Sign Idaho Banking Business Associate Agreement Fast

Digi sign hipaa business associate agreement

good afternoon good morning and welcome to this first installment of a collaborative webinar series on HIPAA business associates the webinar series is sponsored by qissas health and qi p solutions and over the next several webinars will cover timely and relevant topics specific to business associates in regards to HIPAA i'm adam void of qi p solutions and I'm joined today by vice-president of Keith akiza's health Marc prepper thanks for joining Marc thanks Adam appreciate you having me yep so if I waive housekeeping we'll save time for questions at the end if anyone has questions at any point during the presentation you can use the raise hand button and we'll unmute you you can address your question or you can also type any questions into the chat box and we'll address them as we receive them so today we're going to do is really lay the foundation for future webinars and talk and basics and high-level terms about the who when why and how of business associate compliance with HIPAA in subsequent sessions we'll talk specifically about the how will be providing documents draft documents templates and subsequent sessions and we'll get into a little bit more about what some of those specifics that we'll be discussing in coming weeks later in the presentation and also one other thing our presentation today will be a little shorter than the ones to come the later ones will be closer to 30 minutes but we will focus and try to drive this one to be about 15 to 20 minutes so let's talk a little bit about who is a business associate so we've put together this decision tree that hopefully really easily allows people to determine in three questions if they're a business associate so the first question starting at the on the left here is you have to ask yourself are you a covered entity and a covered entity relation to HIPAA is either healthcare providers or those your hospitals your doctors anyone at the point of character a health plan so a health insurer or a health care Clearing House which is a specific definition under HIPAA which probably doesn't have a lot of relevance here if you are a covered entity you are by definition not a business associate you cannot be both they cover at the end of business associate so if you're a covered entity feel free to join and continue with our presentation but you're not a business but if you are not a covered entity then we have another question that you have to ask do you perform services or activities for one of those covered entities this can be almost any business function that it contracted out to a third party billing janitorial or paid services legal services accounting services payroll all of these things that are either a service or an activity that is performed for covered entity if you do then we have another question if you don't perform a service or option for covered entity that and you are not a business associate but if you do there's a third question do you have that you have to answer do the services or functions involved that you perform for that covered entity do they involve access do they require access to protected health information these are this is the names Social Security numbers addresses any personally verifiable information including diagnosis and treatment codes and all of that that health information that we're really trying that HIPAA is really trying to protect do the services or functions that you perform or that covered entity require you to have protected health information so if you are a billing company doing billing for hospital or doctor's office and you need to know what treatment somebody received then you probably are performing a function that requires you to have access to protected health information if you answer yes to that third question that you need access to phi2 perform that service or function then you are a business associate now this there are two caveats i want to mention first of all if the information that you receive or you you're in touch with in contact with from a covered entity to perform that service or function is be identified then by definition that is not protected health information and you would not fall within the definition of a business so see you in second if the information health information that you come in contact with is incidental if it's if you know somebody is performing janitorial services and there happens to be a piece of paper in the trash or in the recycling that has pH I that's probably incident only probably don't fall we can protect definition of business associate but for the most part if you're not a covered entity you're performing a form or service or a function for a covered entity and that activity or service requires access to pH I and you are business associate and this this is a definition that falls widely many people fall within it that's the who now we go to the web when should business associates care about HIPAA well the time is now actually the time was about 18 months ago but we'll we will focus on right now in 2013 the HIPAA omnibus rule was finalized and in September of 2013 it became effective that rule stated that business associates directly now have to comply with HIPAA they have to have specific safeguards in place which we will discuss later today and in coming sessions but that rule the hip omnibus rule has been in effect since September 2013 and it has put business associates at the forefront and has required them to be compliant with HIPAA why why does some why is business so it need to care why do they need to comply with HIPAA well first going back to the previous slide it's it's the law it's something that has been the law since 2013 and but really I mean we have financial ramifications for business associates who did not comply they can now they are directly liable for fines and penalties from the Department of Health and Human Services and the Enforcement Division there is the Office of Civil Rights if previously if there's a breach protected health information was inappropriately accessed by business associate it was really the covered entities responsibility to to ensure that was protected and the fine would go to them there was a service agreement between the business associate and covered entity that could be that some liability could flow to the business associate but OCR and HHS would not come directly to the business associate and slap them with a fine now those fines are administered can be administered and frequently are directly to the business associate if they are adverse they are responsible for a breach if they caused a breach or allowed to preach to happen and later this year OCR will start a round of HIPAA audits that will be focused that and they will specifically audit business associates they will come in and determine if business associates are complying with HIPAA and those are and if they are not they can immediately be fee assessed fines for not being in compliance if that's what the audits term and the general consensus is those audits will not go well for business if there is there is a best understanding of business as its are not complying well or in large part with the rule so do you have the governmental aspect which business associates are now responsible directly responsible for fines we also have civil litigation I have a legal background I'm an attorney and whenever we see breaches whether it be Target or Sony or our most recent one that we've been hearing a lot about anthem I watch the news and inevitably two to four maybe five days after we have the first litigation first civil class-action suits filed against whoever is supposedly responsible for the breach and those can go directly now to business associates business associates can face litigation costs and incredibly high judgment amounts if they are responsible for a breach and this does not uh you know this is not noting the reputational damage that comes from a breach as well as now we're seeing and in our practice for seeing a lot of business associates who are required from their covered entities to verify that they have safeguards in place that they are doing something to protect the pH other that comes into their environments so there really is bottom line it's really a business responsibility it it really affects one's bottom line and I will tell you it is far less expensive to put safeguards in place at the front end and try and deal with a breach fine and litigation costs in the back it seems like a pain but it really really is far easier and far less expensive to do it