There have been over 90,000 HIPAA breaches with 126,472 complaints investigated, and 572 cases referred to the Department of Justice. The already high number of possible violations increased thanks to the HITECH act.
HIPAA HITECH compliance requirements are intentionally vague so they can apply to a variety of businesses. Those who don't understand them are more likely to get in trouble due to an unintentional breach.
Ignorance is never a sufficient defense, so you must learn how to remain compliant now. Read on to learn 5 things you need to know about the HIPAA HITECH act and how it affects your business.
2. All Businesses Need HIPAA HITECH Compliance
3. HIPAA HITECH Act Compliance Checklist
4. Benefits of HITECH Compliance
5. Consequences of HITECH Noncompliance
1. HIPAA vs. HITECH
Both of these regulations help keep patient data secure and accessible. It's important to understand the differences between the two so you can comply with both.
The most important addition of HITECH is the ability for patients to see where their personal information is going. It also added incentives for organizations that manage electronic data.
2. All Businesses Need HIPAA HITECH Compliance
There are several potential consequences of HITECH noncompliance in healthcare. Hefty fines, ruined reputations, and shutdowns are just a few examples.
Despite this, all organizations need to consider HITECH compliance. There are several types of organizations and different requirements for each.
One of the best ways to categorize a business is by how much PHI (personal healthcare information) they manage. Put in order from most to least data, the types include covered entities, business associates, and hybrid entities.
Covered Entities
Businesses like healthcare or health plan providers and healthcare clearinghouses work with PHI every day.
These types of businesses are known as covered entities. They must meet all HIPAA and HITECH compliance requirements to prevent the misuse of important data.
The only main exceptions are individual healthcare providers. The hospital or other larger organization they work for is considered the covered entity. It must maintain HIPAA HITECH compliance standards.
Business Associates
Lawyers, accountants, and IT professionals are just a few examples of businesses that provide essential services to covered entities.
Whenever their job requires the use of PHI, they're considered a business associate.
Even if business associates don't work for a healthcare company specifically, they would still be subject to HITECH standards if they use PHI. For example, lawyers may use hospital records in lawsuit cases.
Another unique requirement for business associates is that they must sign a BAA or Business Association Agreement with every covered entity they work with.
This legal document states which PHI they can access and how. It also states that they'll destroy or return the PHI when they're finished using it.
A BAA means a business associate must meet the same requirements as a covered entity. Violations such as not having one or failing to meet the necessary HIPAA HITECH compliance requirements could come with severe fines.
Hybrid Entities
Some businesses may provide their own health-related benefits. Examples include self-insured health coverage and an Employee Assistance Program or EAP.
These organizations are considered hybrid entities. They don't fully function as a covered entity or business associate but still manage PHI.
Due to the sensitive information they maintain, hybrid entities must maintain HITECH compliance or face severe consequences.
3. HIPAA HITECH Act Compliance Checklist
The three pillars of HIPAA HITECH compliance are the HIPAA laws, the HITECH Act, and the rules and requirements they mandate.
We've already discussed what HIPAA and HITECH are and how to tell them apart. Now it's time to go into the rules and requirements.
The Breach Notification Rule
- Determines when and how an organization must react if any patient's PHI is compromised
- Requires notifying patients within 30 days through email and physical mail
- Requires an annual report to the HHS
- Requires business associates to notify the covered entity they work with of any breaches
The Privacy Rule
- Limits how PHI can be used and when patient permission is required
- Requires maintaining up-to-date written permission forms before using PHI for marketing or research
- Requires organizations to train their employees on the proper requirements and maintain the integrity of all the PHI they manage
- Includes a component known as the Minimum Necessary Rule that states that organizations must only use the amount of PHI that's necessary
The Security Rule
- Regulates what organizations must do to protect PHI that's stored digitally
- Includes technical, physical, and administrative safeguards
The Omnibus Rule
- Relates to business associates
- Requires updated BAAs, privacy policies, and NPPs or notices of privacy practice
- Mandates documented staff training to familiarize them with the new rules
The Enforcement Rule is one of the most important. It regulates when and how a violation can be investigated and what the consequences may be.
Other requirements and rules exist depending on the type of organization you run and the data you manage. Knowing all of them is the best way to maintain HIPAA HITECH compliance.
4. Benefits of HITECH Compliance
No matter what type of business you work in, there are several potential benefits of maintaining compliance. These include but are not limited to:
- Easy, efficient communication
- Increased engagement between a company and its customers
- Easy reminders for payments, appointments, and other important changes
- Accurate, accessible records
- Improved security
HITECH compliance ensures your record-keeping, communication, and other important processes are as efficient and secure as possible. Any organization, whether a member of the healthcare field or not, can benefit from maintaining it.
5. Consequences of HITECH Noncompliance
Fines are the most common way to punish businesses that fail to meet HITECH compliance requirements. Their amount depends on factors such as the type of violation and whether it resulted from ignorance or intentional neglect.
When a business is unaware that it's committed a violation, the fines range from $100-$25,000 for each requirement they break in a year.
The numbers jump to $10,000-$250,000 per violation in cases of willful neglect. The maximum penalties an organization can face are $50,000 per violation with a total cap of $1.5 million.
The same consequences apply to other types of businesses as well. You must always ensure that your business meets all the relevant HITCH compliance requirements.
How to Get a HITECH Compliant Business Phone System?
HITECH compliance doesn't only help you avoid fines and other consequences. It also improves the quality and efficiency of your daily operations.
When you follow the requirements for managing PHI, you can do so faster and create a better reputation amongst your customers. Getting the best possible business phone system is one of the best ways to enjoy these benefits and more.
Check out our HIPAA HITECH compliant calling and texting services and contact us today for more information.
