Health Information Management

Tip: Address inadequate HIPAA Security Rule-required policies and procedures

CDI Strategies, January 6, 2011

Want to receive articles like this one in your inbox? Subscribe to CDI Strategies!

CMS detailed seven shortcomings, including old and inadequate policies and procedures, in its 2009 audits of healthcare organizations to determine compliance with the HIPAA Security Rule. CMS detailed the findings in its 2009 HIPAA Compliance Review Analysis and Summary of Results report.

CMS conducted reviews of five HIPAA covered entities (CE) during 2009. In the past, CMS initiated reviews based on complaints filed, identification of potential Security Rule violations through the media, or recommendations from the Office for Civil Rights. This was the first time CMS reviewed CEs that had not been the subject of any complaints.
 
In the report CMS recommended solutions to help CEs increase compliance, such as:
  • Requiring management to periodically review policies and procedures. These reviews should be conducted when systems or the environment change significantly.
  • Mandating the participation of one of a CE’s designated HIPAA security officers as a permanent member of the policy and procedure development team.
  • Developing a standard format for documenting policies and procedures. This format should accommodate multiple types of documents but should maintain information about document revisions, including all revision dates, the individual who revised the document, the date of the most recent approval of the document, and the individual who approved it.
  • Conducting periodic evaluations, either internally or through a third party, to assess the effectiveness of policies and procedures and compliance with the Security Rule. CEs can perform this assessment using various methods, including interviews, process walk-throughs, and assessment of the actual results of these processes.
Editor’s note: For additional tips see the November issue of Briefings on HIPAA.



Want to receive articles like this one in your inbox? Subscribe to CDI Strategies!

    Briefings on APCs

  • Briefings on APCs

    Worried about the complexities of the new rules under OPPS and APCs? Briefings on APCs helps you understand the new rules...

  • HIM Briefings

    Guiding Health Information Management professionals through the continuously changing field of medical records and toward a...

  • Briefings on Coding Compliance Strategies

    Submitting improper Medicare documentation can lead to denial of fees, payback, fines, and increased diligence from payers...

  • Briefings on HIPAA

    How can you minimize the impact of HIPAA? Subscribe to Briefings on HIPAA, your health information management resource for...

  • APCs Insider

    This HTML-based e-mail newsletter provides weekly tips and advice on the new ambulatory payment classifications regulations...

Most Popular