DO YOU HAVE MONEY TO BURN?
In 2013 The U.S. Department of Health and Human Services (HHS) added the Omnibus Rule to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This new rule was designed to add more security measures to the existing bill as the health care industry was moving into a digital world.
This new rule highlighted how business contracts with third party vendors or business associates must be dealt with to further protect the privacy of patient’s records while expanding patient’s rights at the same time. What that means is after 2013 you should have redrafted those contracts to comply with the new rule, or you may be subject to fines that could cost you millions of dollars. Examples of third party vendors and business associates include:
- Third party shredding company
- Third party billing or coding company
- Accounting firm that gets access to protected health information
- Electronic health record vendor
- Third party information technology organization
- Third party secure messaging company, IT organization
- Health Information Exchange
- E-prescribing gateway
HIPAA defines a third party vendor or business associate as anyone that performs functions or activities on behalf of the healthcare organization. The primary functions that are performed typically revolve around the creation, use, transmission, storage, and destruction of protected health information. HIPAA did not leave any grey areas in this new rule. Prior to 2013 there were many grey areas concerning patient’s rights and privacy, but as the healthcare industry shifted to the digital world those areas quickly became exposed. HIPAA did another thing too, they raised the penalty fee to about $1.5 million. They are serious about privacy and compliance and they want the world to know.
I would advise anyone in the healthcare industry to have an expert go through those third party contracts and make sure they comply with the Omnibus Rule.
