compliance | The Health Law Firm Blog

Do You Need A HIPAA Risk Assessment?

By Danielle M. Murray, J.D.

As a health care provider or owner of a health facility, you know about the Health Insurance Portability and Accountability Act (HIPAA) of 1996. You know that you must safeguard and protect confidential patient medical information to avoid civil and criminal penalties against you and your practice. Did you know that you may need a HIPAA Risk Assessment?

If You Are A Health Care Provider You Face an Audit Risk.

The Office for Civil Rights (OCR) is stepping up enforcement around the country of “covered entities” and business associates. OCR auditors will send a letter informing you that within 30 days, they will be in your office reviewing your organization and interviewing your key staff members. If the auditor finds flaws with your office, you will be made aware of them, and then re-reviewed later, if you are not first fined or otherwise sanctioned. It is a very real and likely situation that many practices, facilities, and their business associates will be faced with in the coming months and years.

Frequently, an investigation into HIPAA violations is started due to disgruntled employees, patient complaints, theft or loss of records, security breaches, and improper disclosure.

A HIPAA Risk Assessment is Mandatory by Law.

A HIPAA Risk Assessment is a thorough review and analysis of areas where you may have risk of violating the HIPAA laws. Federal regulations require that covered entities have this assessment done. Specifically, the regulation says that covered entities must:

[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.

To see this regulation in full, go to http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.4.html.

Practices Big and Small Can Be Audited.

Large and small practices have been targeted by HIPAA Compliance Audits. UCLA was fined $865,000 because some of its employees improperly peeked into hospitalized celebrities’ medical records. The Alaska Department of Health and Social Services was fined $1,700,000 when a USB hard drive full of protected health information was stolen from an employee’s car. In another case, a specialty physician practice in Arizona was fined $100,000 because it used a public internet calendar to post clinical and surgical appointments.

All of these stories had something in common: they did not conduct a HIPAA risk assessment, they did not implement administrative safeguards, and they were fined a lot of money. Could your practice afford that sort of cost? Not to mention the potential criminal liability that comes with privacy violations.

HIPAA Risk Assessments Are A Pre-Emptive Measure to Limit Sanctions.

A HIPAA risk assessment can significantly reduce, if not entirely eliminate, your exposure to regulatory and litigation sanctions. It will identify areas for improvement and allow them to be corrected before an auditor finds the issue and causes unwanted problems for you and your practice.

HIPAA laws have likely changed since you last edited your privacy forms and procedures. Many health providers simply don’t have the time to re-review their policies and revise documents. In a perfect practice, this would be done every 6 months.

When the OCR auditor comes to visit your office to check for HIPAA compliance, they will ask for your Risk Assessment. Do you have one? Does your staff know who your HIPAA compliance officer is? Call an experienced health law attorney to complete a risk assessment of your practice today.

For more on HIPAA, read our two-part blog. Click here for part one and here for part two.

Contact a Health Law Attorney Experienced in Defending HIPAA Complaints and Violations.

The attorneys of The Health Law Firm represent physicians, medical groups, nursing homes, home health agencies, pharmacies, hospitals and other healthcare providers and institutions in investigating and defending alleged HIPAA complaints and violations and in preparing Corrective Action Plans (CAPs).

For more information about HIPAA violations, electronic health records or corrective action plans (CAPs) please visit our website at www.TheHealthLawFirm.com or call (407) 331-6620 or (850) 439-1001.

Comments?

What are your thoughts? Is HIPAA working? Not working? Has HIPAA increased the protection of your health information? What could be done to improve it? Please leave any thoughtful comments below.

About the Author: Danielle M. Murray is an attorney with The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. www.TheHealthLawFirm.com The Health Law Firm, 1101 Douglas Avenue, Altamonte Springs, Florida 32714

“The Health Law Firm” is a registered fictitious business name of George F. Indest III, P.A. – The Health Law Firm, a Florida professional service corporation, since 1999.

