The Practical Guide to HIPAA Privacy and Security Compliance

Following in the footsteps of its bestselling predecessor, The Practical Guide to HIPAA Privacy and Security Compliance, Second Edition is a one-stop, up-to-date resource on Health Insurance Portability and Accountability Act (HIPAA) privacy and security, including details on the HITECH Act, the 2013 Omnibus Rule, and the pending rules. Updated and revised with several new sections, this edition defines what HIPAA is, what it requires, and what you need to do to achieve compliance. The book provides an easy-to-understand overview of HIPAA privacy and security rules and compliance tasks. Supplying authoritative insights into real-world HIPAA privacy and security issues, it summarizes the analysis, training, and technology needed to properly plan and implement privacy and security policies, training, and an overall program to manage information risks. Instead of focusing on technical jargon, the book spells out what your organization must do to achieve and maintain compliance requirements on an ongoing basis.

HIPAA ESSENTIALSIntroduction to HIPAA How HIPAA Came to BeWhat HIPAA Covers Current State of HIPAA Compliance Overview of the Omnibus Rule Updates What the HITECH Act CoversPending Proposed RulesOrganizations That Must Comply with HIPAAOrganizations That Must Comply with the HITECH ActHIPAA Penalties and Enforcement Insight into the Electronic Transactions and CodeSets Rule Conclusion Practical Checklist Related Regulations, Laws, Standards, and Guidance IntroductionARRA and the HITECH ActPractical Checklist Preparing for HIPAA, HITECH , and Other Compliance Changes Background Managing ChangeCreating the Mind-SetIt Is Up to You Practical Checklist HIPAA Cost Considerations BackgroundPrivacy Implementation Costs Privacy Ongoing Maintenance Costs Costs Related to Providing Access to PHI Privacy Officer CostsSecurity Implementation Costs Security Ongoing Maintenance Costs Security Officer Costs Practical Checklist Relationship between Security and Privacy Background Privacy Rule and Security Rule OverlapsConclusion Practical Checklist HIPAA PRIVACY RULEHIPAA Privacy Rule Requirements Overview Background Uses and DisclosuresIncidental Uses and Disclosures Minimum Necessary Requirement De-Identification Business Associates Marketing Notice of Privacy Practices for PHI Individual Rights to Request Privacy Protection for PHI Individual Access to PHI Amendment of PHI Accounting Disclosures of PHI PHI Restrictions Requests Administrative RequirementsPersonal RepresentativesMinorsTransition Provisions Compliance Dates and PenaltiesPractical Checklist Performing a Privacy Rule Gap Analysis and Risk Analysis Introduction Gap Analysis and Risk Analysis Practical Checklist Writing Effective Privacy Policies Introduction Notice of Privacy Practices Example NPPOrganizational Privacy Policies Practical Checklist State Preemption Introduction What Is Contrary? Exceptions to Preemption Preemption AnalysisConclusion Practical Checklist Crafting a Privacy Implementation Plan Introduction Some Points to Keep in Mind ConclusionPractical Checklist Privacy Rule Compliance Checklist Introduction HIPAA SECURITY RULESecurity Rule Requirements Overview Introduction to the Security Rule General Rules for Security Rule Compliance Insight into the Security Rule Other Organizational Requirements Reasons to Get Started on Security Rule Initiatives Practical ChecklistPerforming a Security Rule Risk Analysis Background Risk Analysis Requirements According to HIPAA Risk Analysis Essentials Stepping through the ProcessCalculating Risk Managing Risks Going Forward Practical Checklist Writing Effective Information Security Policies Introduction to Security Policies Critical Elements of Security Policies Sample Security Policy Framework Security Policies You May Need for HIPAA Security Rule ComplianceManaging Your Security Policies Practical ChecklistCrafting a Security Implementation Plan Background Some Points to Keep in Mind ConclusionPractical Checklist Security Rule Compliance Checklist Introduction COVERED ENTITY ISSUESHealth-Care Provider Issues Background Privacy Notices Fees for Record Review Mitigation Measures Fax Use Sign-In Sheets Patient ChartsBusiness AssociatesAuthorizationsPractical Checklist Health-Care Clearinghouse Issues Background Requirements Transactions Financial InstitutionsConclusion Practical ChecklistHealth Plan Issues What Is a Health Plan? What Is a Small Health Plan? Health Plan Requirements Marketing IssuesNotice of Privacy PracticesTypes of Insurance Plans Excluded from HIPAACommunications Government and Law EnforcementPractical Checklist Employer Issues Background "Small" and "Large" EmployersHealth Benefits Enforcement and Penalties Organizational RequirementsHealth InformationMedical Surveillance Workers’ CompensationTraining Resources Conclusion Practical Checklist Business Associate Issues Is Your Organization a Business Associate? Business Associate Requirements What You Can Expect to See or Hear from Covered Entities Common Business Associate Weaknesses Issues to Consider Moving Forward Practical ChecklistHIPAA TECHNOLOGY CONSIDERATIONSBuilding a HIPAA-Compliant Technology Infrastructure OverviewCaution Areas of Technology to Focus OnLooking Deeper into Specific TechnologiesMobile ComputingAdditional Technology Considerations Conclusion Practical Checklist Crafting Security Incident Procedures and Contingency Plans Background Handling Security IncidentsSecurity Incident Procedure EssentialsBasics of Contingency PlanningMoving ForwardPractical Checklist Outsourcing Information Technology Services Background Reasons to Consider Outsourcing What Functions to Outsource What to Look For in Outsourcing FirmsCommon Outsourcing Mistakes Practical Checklist MANAGING ONGOING HIPAA COMPLIANCEHIPAA Training, Education, and Awareness Creating an Effective Awareness Program Identify Awareness and Training Groups TrainingTraining Design and Development Awareness Options Document Training and Awareness ActivitiesGet SupportMeasure Effectiveness Conclusion Practical Checklist Performing Ongoing HIPAA Compliance Reviews and Audits Background Ongoing Cost of Compliance Privacy Issues Security IssuesMaking Audits Work Practical ChecklistAPPENDICESAppendix A: Enforcement and Sanctions Appendix B: HIPAA Glossary Appendix C: Model Incident and Privacy Response ProceduresAppendix D: HIPAA Resources ReferencesFurther Reading Index