![\"\"](\"https:\/\/advantagehcconsulting.com\/blog\/wp-content\/uploads\/2018\/05\/HIPAA.png\")
<\/p>\n<\/p>\n
Warning: Proper disposal of Protected Health Information is an OCR hot spot.<\/em><\/strong><\/span><\/p>\n Ensuring the safety of your patients\u2019 protected health information on your computers, networks, and mobile devices is important. However, you\u2019d be wise to remember that the HIPAA Privacy Rule still mandates the security of your paper records, too. Those protocols must be followed even if your business goes belly up \u2014 or it could cost you, a recent breach demonstrates.<\/p>\n The\u00a0HHS Office for Civil Rights\u00a0<\/strong>recently warned providers and their business associates in a release that anyone handling PHI, including health care providers, storage vendors, and other covered entities (CEs), is subject to the full consequences of a HIPAA violation \u2014 up to and beyond your business\u2019s viability or lifespan.<\/p>\n Context:\u00a0<\/strong><\/span>After liquidating the assets of\u00a0Filefax Inc.<\/strong>, the appointed receiver agreed to pay $100,000 out of the estate to settle violations of the HIPAA Privacy Rule. Filefax advertised its provision of storage, maintenance, and delivery of medical records for covered entities, according to the OCR release.<\/p>\n OCR opened an investigation after an anonymous tipster alleged that someone transported Filefax medical records to a shredding and recycling facility in order to sell them. OCR found evidence of 2,150 patients\u2019 medical records \u2014 records containing PHI \u2014 at the shredding and recycling facility and in an unlocked truck in the Filefax parking lot. OCR\u2019s investigation indicated that Filefax had granted permission to an unauthorized person to remove the PHI from Filefax, who left the PHI unsecured outside the Filefax facility, according to the report. Though Filefax shuttered during the investigation, it was still held to the consequences of violating the HIPAA Privacy Rule. \u201cIn 2016, a court in unrelated litigation appointed a receiver to liquidate its assets for distribution to creditors and others,\u201d according to the press release. \u201cIn addition to a $100,000 monetary settlement, the receiver has agreed, on behalf of Filefax, to properly store and dispose of remaining medical records found at Filefax\u2019s facility in compliance with HIPAA.\u201d<\/p>\n Consider this:<\/span>\u00a0<\/strong>Although there has been intense focus in the healthcare industry on securing ePHI and medical records, paper records are still highly vulnerable, as this case illustrates. \u201cWhile not as easily transferable as its digital counterpart, the information in paper-based medical records remains extremely lucrative in the black market,\u201d warned partner attorney\u00a0Laurie Cohen\u00a0<\/strong>in a blog posting for the law firm\u00a0Nixon Peabody<\/strong>. Experts estimate that an individual\u2019s medical data can fetch as much as 10 times the value of a credit card number.<\/p>\n Make Long-Term Plans For PHI In Your Protocols<\/strong><\/span><\/p>\n Filefax was slapped with a corrective action plan that addressed Privacy and Security Rule issues. The proper disposal of PHI is one of the OCR\u2019s top five hot spots, and one the department takes very seriously.<\/p>\n \u201cOrganizations should pay careful attention to the transfer and disposal of both electronic and paper patient records,\u201d stressed associate attorney\u00a0Jefferson Lin\u00a0<\/strong>in a blog post for the Seattle-based law firm\u00a0Ogden Murphy Wallace Attorneys<\/strong>.<\/p>\n Under the HIPAA Privacy Rule, Section 45 CFR 164.530(c), \u201ccovered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures of PHI, including in connection with the disposal of such information,\u201d OCR guidance reminds. It\u2019s also essential to set up standards after your risk analysis for the disposal of ePHI, ensuring that the electronic devices and tools aren\u2019t reused for nefarious purposes after your agency dissolves, the Security Rule says in 45 CFR Part 160 and Subparts A and C of Part 164.<\/p>\n Ask Yourself These 5 Questions<\/strong><\/span><\/p>\n Take care to outline specific guidelines for the retention and disposal of PHI and ePHI, keeping the HIPAA Privacy and Security Rules in mind. Consider these OCR questions for CEs when writing up your HIPAA compliance plan:<\/p>\n Important:<\/span>\u00a0<\/strong>Healthcare is a competitive business, and agency closures are an all too common occurrence. Records management must include the proper disposal of records, taking every safeguard into account to secure PHI. The scope of the facility, how an agency dissolves, the number of business partnerships, and the state in which the provider operates, are all things that factor into how long PHI and ePHI are retained, managed, and eventually discarded and\/or destroyed, advises the\u00a0American Health Information Management Association\u00a0<\/strong>in its online guidance \u201cProtecting Patient Information After a Facility Closure.\u201d<\/p>\n Endnote:<\/span>\u00a0<\/strong>\u201cThe careless handling of PHI is never acceptable,\u201d said\u00a0Roger Severino<\/strong>, OCR director. \u201cCovered entities and business associates need to be aware that OCR is committed to enforcing HIPAA regardless of whether a covered entity is opening its doors or closing them. HIPAA still applies.\u201d<\/p>\n Note: A summary of the OCR guidance on disposing PHI is at online at\u00a0www.hhs.gov\/hipaa\/forprofessionals\/faq\/575\/what-does-hipaa-require-ofcovered-entities-when-they-dispose-information\/index.html<\/a>. AHIMA\u2019s advice on securing PHI after closure is at\u00a0http:\/\/library.ahima.org\/doc?oid=105074#.WqZm8WaZNAY<\/a>.<\/em><\/p>\n Source- SuperCoder<\/span><\/i><\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Warning: Proper disposal of Protected Health Information is an OCR hot spot. Ensuring the safety of your patients\u2019 protected health information on your computers, networks, and mobile devices is important. … Continue Reading →<\/a><\/p>\n","protected":false},"author":1,"featured_media":277,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[11,12,13,14],"class_list":["post-276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance","tag-home-care","tag-hospice","tag-ltc","tag-snf"],"_links":{"self":[{"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/posts\/276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/comments?post=276"}],"version-history":[{"count":1,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/posts\/276\/revisions"}],"predecessor-version":[{"id":278,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/posts\/276\/revisions\/278"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/media\/277"}],"wp:attachment":[{"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/media?parent=276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/categories?post=276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advantagehcconsulting.com\/blog\/wp-json\/wp\/v2\/tags?post=276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n