By The Health Law Firm|2024-03-14T10:00:38-04:00June 1, 2018|Categories: HIPAA, In the Know, The Health Law Firm Blog|Tags: administrative, civil, compliance, criminal, defense attorney, defense lawyer, doctor, fines, Health Insurance Portability and Accountability Act, hipaa, HIPAA audit protocol, HIPAA compliance, HIPPA audits, license, licensed clinical social worker, licensed mental health counselor, mental health, physician, policy, practice, privacy, psychologist, psychology, risk assessment, sanctions, security|Comments Off

The Importance of Complying with the Stark Law and Other Anti-Fraud Laws

By Lance O. Leider, J.D.

The federal government has several tools in its toolbox to combat Medicare fraud. Among those are the Stark Act, Anti-Kickback laws, and Civil Monetary Penalty Laws. Each of these typically focuses on a particular type of behavior that is prone to abuse by healthcare providers.

The following focuses on the Stark law and what is prohibited by it. Primarily, the Stark laws exist to combat the problems that can arise from physician self-referrals. Self-referrals are cases in which a physician orders a test or service and refers the patient to a provider in which the referring physician has a financial interest. This second provider will then bill Medicare for the service, essentially allowing the referring physician to cash in twice.

The concern is that if physicians are permitted to benefit from referring to an entity that they have a financial interest in, they will be prone to order tests and services that are not medically necessary. Our President and Managing Partner George F. Indest recently wrote an article on the legal ramifications of unnecessary tests, which was published in Medical Economics. Click here to read that article.

Know the History Behind the Stark Law.

There are essentially two Stark laws. The first one is often referred to as “Stark I” and dealt primarily with physician referrals for clinical laboratory testing. This law was in effect from January 1, 1992, to December 31, 1994.

The second Stark law, known as “Stark II,” took effect on January 1, 1995. This law greatly expanded the types of prohibited referrals. Instead of focusing on clinical laboratory testing, Stark II expanded the prohibition to “designated health services.”

A List of the Designated Health Services (DHS).

According to the Stark laws, designated health services (DHS) refers to the following services:

(i) clinical laboratory services;

(ii) physical, occupational, and speech-language pathology services;

(iii) radiology and certain other imaging services;

(iv) radiation therapy services and supplies;

(v) durable medical equipment and supplies;

(vi) parenteral and enteral nutrition and supplies;

(vii) prosthetics, orthotics, and prosthetic devices and supplies;

(viii) home health services;

(ix) outpatient prescription drugs; and

(x) inpatient and outpatient hospital services.

To see the complete statutory definition, click here.

It should also be noted that the regulation states that it only applies to DHS that are payable in whole or in part by Medicare. While there are no Stark prohibitions on self-referral for non-Medicare reimbursed services, many states have their own laws that prohibit these referrals.

Stark Compliance.

Stark II compliance is a two-way street. Not only is the physician prohibited from referring to an entity in which he has a non-exempt financial interest, the provider receiving the referral is prohibited from accepting it.

Medicare conditions payment of a claim upon the certification by the claimant that it is in compliance with the Stark law. What this means is that there is an obligation on the recipient of a referral to make sure that it is proper.

In the complicated world of healthcare business entities, it is incumbent upon the management of a supplier of DHS to know who all of its owners, investors, and stakeholders are so that it can remain in compliance and avoid any charges of impropriety.

Exceptions to the Rules.

Like many other regulatory frameworks, the Stark law have exceptions. The law provides a number of exceptions to the rules which allow otherwise impermissible referral arrangements to pass muster.

Because the exceptions are numerous and often subject to change, it is highly recommended that any new business arrangement, or substantial change to an existing one, is reviewed by a health law attorney experienced in the area of Stark law.

Contact Health Law Attorneys Experienced in Handling Stark Compliance.

If you are involved in referring or providing DHS it is crucial that your arrangements are reviewed for compliance with Stark and other anti-fraud laws.

Violations of these laws can carry severe financial and criminal penalties. One of the best ways to avoid these sanctions is to have your current or potential arrangement reviewed by an attorney who is experienced in these matters.

