Beginning Sept. 23, all healthcare facilities and medical offices are responsible for new medical compliance guidelines, as instituted by the HIPAA Omnibus Final Rule. All hospitals and physicians found non-compliant with new patient privacy protections regarding health records may face heavy penalties.
Is your medical compliance up to date?
Read the whole text here: HIPAA Omnibus Final Rule Here are some key points all healthcare and medical facilities need to know about the new medical compliance policy, as implemented by the US Department of Health and Human Services:- Under the new compliance, medical facilities must issue patients a copy of electronic medical records in electronic form if requested,
- Patients paying out of their own pocket may demand complete compliance regarding medical treatment and health plan privacy.
- Medicare compliance includes restrictions on sharing PHI (Protected Health Information) with Medicare when Medicare recipient pays out of pocket and requests privacy.
- The new guidelines impose limits on how medical facilities may use patient data, regarding marketing and fundraising purposes. Patient health records may not be sold without patient’s permission.
- Non-compliant medical facilities may face a fine up to $1.5 million per violation.
- Violation of PHI probability may be determined by nature and extent of non-compliance, medical persons involved, extent of mitigation, and whether or not the patient records were viewed or received.
- A “breach “of patient privacy may be determined regardless of the type of data which was shared, even if birthdates or zip codes are excluded.
- Healthcare facilities found issuing unauthorized disclosure on a patient will only be charged with PHI non-compliance under the HITECH Act if the PHI disclosure is “unsecured.”
- “Unsecured PHI” is defined as protected health information that a medical facility may share with unauthorized individuals without first rendering the data unusable, illegible, or indecipherable by means of technology.
- Medical compliance regarding privacy includes giving notice to individuals, the media, and the US Department of Health and Human Services (HHS) up to sixty days after a breach of unsecured PHI has been brought to their attention.
- Patients must receive a Notice of Privacy Practices form if they may be contacted by fundraisers, and they must be given the right to opt-out.