The Federal Trade Commission, or FTC, has put together a Safeguard Rule to help establish guidelines for how businesses store and interact with customer information. Enacted in 2003, this rule was recently revamped in 2021 to stay relevant with the latest technology used by businesses. Let’s look at some of the policies and procedures that your business needs to know about the FTC Safeguard Rule.
The days of the cash-only business are over. It doesn’t matter if your business is a multinational corporation or you cut grass for a living, accepting payment cards is not only convenient for your customers, most of the time it’s the most secure way to get paid. In an effort to protect the personal and financial information of consumers who have come to depend on their payment cards, the banks that back the credit card industry have developed a regulation that businesses who process cards need to adhere to. Today, we will go over this regulation and how it affects small and medium-sized businesses
Data loss can have lasting effects upon your business, usually measured in lost productivity and capital. In other words, data loss is often measured by the cost required to retrieve, restore, and/or repair its effects. Of course, this is only the beginning of how data loss can impact your operations.
Compliance laws regarding the storage and dispersion of healthcare records were implemented with the intended purpose of urging healthcare providers to better take care of their patients’ personal information, but how effective are they? Unfortunately, there are many providers that have failed to meet the standards for the HIPAA and HITECH compliance laws, and it has brought a hefty price tag along with it.
In 2016, the Office for Civil Rights (OCR) and the Department of Health investigated several data breaches that led to a considerable sum being claimed in response to violations of these compliance laws. In what totaled to 12 settlements following the investigations of data breaches caused by failure to comply with these laws, as well as one monetary civil penalty, these claims amounted to approximately $25,505,300 in fines.
Compare this to the more recent data. In 2017, there were only nine HIPAA settlements that produced a total of $19,393,000, as well as a single monetary civil penalty paid, a considerably smaller sum than the previous year. Clearly something is working here, but what is it? Perhaps it’s the fear that being negligent with important data could mean a large sum raining down on the heads of those who fail to adhere to these laws.
What’s even more interesting are the types of violations that led to these penalties. While the majority of these involve a failure to protect protected health information, or PHI, and its digital counterpart electronic protected health information (ePHI), there are a couple of outliers that are interesting to look at. Here are some of them:
The majority of the issues revolving around HIPAA and HITECH compliance come from an inability to secure mobile devices, failure to implement proper security processes, and delaying breach notifications for far too long.
As for HITECH specifically, a recent lawsuit was filed in federal court against 60 hospitals over alleged failure to adhere to the HITECH Act. Specifically, these hospitals failed to adequately provide records and documentation for 50% of their patients within three business days of the request. This is one of the specific requirements for securing funding through the HITECH Act, so you can understand that this was quite a big red flag for government.
Consequently, these 60 hospitals from the state of Indiana now face charges totaling over $1 billion for failure to provide records as required, despite receiving the incentive payments totaling around $324 million. Additionally, these hospitals face claims that they violated the Anti-Kickback Statute and the False Claims Act for claiming that they were HITECH-compliant, when in reality they failed to meet the requirements of the regulation.
Not all practices fail to adhere to HIPAA and HITECH, though. Is your practice one of them? Answer with confidence today by reaching out to The Connection, Inc at (732) 291-5938.
Technology is invading all practices, including those of medical offices and other health-related institutions like hospitals and dental offices. With the advent of electronic medical records (EMR) and their management systems, medical institutions are capable of eliminating the physical space required to store paper documents, and can instead easily store them in a digital environment. Unfortunately, this also brings its fair share of problems, such as regulatory compliance.
In other words, offices that don’t take steps to adapt to these changing industry standards could be hit with compliance fines that break their budget. If your office doesn’t take precautions to meet the various regulations put into place by HIPAA, HITECH, PCI, and other laws, and if the personal information for your office’s patients is stolen by hackers, your business could be charged somewhere between $100 to $50,000 per record. You don’t need us to tell you that this is an immense cost that’s exceptionally crippling.
To help you keep your office in compliance, we’ve outlined some information about the various laws that you’ll need to know about.
HIPAA
Known as the Health Insurance Portability and Accountability Act of 1996, HIPAA is a set of compliance regulations that are designed to enforce electronic medical record privacy for patients. HIPAA covers, more or less, all healthcare organizations, the medical staff, and employees of the healthcare industry. This includes health insurance providers. Basically, HIPAA is designed to provide those who submit electronic medical records with rights to know how their information is being used and stored within the electronic medical record environment, and to ensure that health records and personal information is stored in accordance to the various security aspects of HIPAA.
HITECH
The Health Information Technology for Economic and Clinical Health Act was first introduced in 2009, and was designed to encourage medical practices to adopt technical solutions to their operational advantage. Specifically, HITECH revamped part of how HIPAA views user privacy. HITECH requires that organizations covered by HIPAA report data breaches of 500+ users to the United States Department of Health and Human Services, the media, and to the users affected. Furthermore, it changes the way that organizations handle the disclosure of electronic medical records, as well as how this information is used throughout the caregiving process.
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that must be met before an organization can choose to implement major card-scanning technology systems. As credit card numbers are one of the hottest targets that hackers gun for, the main goal of PCI is to minimize and prevent credit card fraud. This applies to any organization, regardless of industry or product, that allows transactions to be completed with cards. Some examples of required protocol include maintaining a firewall that protects cardholder data, restricting access to card numbers on a “need-to-know” basis, and tracking and monitoring network resources, including what accesses cardholder data.
Compliance regulations can be difficult to understand if you’re not versed in the specifics. The Connection, Inc can help your business ensure compliance with the various laws so you don’t wind up in a situation that spells trouble for your organization. To learn more, give us a call at (732) 291-5938.
Mobile? Grab this Article