The Health Law Firm routinely advises healthcare providers on Stark compliance issues for practitioners and providers of all types of DHS. We can advise you on the legality of a particular arrangement and can assist with remedying any perceived compliance issues.

To contact The Health Law Firm, please call (407) 331-6620 or (850) 439-1001 and visit our website at www.TheHealthLawFirm.com.

About the Author: Lance O. Leider is an attorney with The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. www.TheHealthLawFirm.com The Health Law Firm, 1101 Douglas Avenue, Altamonte Springs, Florida 32714, Phone: (407) 331-6620.

“The Health Law Firm” is a registered fictitious business name of George F. Indest III, P.A. – The Health Law Firm, a Florida professional service corporation, since 1999.Copyright © 1996-2012 The Health Law Firm. All rights reserved.

By The Health Law Firm|2024-03-14T10:00:40-04:00June 1, 2018|Categories: In the Know, Medicare, The Health Law Firm Blog|Tags: compliance, designated health services, DHS, Florida defense attorney, Florida defense lawyer, fraud, health law lawyer, heath law attorney, kick-backs, medicare, Medicare fraud, Medicare fraud prevention, physician self-referral, self-referral, Stark I, Stark II, stark law|2 Comments

Do You Need a HIPAA Risk Assessment?

By Danielle M. Murray, J.D.

As a health care provider or owner of a health facility, you know about the Health Insurance Portability and Accountability Act (HIPAA) of 1996. You know that you must safeguard and protect confidential patient medical information to avoid civil and criminal penalties against you and your practice. Did you know that you may need a HIPAA Risk Assessment?

OCR Auditors Are Stepping Up Enforcement.

The Office for Civil Rights (OCR) is stepping up enforcement around the country of “covered entities” and business associates. OCR auditors will send a letter informing you that within 30 days, they will be in your office reviewing your organization and interviewing your key staff members. If the auditor finds flaws with your office, you will be made aware of them, and then re-reviewed later, if you are not first fined or otherwise sanctioned. It is a very real and likely situation that many practices, facilities, and their business associates will be faced with in the coming months and years.

Frequently, an investigation into HIPAA violations is started due to disgruntled employees, patient complaints, theft or loss of records, security breaches, and improper disclosure.

The Law Requires a HIPAA Risk Assessment.

A HIPAA Risk Assessment is a thorough review and analysis of areas where you may have risk of violating the HIPAA laws. Federal regulations require that covered entities have this assessment done. Specifically, the regulation says that covered entities must:

[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.

To see this regulation in full, go to http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.4.html.

Can You Afford the Fine?

Large and small practices have been targeted by HIPAA Compliance Audits. UCLA was fined $865,000 because some of its employees improperly peeked into hospitalized celebrities’ medical records. The Alaska Department of Health and Social Services was fined $1,700,000 when a USB hard drive full of protected health information was stolen from an employee’s car. In another case, a specialty physician practice in Arizona was fined $100,000 because it used a public internet calendar to post clinical and surgical appointments.

All of these stories had something in common: they did not conduct a HIPAA risk assessment, they did not implement administrative safeguards, and they were fined a lot of money. Could your practice afford that sort of cost? Not to mention the potential criminal liability that comes with privacy violations.

HIPAA Risk Assessments Can Significantly Reduce Your Exposure to Regulatory and Litigation Sanction.

A HIPAA risk assessment can significantly reduce, if not entirely eliminate, your exposure to regulatory and litigation sanctions. It will identify areas for improvement and allow them to be corrected before an auditor finds the issue and causes unwanted problems for you and your practice.

HIPAA laws have likely changed since you last edited your privacy forms and procedures. Many health providers simply don’t have the time to re-review their policies and revise documents. In a perfect practice, this would be done every 6 months.

When the OCR auditor comes to visit your office to check for HIPAA compliance, they will ask for your Risk Assessment. Do you have one? Does your staff know who your HIPAA compliance officer is? Call an experienced health law attorney to complete a risk assessment of your practice today.

