OCR in 2013, through the Health Information Technology for Economic and Clinical Health (HITECH) Ac,t issued a final rule identifying provisions of the HIPAA rules that apply directly to business associates (BA) and those provisions for which BAs are directly liable.
HIPAA training is required by the HIPAA rules, under § 164.530, Administrative requirements. But just because it’s required doesn’t mean it has to be repetitive, boring, or unappealing. There are ways to make your healthcare staff excited about HIPAA training. At the very least, you can do your part to make sure they’re engaged.
According to the 2019 edition of IBM Security and Ponemon Institute’s annual Cost of a Data Breach Report, data breaches cost the healthcare sector an average of 65% more per record than they cost any other industry.
Q: We still use a color-coded filing system at my organization that uses specific colors to identify patient types, like whether an individual is a Medicaid/CHIP patient. These files are mostly used for billing documentation. Because the colors identify patient type, would this be considered a HIPAA violation?