Q: I recently received a customer satisfaction survey from a medical supply company. The survey was printed on a postcard, not enclosed in an envelope. The survey is generic and doesn't include information about what services or supplies were received, but it does show my name and address and the name of the company. Anyone looking at it could know, or assume, that I received medical supplies. I don't feel this is appropriate, but I'm not sure if this is a HIPAA concern.
Much of today's healthcare industry is reliant on third-party vendors. If you haven't asked your vendors whether they are compliant with HIPAA and have implemented sound information privacy and security programs, you are likely facing unknown?and possibly significant?risks. Covered entities (CE) and business associates (BA) are required by HIPAA to exercise due diligence when it comes to their BAs and BA subcontractors. Assessing the risk of those vendors is necessary, especially if those vendors support critical functions in support of CE operations.
HIPAA breaches haven't become less common. If the law was, in part, meant to reduce the amount of PHI released to unauthorized individuals, some may say its success is uncertain. HIPAA's requirements aren't prohibitively stringent: they provide a basic floor of privacy and security. If a covered entity (CE) or business associate (BA) does no more than comply with HIPAA, it will simply be doing the bare minimum to safeguard PHI. Although that may not sound difficult, some organizations continue to fall short and leave others wondering if HIPAA is enough to meet today's information security and privacy challenges.
If your hospital resides in one of the 67 metropolitan statistical areas (MSA) required to participate in the Comprehensive Joint Replacement Model (CJR), you will also be required to participate in a new orthopedic payment model called 'SHFFT' (surgical hip and femur fracture treatment) if an August 2 proposed rule is finalized. The impact? The following assigned MS-DRGs will no longer define hospital reimbursement:
Major Joint Replacement or Reattachment of Lower Extremity (MS-DRGs 469, 470)
Hip and Femur Procedures Except Major Joint (MS-DRGs 480, 481, 482)
Hospitals got a last-minute reprieve from the Medicare Outpatient Observation Notice (MOON) notification requirement, which was set to go into effect August 6. Citing the need for additional time to revise the standardized notification form that hospitals will need to use to notify patients about the financial implications of being assigned to observation services, CMS moved back the start date for the requirement in the 2017 IPPS final rule to 'no later than 90 days,' after the final version of the form is approved (www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/...).
