A closer look at HIPAA: Part 2 -- Violations and their mitigation

In her first column, Lindy Benton of healthcare information exchange company MEA/NEA discussed what the Health Insurance Portability and Accountability Act (HIPAA) is and how breaches of information might occur. In this column, she looks at 10 common violations and offers practical tips for your practice.

Diverse forms of protected health information are at risk, as indicated by respondents to the Ponemon Institute's 2014 benchmark study on patient privacy and data security. However, the following 10 common violations require that attention be paid.

10 common violations

Lindy Benton is the CEO of MEA|NEA.

• Failure to adhere to the authorization expiration date: Patients can set a date when their authorization expires. A violation would be releasing confidential records after that date.
• Failure to promptly release information to patients: According to HIPAA, a patient has the right to receive electronic copies of medical records on demand.
• Improper disposal of patient records: Shredding is necessary before disposing of patient's record.
• Insider snooping: This refers to family members or co-workers looking into a person's medical records without authorization. This can be avoided with password protection, tracking systems, and clearance levels.
• Missing patient signature: Any HIPAA forms without the patient's signature is invalid, so releasing information would be a violation.
• Releasing information to an undesignated party: Only the exact person listed on the authorization form may receive patient information.
• Releasing unauthorized health information: This refers to releasing the wrong document that has not been approved for release. A patient has the right to release only parts of their medical record.
• Releasing wrong patient's information: Through a careless mistake, someone releases information to the wrong patient. This sometimes happens when two patients have the same or similar name.
• Right to revoke clause: Any forms a patient signs need to have a "right to revoke" clause or the form is invalid. Therefore, any information released to a third party would be in violation of HIPAA regulations.
• Unprotected storage of private health information: A good example of this is a laptop that is stolen. Private information stored electronically needs to be stored on a secure device. This applies to a laptop, flash drive, or any other mobile device.

Scenarios that violate HIPAA

Additionally, there are several scenarios that clearly violate HIPAA. Some of these scenarios can be quite simple and some should be common sense, but they can carry some heavy costs. For example, practice employees telling friends or relatives about patients in the practice or discussing protected health information in public areas, including the lobby of a facility, an elevator, or the cafeteria.

Practice leaders should be aware of a number of other scenarios, including the following:

• Discussing private health information over the phone in a public area.
• Not logging off a computer or a computer system that contains private health information.
• HIPAA regulations for "minimum necessary": For example, a health insurance company might need information about the number of visits the customer had, but isn't allowed to view the entire patient history.
• Including private health information in an email.
• Releasing information about minors without the consent of a parent or guardian.
• Leaving too much patient information over a phone message: A patient may give the practice approval to call, but practice leaders should be sure their staff does not leave a message disclosing too much patient information. A friend or family member could check your patient's message and hear things they shouldn't.

The real world

Let's take a look at a real-world example of a HIPAA violation. An Office of Civil Rights (OCR) investigation confirmed allegations that a dental practice flagged some of its medical records with a red sticker with the word "AIDS" on the outside cover, and that records were handled so that other patients and staff without need to know could read the sticker.

When notified of the complaint filed with OCR, the dental practice immediately removed the red AIDS sticker from the complainant's file. To resolve this matter, OCR also required the practice to revise its policies and operating procedures and also move medical alert stickers to the inside cover of the records. Further, the covered entity's privacy officer and other representatives met with the patient and apologized and followed the meeting with a written apology.

Keeping your practice compliant

Administratively, is everyone in your office trained in HIPAA compliance? Do you regulate who has access to sensitive information?

From a technical perspective, do you have an inventory of computers and devices that store protected health information? Do you use your smartphone or tablet to capture or store sensitive documents? Do you email patient information and records? Are the items discussed above encrypted for security protection?

When dealing with physical records, how are you storing or disposing of your paper files?

All these factors can affect your HIPAA liability.

Tips for mitigating HIPAA violation

Here are some tips to keep the HIPAA cops from coming after you or your practice:

• Always use a cover sheet when faxing protected health information.
• Email protected health information using secure, encrypted email only.
• Assign different levels of security clearance to specific people. Role-based security prevents employees from accidentally changing or seeing information that does not pertain to their specific duties.
• Never share passwords among staff members.
• Properly dispose of information containing protected health information by shredding paper files.
• Make sure computers have updated antivirus scanning software installed. This insures that your practice is reasonably guarded against malicious software.
• It's important to make sure any vendors or other businesses associated with your practice are properly following HIPAA standards as well.
• Always consult a HIPAA compliance attorney for any legal advice or questions concerning HIPAA. You can never be too careful.

Lindy Benton is the CEO of MEA|NEA, a provider of electronic attachment, health information exchange, and secure cloud storage solutions for dental and medical practices.

The comments and observations expressed herein do not necessarily reflect the opinions of DrBicuspid.com, nor should they be construed as an endorsement or admonishment of any particular idea, vendor, or organization.