Overview:

This training provides a detailed examination of your organization's information technology infrastructure and its critical relationship with the HIPAA/HITECH Security Rule, particularly regarding the protection of Protected Health Information (PHI) during electronic transmission.

The session will explore multiple real-world examples and specific scenarios, offering practical, common-sense compliance solutions. We will cover key areas including secure texting, email transmission, encryption standards, medical messaging platforms, voice data protection, and the management of personal mobile devices and their associated risks.

Drawing from insights gained in over 1000 risk assessments and direct experience with OCR audit protocols, the presentation will distinguish common misconceptions from the actual requirements of this complex regulation. I will share specific knowledge from 18 years as an independent compliance auditor and expert witness in HIPAA-related litigation, including a clear explanation of how patients can now seek financial compensation for the wrongful disclosure of their private health information. Most importantly, I will demonstrate how to significantly reduce these risks by adopting proactive measures and implementing industry best practices.

Be cautious of the widespread misinformation online about HIPAA, especially concerning IT and encryption, as many vendors promote solutions that exceed what is actually required by law.

Why you should Attend:

Are you struggling to separate fact from fiction regarding what HIPAA does and does not allow? This session provides definitive clarification. Significant misunderstanding exists around the transmission of PHI and the specific obligations for covered entities and business associates—including what practices should be avoided entirely.

Understanding the latest enforcement trends from the Department of Health and Human Services concerning portable devices, texting, email, and other electronic transfers of PHI is crucial. You will learn strategic approaches to minimize audit exposure and prevent lawsuits stemming from inadequate information security practices. Having served as an expert witness in cases where organizations were sued for insufficient risk management, I can confirm that the litigation threat from private individuals now often represents a greater financial risk than federal enforcement.

Areas Covered in the Session:

• Updates for 2024: Key regulatory changes and heightened enforcement priorities.

• BYOD: Managing the risks of Bring Your Own Device policies.

• Policies Regarding Personal Devices: Developing effective and enforceable guidelines.

• Portable Devices - Best Practices: Security protocols for laptops, tablets, and smartphones.

• Doctors and Texting: Establishing compliant frameworks for clinical communication.

• Practical Solutions: Implementable strategies for everyday compliance.

• Business Associates and the Increased Burden: Understanding expanded compliance responsibilities.

• Emailing of PHI: Secure methods for transmitting PHI via email.

• Texting of PHI: Compliant practices for text-based communication.

• Federal Audit Process: Navigating the HIPAA audit from initiation to conclusion.

Who Will Benefit:

• Practice Managers

• Any Business Associates who work with Medical Practices or Hospitals (e.g., Billing Companies, Transcription Companies, IT Companies, Answering Services, Home Health, Coders, Attorneys, etc.)

• Physicians and Other Medical Professionals

• Compliance Officers and IT Staff

• Healthcare Administrators and Executive Leadership

This training is essential for anyone responsible for protecting patient information, ensuring a legally defensible compliance posture, and mitigating organizational risk.