Small- to medium-size clinics often operate under the assumption that their outsourced IT shop or managed services provider (MSP) is providing a robust security solution, but this is not always the case. MSPs aren't necessarily falling down on the job, though; remember that just because something is outsourced doesn't mean the vendor will manage all of the risk. In the end, if you want additional services from your MSP, it costs money. RapidFire Tools® offers a solution MSPs can use to address risks that many small- to medium-size clinics may falsely assume are already managed.
Q: I work at a pediatric practice, and we receive a lot of holiday cards from our patients, many of which feature family photos. We hang them up because the patients love to see themselves displayed in our lobby. We have reached out to a HIPAA security officer at a nearby hospital who told us it is not a HIPAA violation to display holiday cards received from patients. Is this accurate?
Q: If someone calls a facility to schedule an appointment for a patient, is it a violation of HIPAA to admit the patient receives care at the practice? For example, the practice where I work often helps victims of domestic abuse.
The September 22, 2014, deadline to revise business associate agreements (BAA) may have seemed like a date far in the future when the HIPAA omnibus final rule was released January 25, 2013. However, this compliance date is now in our rearview mirror as we continue to move along the road toward establishing and maintaining compliance with the HIPAA Privacy Rule and Security Rule.
1. Phase 2 of OCR's HIPAA audits will be desk audits, which means OCR will not conduct on-site audits of covered entities (CE) and business associates (BA) unless resources are available.
