Services

The Carosh Privacy Assessment focuses on the Privacy Rule requirements contained in 45 CFR Part 160 and Part 164 Subparts A and E. The Privacy Rule establishes national standards to protect individual’s medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically along with their Business Associates.

The Privacy Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the use and disclosure of the information without patient authorization. The rule also gives patients personal rights over their health information, including rights to examine and obtain copies of their health records, and to request corrections to their medical record.

Implementing the remediation plan includes the development of appropriate policies and procedures to provide the overall direction for the controls. Procedures spell out the details of how specific controls will be implemented. While security policies should be known by all members of your work force, some security procedures may need to be considered sensitive information. In this case, only a limited number of persons, with a “need-to-know”, should have access to procedures (eg.as how to set passwords or the encryption methodology employed). While procedures may be sensitive and the number of staff with a need-to-know limited, there should always be more than one person who knows each procedure (backup) and no one person should know all procedures for all controls (separation of duties).

Carosh will review existing policies and procedures to assess appropriateness in addressing risk and security threats. For those deficiencies addressed in the Security and Privacy Risk Assessment(s), we will develop the policies and procedures necessary to address these deficiencies tailored to your workflow and personnel. Outsourcing the documentation development and preparation, especially when combined with the Security Risk Assessment, ensures a complete “Master Manual” that can be used by anyone in the practice to find procedures and forms to manage all aspects of HIPAA compliance.

The Carosh Security Risk Assessment focuses on 45 CFR 164 308(a)(1) with an in-depth analysis of the three key areas, Administrative, Physical and Technical safeguards. The determination of risk for a particular threat or vulnerability is a function of:

These Security Rules identify over 78 controls to include “required” and “addressable” controls; each is evaluated, and included in the delivered Gap Analysis, as the first step in the compliance process.

To assure effective training, and laying the groundwork for the creation of a culture of compliance, additional training resources are available.

All staff, whether salaried or non-salaried, are required to complete HIPAA privacy and information security training on a periodic basis. Contrary to generally accepted practice, training is required to include materials related to the practice’s specific policies and procedures. Though not specified in the Regulations, best practices have you conducting this training continually throughout the year, or when a change to the Regulations occur. Training needs to include faculty, staff, students, volunteers, as well as visitors who may have either direct or indirect access to patients or their health information.

Carosh provides you with several levels of training depending upon employees’ level of access to patients and patient information including basic (staff) and advanced (management). Training is designed for your specific type of practice. Training is delivered in the form most suited for your individual staff.

Carosh’s Attestation Service covers a number of areas required for compliance with the HIPAA/HITECH Security Rules that many entities have a difficult time addressing internally. This attestation audit is conducted on-site, customized to the specific business operation, and covers specific areas that have been identified by HHS (the U. S. Department of Health and Human Services) as areas consistently lacking in their breach investigations.

During the Attestation Service, additional time is spent on-site to validate components of the Security Risk Assessment. Additional activities include: a) the required Vulnerability Assessment, b) Business Associate Management, and c) implementing an effective Training Program.

Upon completion of the Attestation phase, Carosh will generate an opinion letter as to the entities compliance with all the relevant regulations. Successful attestation will include a “seal of approval” for use on your website and promotional materials, and certificate of attestation, documenting your organizations’ successful implementation of a security and privacy program.

Carosh will provide all levels of services and support in the implementation and maintenance of your HIPAA/HITECH compliance program. Service level is described independently and estimated independently. However, each service level is dependent on each other for overall success.

This planning and facilitation service level begins the process and is therefore the most important to a successful implementation. Careful thought must be put into which operational areas, and service offerings need to comply with the requirements of HIPAA/HITECH. The goal is to identify those areas that will be impacted, and those, if any, that need not comply with the requirements of HIPAA/HITECH. Care must be taken to assure that these two areas do not bleed together, resulting in a weakened defense when you experience a breach of client PHI. Carosh has substantial experience with the processes involved in planning successful HIPAA/HITECH compliance programs, in complex organizations.

Carosh will facilitate meetings to determine and clarify:

– What are your obligations under HIPAA/HITECH,

– Business Processes, Product and Service Lines that may require compliance with HIPAA/HITECH regulations,

– Extent and function of Business Associate relationships, including specific services provided,

– Training needs across multiple functional groups,

– Extent of internal assets to develop launch and manage training requirements under HIPAA/HITECH,

– Extent of internal assets and configuration to comply with document management requirements under HIPAA/HITECH, and

– Development of timeline and tasks to develop and implement HIPAA/HITECH compliance program.

The subsequent phase is the Security Risk Assessment phase, we will update the security and risk assessment required under HIPAA/HITECH. This risk assessment needs to be conducted under a protocol similar to that described in the NIST’ (National Institute of Standards and Technology) Special Paper 800-30.

The results of the Security Risk Assessment are used to generate a new and required Remediation Plan. Following the approval of the remediation plan, you will need to implement the Remediation Plan, making “meaningful progress” towards compliance.

Carosh will conduct the Security Risk Assessment, auditing business processes, policies and procedures, document retention programs, and training programs to assess compliance with the requirements of HIPAA/HITECH. With the completed Risk Assessment, Carosh will construct the prioritized remediation plan, and present it to management for approval.

Carosh will work with you to achieve compliance under HIPAA/HITECH and will attest that you have conducted the required Security Risk assessment, has constructed the required Remediation Plan, and is making “meaningful progress” in remediating any identified deficiencies. To do so, Carosh will work on the remediation of deficiencies and implementation of all policies and procedures, business processes document management and training.

As part of this service, Carosh will conduct quarterly reviews and updates to all aspects of the compliance program to ensure continued compliance and continued attestation to compliance of your obligations under the HIPAA/HITECH regulations.

Carosh will routinely review and provide training within the contest of the HIPAA/HITECH compliance program. This routine review and on-going training are at the core of a maintaining HIPAA/HITECH compliance. When a suspected breach occurs, you, under the Final Omnibus Rules which went into effect in January 2013, obligated to assess the extent and impact of the breach. Depending on the result of this assessment, different reporting requirements are triggered.

In the event an actual breach has occurred, or you are audited as part of the Office of Civil Rights’ (“OCR”) ongoing random audit program, specific protocols will be triggered to demonstrate to OCR, your compliance with the requirements of HIPAA/HITECH. As part of Carosh’s Program, Carosh will stand by you, guiding you through the process of working with both suspected breaches and with OCR during a breach investigation.

To assure continued compliance with the requirements under HIPAA/HITECH, the tasks presented above need to be reviewed and updated on a routine basis. The Security Risk Assessment and Remediation Plan need to be reviewed and updated; (i) periodically, (ii) after a move to a different physical location, and (iii) when a material change in operation or operating procedures occurs.