Business Associates and HIPAA – The Basics

In the Business Associate Category, we will be discussing issues that surface as organizations develop business relationships with outside agents and vendors. Let’s start with some basics first -

The HIPAA Privacy Rule applies only to covered entities (health plans, healthcare clearinghouses, and certain healthcare organizations). However, most healthcare organizations and health plans do not carry out all of their healthcare activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses (Business Associates).

The Privacy Rule allows covered entities and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule. The satisfactory assurances must be in writing, whether in the form of a contract or other agreement between the covered entity and the business associate.

Aside from the obvious users of identifiable health information (hospitals, clinics, nursing homes etc.), others may be referred to as Business Associates (agents and vendors) that also come in contact with identifiable health information. For Business Associates, HIPAA requires hospitals, clinics, insurance companies and others that use agents and vendors to use a Business Associate Agreement. The regulation states –

PART 164—SECURITY AND PRIVACY
(Business associate contracts or other arrangements)

§ 164.314 Organizational requirements.
(a)(1) Standard: Business associate contracts or other arrangements.(2) Implementation specifications (Required).

(i) Business associate contracts. The contract between a covered entity and a business associate must provide that the business associate will—

(A) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the covered entity as required by this subpart;

(B) Ensure that any agent, including a subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect it;

(C) Report to the covered entity any security incident of which it becomes aware;

(D) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract… for complete regulation click here: http://www.hhs.gov/ocr/AdminSimpRegText.pdf

Watch for future posts on developing issues regarding Business Associates and the clients they serve.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us

Long-Term Care: Quality Training on Your Budget!

I recently read an interesting long-term care report on the topic of Driving for Quality in Long-Term Care: A Board of Directors Dashboard.

http://www.oig.hhs.gov/fraud/docs/complianceguidance/Roundtable013007.pdf

The report was the result of roundtable discussion involving 35 long-term care (LTC) professionals and 10 government representatives. The participants represented a wide spectrum of LTC organizations and professionals, including not-for-profit and for-profit organizations, multi-facility and single facility organizations, nationally and locally based organizations, clinicians, administrators, compliance officers, outside and corporate counsel, and monitors involved in OIG quality of care Corporate Integrity Agreements.

Breakout discussion groups were designed around three perspectives on the oversight of quality of care: (1) organizational commitment to quality; (2) processes related to monitoring and improving quality; and (3) outcome measures related to quality.

Some of the tools recommended to assist the board in evaluating these issues included:

  1. Promote Active Questioning by the Board – The board of directors needs to ask questions as to (1) why a quality problem occurred, and (2) what management is doing to fix the problem and to prevent it from happening again. Simply put, board members should not be afraid to ask difficult questions.
  2. Retain an Outside Expertise/Consultant – The board could engage an external expert or consultant to review the organization’s policies, procedures, and processes, as needed.
  3. Monitor Staff Training and Turnover – Lack of staff competency and high staff turnover could indicate that the organization’s processes are not adequate. Staff education should be provided on an ongoing basis due to staff turnovers and to ensure that the organization has trained, updated staff.

Based on my professional experience with long-term care organizations, I viewed the report as practical measures for board and management to effectively address organizational quality.

The idea of retaining outside expertise is another plus for the report, since consultants have the expertise to review organizational policies and procedures and in turn, share their findings and skills with the board and management.

Monitoring staff training and turnover caught my attention, since all too often training lacks the prioritization of other LTC business functions, yet training is the basis for quality care. To put training in perspective, imagine pilots, physicians or accountants lacking training or continuing education. Then apply that same concept to those who deal 24/7 with our loved ones.

The “Challenges and Opportunities” breakout group discussions related to broader issues of board of director involvement with quality of care and the use of a Quality of Care Dashboard. One of the challenges and opportunities suggested,  “Quality and financial data are interwoven. When a facility is having cash flow problems, the quality of care delivered may suffer. Similarly, care will suffer when there are insufficient funds for training, education, and staffing. Money and quality are two sides of the same coin. When board members are effectively monitoring the quality indicators at a facility, they will also be learning valuable information about the financial health of the entity” (emphasis added).

Bottom Line.
While it’s true that quality and financial data are generally interwoven, I see the opportunity for LTC board and management to engage consultants that are willing to partner in the goal of achieving quality, despite a tight budget – and that of course is the challenge.

Consultants can help to deliver compliance tools using Web-based programs that unify all locations and standardize such things as HIPAA policies & procedures, forms, required logs, reports, training and more.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us

HIPAA Security Training: A Flexible Approach

Whether your organization is an insurance company, hospital, clinic, dental group, elder-care facility or anything in between, security awareness and training is required of all members of its workforce (including management).

So how must healthcare organizations plan to meet the Security and Awareness Training Standard? As a first step, I often caution clients to review specific standards and the references made as a part of the standard – for example, §164.308, the Security Awareness and Training Standard must be read in conjunction with § 164.306 Security Standards: General rules, since the General Rules help the organization understand the general intent of the standards and guidance for implementing them. Take a look at the General Rules and see for example the guidance on a “Flexible Approach” -

§ 164.306 Security Standards: General Rules

(a) General requirements. Covered entities must do the following:
(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits.
(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under sub-part E of this part.
(4) Ensure compliance with this subpart by its workforce.
(b) Flexibility of approach. (Emphasis added)
(1) Covered entities may use any security measures that allow the covered entity to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.
(2) In deciding which security measures to use, a covered entity must take into account the following factors:
(i) The size, complexity, and capabilities of the covered entity.
(ii)The covered entity’s technical infrastructure, hardware, and software security capabilities.
(iii) The costs of security measures.
(iv)The probability and criticality of potential risks to electronic protected health information.

As you can see, the General Rules help answer the question…”We are a clinic and cannot afford a large scale training program like a hospital, what can we do?” By reading § 164.306 Security Standards: General Rules, healthcare organizations of any size will realize the “flexibility” built into the regulations are designed to accommodate healthcare operations of any size.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us