Q: I am currently working on a social media usage policy for the organization where I work. I often notisce that some of my friends in the healthcare industry will post about patients on social media website.
1. Phase 2 of OCR's HIPAA audits will be desk audits, which means OCR will not conduct on-site audits of covered entities (CE) and business associates (BA) unless resources are available.
A mobile workforce in the healthcare industry presents a unique set of HIPAA privacy and security challenges. As the number of large HIPAA breaches increases and OCR ramps up audits, organizations cannot afford to risk their bottom line and reputation by failing to protect patient privacy and security.
Q: Are there any penalties for sending an unencrypted email containing PHI to the intended recipient? Would this just be a violation of the CE's policy and not a privacy breach under HITECH?
The OCR continues to crack down on HIPAA breaches, but it also paused to take a look back at past incidents in two annual reports to Congress. The reports, which were released in May, summarize the reported 2011?2012 HIPAA breach and compliance activities as required by the HITECH Act. Although the data presented in the reports details the events from prior years, the causes of the breaches reported to and investigated by OCR are still relevant?and problematic?for healthcare organizations today.
