Tip: Address inadequate HIPAA Security Rule-required policies and procedures
CDI Strategies, January 6, 2011
Want to receive articles like this one in your inbox? Subscribe to CDI Strategies!
CMS detailed seven shortcomings, including old and inadequate policies and procedures, in its 2009 audits of healthcare organizations to determine compliance with the HIPAA Security Rule. CMS detailed the findings in its 2009 HIPAA Compliance Review Analysis and Summary of Results report.
CMS conducted reviews of five HIPAA covered entities (CE) during 2009. In the past, CMS initiated reviews based on complaints filed, identification of potential Security Rule violations through the media, or recommendations from the Office for Civil Rights. This was the first time CMS reviewed CEs that had not been the subject of any complaints.
In the report CMS recommended solutions to help CEs increase compliance, such as:
- Requiring management to periodically review policies and procedures. These reviews should be conducted when systems or the environment change significantly.
- Mandating the participation of one of a CE’s designated HIPAA security officers as a permanent member of the policy and procedure development team.
- Developing a standard format for documenting policies and procedures. This format should accommodate multiple types of documents but should maintain information about document revisions, including all revision dates, the individual who revised the document, the date of the most recent approval of the document, and the individual who approved it.
- Conducting periodic evaluations, either internally or through a third party, to assess the effectiveness of policies and procedures and compliance with the Security Rule. CEs can perform this assessment using various methods, including interviews, process walk-throughs, and assessment of the actual results of these processes.
Editor’s note: For additional tips see the November issue of Briefings on HIPAA.
Want to receive articles like this one in your inbox? Subscribe to CDI Strategies!
Related Products
Most Popular
- Articles
-
- Don't forget the three checks in medication administration
- Steps for maintaining patient privacy
- The consequences of an incomplete medical record
- Note similarities and differences between HCPCS, CPT® codes
- Know the medical gas cylinder storage requirements
- Practice the six rights of medication administration
- Tip of the week: Overcoming language barriers with ESL staff members
- Prevent dehydration with nursing interventions
- Nursing responsibilities for managing pain
- Q&A: Primary, principal, and secondary diagnoses
- E-mailed
-
- Understand how to report services during the global period for minor surgeries
- Tip: Understand Q status indicator subcategories
- Tip: Report drugs with HCPCS code, revenue code 636
- Tip: Carefully code fracture care
- Elder Abuse and Exploitation
- Documentation challenges for skin and dermatology coding
- Correctly code for new cardiac, pulmonary rehab benefits
- Searched