Help Me With HIPAA

Preventing ransomware is a major concern for every business today.  If not, it should be.  This episode covers understanding ransomware and methods for preventing it. Is ransomware a phi breach? April record number of cases and not slowing down 8 hospitals (more by the time we record) already hit. Training and vigilance is best defense Ransomware attacks continue to evolve to be "smarter"   For mo...

HIPAA policy and procedure templates seem to be a panacea to many people who are just trying to meet the standards and move on. However, these are not the droids you seek! Templates can be the basis for what you need to do but they shouldn't be the solution to the written policy and procedure requirements under HIPAA.   See HelpMeWithHIPAA.com/57

Two reasons for today's topic: A question we received from a listener about understanding antivirus software and a news report about a malware scan that interrupted a medical procedure. Between those two cases it felt like it was time to discuss malware protection under HIPAA. Suzie from Savannah: I would like to have a podcast or a quick answer to the different between anti-virus software release...

We always look at the security rule aspects of HIPAA because they deal with the easier parts for people to deal with when it comes to lowering their risk, but today we are diving into some privacy rule guidelines, because there is new HIPAA privacy guidance that has just been published. Get more info at HelpMeWithHIPAA.com/55

Recently, we ended up in several discussions about HIPAA access logs and what they really require with our clients. As per usual, any topic that comes up multiple times in my "real job" becomes a discussion for HMWH.  So, today we are talking about HIPAA access logs to attempt to clear up some confusion we have encountered.  There are multiple types of HIPAA access logs being created in most envir...

We talked about OCR audits recently because they are in the news. The audit protocol is a perfect guide for developing and maintaining your HIPAA compliance programs. In fact, the audits have been a hot topic in the industry this month. However, the fact that only 200 audits will take place really means the audit protocol is more important as a guide for what your program should look like in the e...

We really appreciate the support and feedback we have received for our little HIPAA podcast project known as Help Me With HIPAA.  This episode marks one complete year of weekly HIPAA podcasts (counting the special bloopers holiday episode).  We certainly learned a great deal since we started this little DIY project last year.  Granted, David was a convert to the idea much quicker than Donna.   Her...

We often talk about doing the "work" of compliance. Some people seem to have the attitude that all I need to do some is annual staff training and hand out a Notice of Privacy Practices to do small office HIPAA compliance. When we try to explain there is more to it than that we often get pushback about the requirements. We always hear comments like: we don't have time, we don't have resources, we c...

Every website needs security. What questions should you be asking about your business websites and who should you be asking?  Website security can be an open hole in your security plans.  It can also be the source of lots of problems for your business if you don't pay attention to the site content or securing your message. More info on the website at helpmewithhipaa.com/50

The recent release of the new OCR audit protocol gives us new guidance on what they expect from HIPAA compliance programs.  There is a great deal of information to sift through if you are so inclined.  To make it easier for you we are discussing some of the details and things we have learned from reviewing it for you! So, here is our review of the new OCR audit protocol! For more details go to our...

In the first episode in our Disaster Recovery series that we will be doing this year we are discussing planning disaster recovery plans for flooding.  This episode is an interview with Ginger McCleish who experienced a real world disaster recovery flooding in the St. Louis, MO area in December 2015. Hear more at HelpMeWithHIPAA.com/48

The latest HIPAA buzz is about things like Interoperability, Data Governance, Patient Access Rights, and, of course, OCR random audits.  Donna attended HIMSS and the National HIPAA Summit recently.  In this episode we discuss what kinds of things are happening in the industry relating to HIPAA. For more details visit our website at helpmewithhipaa.com/47

So far in 2016, we have seen four HIPAA enforcement cases resolved by OCR.  One involved only the second Civil Money Penalty ever assessed. The three others were resolution agreements.  Add those cases to what was done in 2015 and you have the most active 12 month period of HIPAA enforcement ever.  Certainly, the first quarter of 2016 has been the most active quarter ever when it comes to HIPAA en...

Many times people ask: Why do we need HIPAA?  Is HIPAA really necessary?  The short answer is yes, we do need HIPAA and the reason is without it there is no baseline for protecting patient privacy.   Learn more at http://helpmewithhipaa.com/45

Social media can be the source of many issues if you don't have a clear policy for use.  HIPAA social media policies requires some serious thought and commitment from your management staff.  What things are good use of social media and what things should be avoided through policy enforcement?   Read more about HIPAA Social Media Policies at our website: helpmewithhipaa.com/44

It is clear that HIPAA disaster recovery and business continuity plans should include some level of ransomware response planning after the attack that shut down Hollywood Presbyterian Hospital.  What kinds of issues should you expect and how can you mitigate the damage from a ransomware attack? Read more about our ransomware attack planning discussion on our website at helpmewithhipaa.com/43

To be certain you are protecting the health information in your organization you must identify where it lives and moves about around the network and workforce.  A risk analysis can't be done properly without making that list first. Where should you look for PHI?  If you don't store it do you store access TO it?  Get more information for this podcast at HelpMeWithHIPAA.com/42

Trust but verify is the new standard when it comes to Business Associate relationships today.  Yes, they must sign a BAA but you really need to ask some questions to confirm those BAs understand and are doing the things they have agreed to do for you. Covered Entities (CEs) haven't really worried about the details of the contracts too much as along as the vendors would sign them.  Many vendors hav...

Get all the details at HelpMeWithHIPAA.com/40

More notes and links on the website at HelpMeWithHIPAA.com/39

More details on our website   Also at the Atlanta's Most Trusted Advisors page : 

 Brittney Wilson, The Nerdy Nurse , joins us to discuss the clinical staff's HIPAA perspectives.   More details at helpmewithhipaa.com/38

More details at helpmewithhipaa.com/37

HIPAA may show up in areas you haven't seen before.  If you are assessed by any other organization or for any other reason, HIPAA questions may start showing up. We have heard about it being brought up in many areas: Insurance Policy Applications Partnership Negotiations Funding discussions URAC accredidation (formerly known as the Utilization Review Accreditation Commission) This episode is a dis...

ID Experts is in the business of dealing with privacy breaches.  They have a variety of incident response services and tools. We discuss breach topics with Jeremy Henley, Director of Breach Services, ID Experts in today's episode.   Detailed notes from the show can be found on our website  at helpmewithhipaa.com/35