audit risk? Help them learn winning Internet strategies for the modern payer-provider conflict by steering them to Vericle - Medical Billing Network and Practice Management Software, which powers such leading-edge billing services as Billing Precision (http://www.chiro-billing.com), Billing Dynamix (http://www.pt-billing.com), and Affinity Billing, and is home for "Medical Billing Networks and Processes" book by Yuval Lirov, PhD and inventor of patents in artificial intelligence and computer security.
