Q: As part of the audit controls policy at my organization, we hired an external security vendor to collect and review logs from several critical servers. The vendor creates tickets for our IT staff when a potential incident is discovered during the daily log review. This supplements our own activity reviews of internally generated reports, and the vendor then uses them for its own review. Our internal staff never sees the reports the vendor uses for its review. Do the reports the vendor uses fall under the HIPAA requirement for retaining logs for six years? Should we compel the vendor to retain these reports?
The Office for Civil Rights (OCR) announced December 8, 2014 that it fined an Alaska behavioral health service $150,000 for potential HIPAA violations. OCR entered into a resolution agreement with Anchorage Community Mental Health Services (ACMHS), a nonprofit behavioral healthcare service, per the announcement (see www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/acmhs/amchs-capsettle...).
Many hospitals and health systems include computer-assisted coding (CAC) systems as a strategic tool in their plan for ICD-10. CAC software is considered an antidote to the significant decrease in coder productivity anticipated with ICD-10.
The ICD-10 delay forced many healthcare organizations to rethink their ICD-10 staffing and implementation plans. Baptist Health System in Birmingham, Alabama, devised a plan to prepare for the one-year delay of ICD-10 by revising its budget and relying on new graduates to fill coder positions.
