HIPAA breaches haven't become less common. If the law was, in part, meant to reduce the amount of PHI released to unauthorized individuals, some may say its success is uncertain. HIPAA's requirements aren't prohibitively stringent: they provide a basic floor of privacy and security. If a covered entity (CE) or business associate (BA) does no more than comply with HIPAA, it will simply be doing the bare minimum to safeguard PHI. Although that may not sound difficult, some organizations continue to fall short and leave others wondering if HIPAA is enough to meet today's information security and privacy challenges.
Much of today's healthcare industry is reliant on third-party vendors. If you haven't asked your vendors whether they are compliant with HIPAA and have implemented sound information privacy and security programs, you are likely facing unknown?and possibly significant?risks. Covered entities (CE) and business associates (BA) are required by HIPAA to exercise due diligence when it comes to their BAs and BA subcontractors. Assessing the risk of those vendors is necessary, especially if those vendors support critical functions in support of CE operations.
Q: I recently received a customer satisfaction survey from a medical supply company. The survey was printed on a postcard, not enclosed in an envelope. The survey is generic and doesn't include information about what services or supplies were received, but it does show my name and address and the name of the company. Anyone looking at it could know, or assume, that I received medical supplies. I don't feel this is appropriate, but I'm not sure if this is a HIPAA concern.
Opening the lines of communication between clinicians and specialists to make care more efficient can be a sizable challenge.
At many facilities, hospitalists shuttle from floor to floor to see patients, each time trying to track down the nurse and other professionals working on each case. Information is typically transferred through an inefficient system of pages and phone calls, sometimes taking hours at a time to deliver crucial pieces of information.
Enter the accountable care unit, a new way of configuring care systems that can help to uncoil tangled communication wires between clinicians and support staff to provide care that is more efficient and streamlined.
In this model, hospitalists work with patients in a specified geographical area of the hospital in conjunction with interdisciplinary teams.
Having patients in one area helps make care more efficient, and as one hospital system in New Mexico learned, can also reduce length of stay and increase cost-efficiency.
Regionalization of hospitalist patients is becoming more common today, because of the benefits it's been shown to bring, says Stefani Daniels, RN, MSNA, ACM, CMAC, founder and managing partner of Phoenix Medical Management in Pompano Beach, Florida. Those benefits include:
Improved teamwork, care coordination, and communication
Fewer readmissions
Improved resource management to lower cost of care
Improvements in patient satisfaction
Reduction in inefficiencies
"I'm pushing accountable care units at all my hospital clients," says Daniels. But while the will is there in many cases to make the change, it's not always an easy conversion.
Sometimes these initiatives face pushback from physicians concerned about personnel or scheduling issues.
Other challenges include:
The lack of diagnostic diversity that results from having set teams on a unit
The challenge of deciding whether teams should be flexible or static
Hammering out logistical issues, such as how patients should be triaged and how beds are managed
With only 60 days between the OPPS final rule's release and the January 1 implementation date, providers will be ahead of the curve by spending time now and thinking about the processes they may need to review, change, or implement based on what CMS finalizes and the sort of financial impact the final rule is likely to have.