For more on HIPAA, read our two-part blog. Click here for part one and here for part two.

Contact a Health Law Attorney Experienced in Defending HIPAA Complaints and Violations.

The attorneys of The Health Law Firm represent physicians, medical groups, nursing homes, home health agencies, pharmacies, hospitals and other healthcare providers and institutions in investigating and defending alleged HIPAA complaints and violations and in preparing Corrective Action Plans (CAPs).

For more information about HIPAA violations, electronic health records or corrective action plans (CAPs) please visit our website at www.TheHealthLawFirm.com or call (407) 331-6620 or (850) 439-1001.

Comments?

What are your thoughts? Is HIPAA working? Not working? Has HIPAA increased the protection of your health information? What could be done to improve it? Please leave any thoughtful comments below.

About the Author: Danielle M. Murray is an attorney with The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. www.TheHealthLawFirm.com The Health Law Firm, 1101 Douglas Avenue, Altamonte Springs, Florida 32714

“The Health Law Firm” is a registered fictitious business name of George F. Indest III, P.A. – The Health Law Firm, a Florida professional service corporation, since 1999.

By The Health Law Firm|2024-03-14T10:01:12-04:00May 15, 2018|Categories: Defense, HIPAA|Tags: administrative, civil, compliance, criminal, defense attorney, defense lawyer, doctor, fines, Health Insurance Portability and Accountability Act, HIPAA audit protocol, HIPAA compliance, HIPPA audits, license, licensed clinical social worker, licensed mental health counselor, mental health, physician, policy, practice, privacy, psychologist, psychology, risk assessment, sanctions, security|3 Comments

Avoid Costly HIPAA Violations with a HIPAA Risk Assessment

By Danielle M. Murray, J.D.

As a health care provider or owner of a health facility, you know about the Health Insurance Portability and Accountability Act (HIPAA) of 1996. You know that you must safeguard and protect confidential patient medical information to avoid civil and criminal penalties against you and your practice. Did you know that you may need a HIPAA Risk Assessment?

All Health Care Providers Face the Risk of Being Audited.

The Office for Civil Rights (OCR) is stepping up enforcement around the country of “covered entities” and business associates. OCR auditors will send a letter informing you that within 30 days, they will be in your office reviewing your organization and interviewing your key staff members. If the auditor finds flaws with your office, you will be made aware of them, and then re-reviewed later, if you are not first fined or otherwise sanctioned. It is a very real and likely situation that many practices, facilities, and their business associates will be faced with in the coming months and years.

Frequently, an investigation into HIPAA violations is started due to disgruntled employees, patient complaints, theft or loss of records, security breaches, and improper disclosure.

A HIPAA Risk Assessment is Required.

A HIPAA Risk Assessment is a thorough review and analysis of areas where you may have risk of violating the HIPAA laws. Federal regulations require that covered entities have this assessment done. Specifically, the regulation says that covered entities must:
[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.

To see this regulation in full, go to http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.4.html.

Auditors Do Not Care About the Size of Your Practice.

Large and small practices have been targeted by HIPAA Compliance Audits. UCLA was fined $865,000 because some of its employees improperly peeked into hospitalized celebrities’ medical records. The Alaska Department of Health and Social Services was fined $1,700,000 when a USB hard drive full of protected health information was stolen from an employee’s car. In another case, a specialty physician practice in Arizona was fined $100,000 because it used a public internet calendar to post clinical and surgical appointments.

All of these stories had something in common: they did not conduct a HIPAA risk assessment, they did not implement administrative safeguards, and they were fined a lot of money. Could your practice afford that sort of cost? Not to mention the potential criminal liability that comes with privacy violations.

HIPAA Risk Assessments Will Show You Weak Areas.

A HIPAA risk assessment can significantly reduce, if not entirely eliminate, your exposure to regulatory and litigation sanctions. It will identify areas for improvement and allow them to be corrected before an auditor finds the issue and causes unwanted problems for you and your practice.

