In the Medicare Claims Processing Transmittal 2903, April 2014 Update of the Hospital Outpatient Prospective Payment System (OPPS), CMS discusses the current policy regarding billing for certain devices that are received by facilities at no cost, full credit, or partial credit.
You hear it over and over again. Covered Entity (CE) A failed to produce an ongoing risk assessment for HIPAA security compliance. CE B had an incomplete risk analysis, leading to a failure to recognize security weaknesses and vulnerabilities. And in come the fines.
Watch out, HIPAA privacy and security officers. The criminals are coming, and they want to make money off of PHI your organization stores. It's one more thing to add to the growing list of compliance concerns covered entities (CE) and business associates (BA) have to worry about when protecting internal PHI.
