Reasonable Cause: Reasonable Cause ranges from $100 to $50,000 per incident and does not involve any jail time.
Willful Neglect: Willful Neglect ranges from $10,000 to $50,000 per incident and may result in criminal charges as well.
HIPAA violation categories and their respective penalties
WHAT IS HIPAA AND EPHI?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.1 To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “Electronic Protected Health Information” (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.
Source: Summary of the HIPAA rules and ePHI
RISK ANALYSIS PROCESS
To pass an OCR audit covered entities must have a thorough, documented Security Risk Analysis in place to protect Electronic Patient Health Information. ZEE Medical Billing takes on this task with great vigilance and completes a security risk analysis in alliance with providers within a time period depending on the size of your practice. Some of the services we offer include:
- PHI disposal logs
- Complete module based Risk Assessment
- Disaster recovery plans
- Designating a privacy and security officer within the place of service
- Constructing written policies and procedures
- HIPAA related employee training included within the service offering (uncapped)
- Security incident monitors and incident reporting guidelines
To construct an SRA, Security Rule mandates must be followed. Hence ZEE Medical Billing bases the SRA on three cores:
Technical Safeguards
Example
- Prevention of unauthorized destruction of PHI
- Access and audit controls for any software with ePHI, or access to prescriptions and other documentation containing PHI
Physical Safeguards
Example
- Device and media controls
- Facility access control
Administrative Safeguards
Example
- Backup plan
- Workforce Access to PHI and security
With each module covered, risk assessments are made taking into account:
- The severity of the possible breach
- Probability of possible breach
We suggest getting in touch with a professional if by chance you receive an audit. Auditors will be on the lookout for quality rather than quantity; focusing on the documentation and whether or not it contains the appropriate information.
Get a free no-sting attached billing services quote from ZEE Medical Billing for your practice.