HIPAA laws have likely changed since you last edited your privacy forms and procedures. Many health providers simply don’t have the time to re-review their policies and revise documents. In a perfect practice, this would be done every 6 months.

When the OCR auditor comes to visit your office to check for HIPAA compliance, they will ask for your Risk Assessment. Do you have one? Does your staff know who your HIPAA compliance officer is? Call an experienced health law attorney to complete a risk assessment of your practice today.

For more on HIPAA, read our two-part blog. Click here for part one and here for part two.

Contact a Health Law Attorney Experienced in Defending HIPAA Complaints and Violations.

The attorneys of The Health Law Firm represent physicians, medical groups, nursing homes, home health agencies, pharmacies, hospitals and other healthcare providers and institutions in investigating and defending alleged HIPAA complaints and violations and in preparing Corrective Action Plans (CAPs).

For more information about HIPAA violations, electronic health records or corrective action plans (CAPs) please visit our website at www.TheHealthLawFirm.com or call (407) 331-6620 or (850) 439-1001.

Comments?

What are your thoughts? Is HIPAA working? Not working? Has HIPAA increased the protection of your health information? What could be done to improve it? Please leave any thoughtful comments below.

About the Author: Danielle M. Murray is an attorney with The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. www.TheHealthLawFirm.com The Health Law Firm, 1101 Douglas Avenue, Altamonte Springs, Florida 32714

“The Health Law Firm” is a registered fictitious business name of George F. Indest III, P.A. – The Health Law Firm, a Florida professional service corporation, since 1999.
Copyright © 1996-2012 The Health Law Firm. All rights reserved.

By The Health Law Firm|2024-03-14T10:01:43-04:00May 15, 2018|Categories: Dental Law, Dentist Defense attorney, Dentistry Law, Licensure matters|Tags: administrative, civil, compliance, criminal, defense attorney, defense lawyer, doctor, fines, Health Insurance Portability and Accountability Act, hipaa, HIPAA audit protocol, HIPAA compliance, HIPPA audits, license, licensed clinical social worker, licensed mental health counselor, mental health, physician, policy, practice, privacy, psychologist, psychology, risk assessment, sanctions, security|Comments Off

Workers Can Be Fired For Using Marijuana Off-Duty

By Carole C. Schriefer, R.N., J.D., The Health Law Firm

Marijuana may be legal in Colorado, but you can still be fired for using it. Employers’ zero- tolerance drug policies trump Colorado’s medical marijuana laws, the Colorado Supreme Court ruled on Monday. In a 6-0 decision, the Supreme Court ruled that businesses can terminate an employee for the use of medical marijuana – even if it’s off-duty.

Coats v. Dish Network.

Brandon Coats became a quadriplegic after a car accident and has relied on medical marijuana to help with muscle spasms. Dish Network fired Coats after a failed drug test in 2010. “As a national employer, Dish remains committed to a drug-free workplace and compliance with federal law,” company spokesman John Hall said in a statement. To read about the Coats v. Dish Network case in its entirety, click here.

What is Lawful Activity?

This case was brought based on Colorado Revised Statute 24-34-402.5, Colorado’s “lawful activities statute.” The Supreme Court held the term “lawful” in the statute refers only to those activities that are lawful under both state and federal law. Therefore, employees who engage in an activity such as medical marijuana use that is permitted by state law but unlawful under federal law, are not protected by this statute. Like Texas, Colorado law allows employers to set their own policies on drug use. Unlike Texas, Colorado has a law that says employees can’t be fired for “lawful” off-duty activities.
To read C.R.S. § 24-34-402.5. – Unlawful prohibition of legal activities as a condition of employment, click here.

Legal Off-Duty Activity.

Coats claims that Dish Network violated C.R.S. § 24-34-402.5, by terminating him due to his state licensed use of medical marijuana at home during non-working hours. The Colorado justices ruled that because marijuana is illegal under federal law, Coat’s use of the drug couldn’t be considered legal off-duty activity. State laws only govern the citizens within a particular state, but federal laws apply to all U.S. citizens. Therefore, federal laws trump state laws.

