7 MORE COMMON HIPAA Violations

In my last video, we went over 6 of the most common HIPAA violations. If you need a second, you can pause here to go back and get caught up because I’m about to go over 7 more examples. Let’s get into it!

LINKS:
____________________________________________

____________________________________________

1. Releasing Protected Health Information (PHI) Without Authorization
Employees must be cautious of the types of information released to third parties. Any information shared that is not specifically outlined in the authorization form is a HIPAA violation.

When disclosing PHI/records, if not collected in person by the patient, any third party involved must receive authorization by the patient. Employees must verify the identity of whoever is collecting these records and ensure the authorized records release only to this authorized individual.

2. Exceeding Expiration Date For Providing Access to PHI
So you have the authorization form with every intention of sending the PHI to the approved individual or organization. Great! Just make sure to fulfill the request on time to avoid a HIPAA violation. Too many times employees are simply bogged down by their day to day responsibilities that an authorization request may go unnoticed. This is how unauthorized access to PHI happens after their expiration date.

If a request is past the expiration date, an employee must complete a new authorization form before releasing information.

3. Failure To Enter A Business Associate Agreement
Failing to enter into a HIPAA-compliant Business Associate Agreement (BAA) with vendors that have access to PHI is another big HIPAA violation to look out for. Even when BAAs hold for all of your vendors, they might not necessarily be viable. Make sure that these agreements follow the Omnibus Final Rule.

4. Failure To Use Encryption To Safeguard ePHI
Here is an easy way to avoid a data breach, and consequently a large fine: encrypt your electronic protected health information (ePHI). While encryptions are not mandatory under HIPAA, you should not overlook them. If encryption is not an option, organizations must look into equivalent security measures to avoid leaked data.

5. Exceeding Deadline For Issuing Breach Notifications
Just like there is a time frame that employees must follow in regards to providing patient’s their records, there is a timeline for issuing breach notifications. The HIPAA Breach Notification Rule requires covered entities to alert the appropriate individuals and organizations within 60 days following the discovery of a data breach.

6. Improper Disposal of Protected Health Information
Both physical PHI and electronic PHI are risks if left unattended. When these forms of data are no longer required, disposing of them properly and permanently is your number one priority. For paper records, this might look like shredding. For ePHI you can securely wipe devices, degauss hard drives, or destroy electronic devices.

7. Leaving Portable Electronic Devices and Paperwork Unattended
Last, but certainly not least, we have the risk of a lost or stolen device which holds sensitive health information. That’s right, misplacing your work computer can get you in deep trouble and earn you a HIPAA violation.The risk doesn’t end with computers. The device in question might be a tablet, phone, etc. No matter the device, if it holds patient information and has the possibility of landing in the wrong hands, it’s a problem.

HIPAA violations have the potential to harm the reputation and workflow of any organization. Not to mention damaging to the privacy of the patient affected. Incorporating regular education and applying effective fundamental elements to staff training can help you avoid future lawsuits.

#IncidentResponse #IncidentResponsePlan