Business Associate To-Do List

Business Associates are required to comply directly with
many of HIPAA’s Privacy and Security Rules. The list of tasks
begins by appointing a Security Official, and developing policies and
procedures that safeguard ePHI.

5010/D.0 Effective Date Tuesday, March 17, 2009; Compliance Date January 1, 2012

The version modification to the HIPAA Administrative Simplification transaction standards becomes effective next Tuesday, March 17, 2009. Here are several critical things to know, drawn directly from the final rule published in the Federal Register on January 16, 2009. The final rule is available for download on the HIPAA.com site.

New Director of Office of Recovery Act Coordination

Dennis Williams is the new Deputy Assistant Secretary of the Office of Recovery Act Coordination, charged with overseeing all ARRA activities for HHS.

One Week from Today: 5010/D.0 Final Rule Effective Date

They’re coming: the Ides of March (the 14th); NCAA Basketball Tournament Announcement (the 15th); St. Patrick’s Day (the 17th); and 5010/D.0 Final Rule Effective Date (the 17th). In short, now is the time to start your short- and long-term game plans for adopting new electronic business processes and adapting your workflows. HIPAA.com will provide resources to help you along the way.

Medicare Incentives for Physicians

This chart demonstrates incentives to physicians beginning in 2011. Physicians with an EHR already in place will be most skilled at completing reporting requirements. Physicians adopting in 2009 – 2010 will receive the largest payouts.

CMS Confirms 5010 and ICD-10 Rules’ Effective Dates

In notification to the U.S. House and Senate on Thursday, March 5, 2009, Don Johnson, Acting Director, Office of Legislation of the Centers for Medicare & Medicaid Services (CMS), notified the Congress that “[i]n accordance with the White House Chief of Staff’s memorandum of January 20, 2009 entitled ‘Regulatory Review,’ a determination has been made that the effective date will not be extended and the comment period will not be reopened for either of these rules.” The effective date for each of the rules is March 17, 2009. The memorandum CMS sent to Congress follows. Beginning next Monday, March 9, HIPAA.com will have a posting daily through March 17, 2009, related to the 5010 Final Rule. Earlier, this week, HIPAA.com outlined the Level 1 and Level 2 requirements of the 5010 rule.

Security Incident Procedures Response and Reporting: What to Do and How to Do It

The covered entity’s Security Official is responsible for identifying, containing, mitigating, and documenting a security incident. A security incident might be leaving electronic protected health information on a computer that is donated to a local organization. The Security Official would determine the extent of the damage that occurred if the electronic protected health information were accessed by unauthorized persons, and implement measures to mitigate the damage, such as immediately recovering the computer. The Privacy Official, if different from the Security Official, may be called in to help mitigate the breach, as a security incident is called in the Privacy Rule, if the breach results in an unauthorized disclosure of electronic protected health information.

What should you expect from your HIPAA Security Official?

Your security official’s primary task is to determine the organization’s risks, implement and monitor risks. You don’t need a degree in technology, but you must know what to do, when and to whom to delegate tasks, and keep your cool in case of emergencies.

keep looking »