Yesterday (April 20, 2017), the Office for Civil Rights (OCR) announced a settlement of $31,000 with an Illinois nonprofit. The nonprofit had failed to enter into a business associate agreement (BAA) with one of its vendors that stores records containing protected...
Patients don’t want to be put on hold. They’re tired of accommodating to constraining office hours. Consequently, they’re looking for easy ways to communicate with their providers. Technology can solve many of patients’ communication frustrations. Many systems allow...
Far too many privacy officers lean on their electronic medical record (EMR) or electronic health record (EHR) system as a HIPAA compliance crutch. They believe (mistakenly) that an EMR/EHR system keeps their organization HIPAA compliant. Maybe that’s you. However,...
In January 2017, a HIPAA-covered Texas clinic learned that someone had stolen an unencrypted external hard drive. The thief took it from a locked closet inside the clinic. The clinic used that hard drive to back up patients’ protected health information (PHI)....
If you don’t record and review system activity, hackers or unethical employees can harm your organization without a trace. Therefore, The Office for Civil Rights (OCR) prompts HIPAA-covered organizations to collect, secure, track, and review their system audit...