Process
HIPAA implementation involves following 6 step process
- Establish need for HIPAA
- Risk assessment
- Create privacy policies
- Create security procedures
- Sign BA agreements
- Train employees
HIPAA Privacy and Security Officer
For a smaller practice, your Privacy and Security Officer may be the same person. For larger practices, these duties will probably be split between two people. These are the folks who are going to be spearheading your Compliance Plan. If you don?t have someone designated to fill this role, you are not compliant.
For risk assessment, review your workplace and electronic devices to assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI) held by the Covered Entity or Business Associate.
You can perform the Assessment yourself or hire an outside contractor to come in and complete the process for you. If you're thinking about performing the assessment yourself, HHS has developed a Risk Assessment tool to help you get started. However, in almost all cases, to avoid confusions and achieve greatest accuracy, it is advised to use services of HIPAA implementation partners such as Valency Networks.
After completing your Risk Assessment, it?s time to create your blueprint for achieving HIPAA Compliance. The Compliance Plan should include Policies and Procedures - ensuring the Privacy of Protected Health Information and the Security of such information. The Security Policies and Procedures deal with ePHI (electronic PHI) and how you will protect that information. Policies and Procedures need to be updated regularly and any changes need to be clearly documented and communicated to your staff.
Most of you use vendors or contractors to help run your practice or business. Under HIPAA, persons or entities outside your workforce who use or have access to your patient?s PHI or ePHI in performing service on your behalf are ?Business Associates? and hold special status in the Privacy equation. Make sure you do an audit of your Business Associates before you accept a signed Agreement from them. We?ve seen a lot of folks sign these Agreements, and have no clue what they?ve agreed to. Auditing means looking at their Compliance Plan. They have to have one, or you can?t do business with them.
You need to annually train your employees on the HIPAA Rule and communicate information about your Privacy and Security Policies and Procedures that you?ve worked so hard to create. What good is all the work you?ve done on a Compliance Plan when no one knows about it, or how to use it? Train employees both on the HIPAA Law and your specific plan. In addition, you must keep records that they have been trained.