To read past blogs on this topic or any health law topic, visit our blog pages on our website : www.TheHealthLawFirm.com.

Visit our Colorado Health Law blog.

Comments?

Do you think medical marijuana is considered a “lawful” activity? Do you agree with Dish Network’s decision? Do you think Coats v. Dish Network was a fair case, why or why not? Please leave any thoughtful comments below.

Contact Experienced Health Law Attorneys for Medical Marijuana Concerns.

The Health Law Firm attorneys can assist health care providers and facilities, such as doctors, pharmacists and pharmacies, wanting to participate in the medical marijuana industry. We can properly draft and complete the applications for registration, permitting and/or licensing, while complying with Florida law. We can also represent doctors, pharmacies and pharmacists facing proceedings brought by state regulators or agencies.

To contact The Health Law Firm please call (407) 331-6620 or (850) 439-1001 and visit our website at www.TheHealthLawFirm.com.

Sources:

Linsley, Brennon. “Colorado court: Workers can be fired for using pot off-duty.” The News Herald. (June 15, 2015) From:

http://www.morganton.com/colorado-court-workers-can-be-fired-for-using-pot-off/article_f4f67447-5d36-5e6e-9a67-8548d5fc77a4.html

“24-34-402.5. Unlawful Prohibition of Legal Activities as a Condition of Employment.” Department of Regulatory Agencies. (June 15, 2015) From:

http://www.colorado.gov/cs/Satellite?blobcol=urldata&blobheadername1=Content-Disposition&blobheadername2=Content-Type&blobheadervalue1=inline%3B+filename%3D%22Colorado+Anti-Discrimination+Act+statutes+-+unofficial.pdf%22&blobheadervalue2=application%2Fpdf&blobkey=id&blobtable=MungoBlobs&blobwhere=1251818317123&ssbinary=true

Coats v. Dish Network, LLC., CO 44. No. 13SC394. U.S. (2015)

About the Author: Carole C. Schriefer is an attorney with The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. www.TheHealthLawFirm.com The Health Law Firm, 1101 Douglas Avenue, Altamonte Springs, Florida 32714, Phone: (407) 331-6620. The Health Law Firm also has offices in Fort Collins, Colorado and Pensacola, Florida.

KeyWords: Employment Law, medical marijuana, medical cannabis, marijuana license, defense attorney, drug-free work place, Drug-Free Work Place Act, employee rights, employer rights, employment law, employment termination, Colorado marijuana laws, health care lawyer, health lawyer, law attorney, legalizing marijuana, licensed medical marijuana user, marijuana, medical marijuana license, medical marijuana policy, physician attorney, physician lawyer, workplace marijuana regulations, lawful activity, lawful off-duty activity, federal law, state law, Supreme Court, zero tolerance, zero tolerance drug policy, THC, compliance, Recreational drug laws and regulations, Government regulations, Courts, Colorado, health care, health issues, health law, health law attorney, health law lawyer

“The Health Law Firm” is a registered fictitious business name of and a registered service mark of The Health Law Firm, P.A., a Florida professional service corporation, since 1999.
Copyright © 2017 The Health Law Firm. All rights reserved.

By The Health Law Firm|2024-03-14T10:02:01-04:00May 15, 2018|Categories: marijuana law, Marijuana Law Blog, Medical Marijuana|Tags: Colorado, Colorado marijuana laws, compliance, Courts, defense attorney, drug-free work place, Drug-Free Work Place Act, employee rights, employer rights, employment law, employment termination, federal law, Government regulations, health care, health care lawyer, health issues, health law, health law attorney, health law lawyer, health lawyer, law attorney, lawful activity, lawful off-duty activity, legalizing marijuana, licensed medical marijuana user, marijuana, marijuana license, medical cannabis, medical marijuana license, medical marijuana policy, physician attorney, physician lawyer, Recreational drug laws and regulations, state law, supreme court, THC, workplace marijuana regulations, zero tolerance, zero tolerance drug policy|Comments Off