As the HIPAA Omnibus Barrels Down Will You Be On It or Under It? by Michelle Paster

Okay, first thing's first. Yes, I know Omnibus isn't really a bus but, geez, with ever-evolving regulatory requirements and all the mass changes going in the healthcare industry (ICD-10, EMR Transition, Pay-for Performance) , it can start to feel as though a massive vehicle is constantly barreling down you. But before you resign yourself to becoming road kill, let's hit the brakes for a moment, take a breath, and see if there isn't an easier way to get ahead of this thing.

First, let's talk about what Omnibus is, and what' it's not. The Omnibus Rule is not a complete overhaul to the requirements originally outlined in the American Reinvestment and Recovery Act. Rather, Omnibus is a collection of modifications released by Health and Human Services (HHS) to provide greater clarity and accountability around HIPAA privacy, security, enforcement, and breach notification. At a high level the Omnibus Rule modifications to the Privacy and Security Rules:

Expand the definition of business associates to include any vendor that creates, receives, maintains or transmits PHI

Require business associates to enter into a written and comprehensive contract that contains specific provisions required by HIPAA

Identify new and expanded individual rights

Update the factors that determine the amount of civil monetary penalties and incorporate the increased and tiered civil money penalty structure

Replace the Breach Notification Rules' harm threshold with a more objective standard

Require a response to a patient's written request for copies of their PHI within 30 days

Enable patients to request information about care to be withheld if the patient paid for these services out-of-pocket

Of course, understanding these requirements is only half the battle. In order to achieve compliance by the September 23rd deadline you will have to re-evaluate your program and processes against the recent modifications - particularly the electronic elements. However, you don't have to do all the heavy lifting alone. There is a wealth of information and industry resources out there that can help you easily isolate areas of risk within your own program and identify proven best practices processes to achieve or, in most cases, enhance the compliance of your program. One resource I'd highly recommend is the HIPAA Primer: What You Should Know about HIPAA and the Omnibus Final Rules . In this document you'll find:

An overview detailing the changes brought forth by the Final Omnibus Rules

5 key questions to ask your business associates to ensure they are HIPAA-compliant

Detailed best practices that can help your organization meet and maintain compliance

A best practice checklist that can be leveraged to assess your internal program as well as your external vendors

In today's rapidly changing regulatory environment, maintaining compliance can be tough. The key to avoiding the head on collision isn't to run harder or faster down an uncharted path. Rather, stop running from the bus and take control of it. By leveraging the proven best practices and mapping out a strategic course, you can drive your organization well down the path to HIPAA compliance.

LINK:	http://blogs.ironmountain.com/2013/industry/healthcare-information-man...
	See more stories from ironmountain

Most recent headlines