in the beginning so that we'll get to the dicey environment of how a business associate complies with HIPAA and I will turn that over tomorrow to take that conversation off thanks Adam and thanks for kind of setting up that nice global picture you know we've gotten to this slide we're in the we're going to dump into the weeds a little bit the hell so now that I've identified that I am a BA and I've identified obviously the business impact that is out there or what we like to talk about is risk exposure your businesses has a risk exposure being in this industry in this market segment of health care and in order to limit the exposure and limit risk to your business is about this relationship that you carry with the covered entity as you being a business associate and fundamentally starts with that wonderful agreement known as the business associate agreement and within that agreement you have laid out contractually what your roles and responsibilities are in that relationship and what coincide with that is this basically assumption that the government in HHS is assuming you have a fundamental risk management program in place to protect this health information and that's the detail of the how you must have what are called safeguards around HIPAA for this information and those safeguards are a little bit of a three-legged stool they are heavily privacy and security is the main focus of these safeguards but they are in three different buckets there is a technical safeguards area the actual electronic information electronic exchange networks many of the IT functions of protected health information is one leg of the stool your second leg is actual physical safeguards meaning physical access so you as a BA how your entry point to information and then maybe you carry information back to your business or you hold on to it so what physical safeguards you have in place and when we say in place you're really talking about not only policies of handling information but the actual procedures that you have in place to handle protected health information and and the third leg of the stool one of the most complicated and misunderstood the administrative safeguard area those are the actual policies that is the core foundation of what you're doing is operating and handling and protecting this information both from a privacy and security perspective so that's what you really have to put in place as ABA is that that structure around those three safeguard areas and then once those safeguard areas are in place then you have your two biggest sections as ABA which are training and breach notification training and vitally important because many of the business associate agreements that we have worked with and work with DA's in helping them implement risk management programs this is one of those loose areas but also the easiest area to a limit exposure and that is the training of an employee the awareness of these safeguards that are have to be in place of protecting health information this is part of that training plan this is a core aspect sometimes you as a BA we've even seen language where you're putting that responsibility back on the covered entity to train your employees or to make the training available from the covered entities or what they have in place to protect information in the relationship that you've shared but you'll want to make sure that you vitally understand what your role and responsibility is when it comes to training for your employees in it relationship back to that Cee and vice-versa and then even the pillar now is breach notification obviously in this whole relationship which is what this is between you as a business and the covered entity there isn't a known relationship that they're expecting a policy and procedure around breach notification that you have clearly identified who would be responsible for the identification of a breach if it were to occur on your end or if the breach occurred from the C e and then notifying you how that relationship is handled how that communication is handled is just you know vitally important even to the standpoint where you've seen CMS come out with the extended guidance on making sure you have your breach notification policy and procedure in place so when you talk about these three areas these are what you will be accomplishing as a business associate is heavily focused on understanding the pillars of constructing a risk management program for your organization that will basically protect and coincide with your business associate agreement and your service level agreement is at the end of the day that's what it's really governed by you want to make sure that it's clearly known and understood within your language relationship of your business associate agreement that that's the core of what you're doing and as Adam alluded to going forward this is going to become a commonplace I mean this is a point of business entry for many entities the larger healthcare organizations will be requiring and looking for these types of programs that you can produce and say yes this is what we do we do these functions to protect it but here's our security risk management program here's our assessment and how you can kind of communicate those back and forth and that's what we're going to do in this series we're going to get down in the details and actually take you through the steps of creating and actually walking through examples or particular policies and walking through procedures that are done in relationship for ABA you know that's part of this is a learning series and to get the community comfortable with what they're going to have to do and put in place in order to be quote unquote in compliance and we'll be using for that our solution that we platform wise use with qi p known as HIPAA hi-tech express because fundamentally a lot of times is a very difficult thing to handle with just paper and just templates and processes you need to have a workflow in place and an ability to create something that you can manage going forward and that you can use to communicate with your clients on a consistent basis so we'll be using our solution as the example inside of our webinar series here and pulling out very specific detail and actually working through exercises of execution so that you will get an understanding of the kind of things that you'll need to be accomplishing Adam did I miss anything for you there nope I think you got it all so I think you laid out exactly in high-level how an organization a business associate specifically can take on you know HIPAA compliance so this is sort of our plan for the next several weeks we're going to have a session every two weeks except our last one will will skip a week and have it third because falls on the week of Easter but and this is how we're going to help folks in business associate community take on begin to take on their HIPAA compliance and we've bucketed these things into some of the most critical areas that we see in some of the areas that we see can really quickly help organizations be ready and be prepared and be compliant for lack of better words so we're going to start with negotiating business associate agreements and one thing that we've noticed is there's a lot of information out there about HIPAA compliance I venture to say all if not most of it is specific to covered entities and very little if any is specific to business associates and as an attorney I you know drafted tons of contracts and who is drafting a contract and from what perspective and how that contract is negotiated it's very important and when you're executing a business associate agreement most a lot of business associates just get a BA a from a covered entity and sign it and never think that this is not really drafted with them in mind so we're going to look basically at what what things business associates want to negotiate for what they want to be on the lookout for and what types of things they want to push to a covered entity or ensure that there is collaboration with the covered entity on specifically disposal of thi and breach notification who's going to notify potential affected individuals of a breach if there is one within a BIA or for a business associate subcontractors which is also of something that we that we have to keep in mind if that happens from a business associates perspective and at the end of that session everyone will receive a template business associate agreement that we will be working with and they can use that as they wish in their own in their own practice then on the 11th of March a month from today we'll conduct a security risk assessment with everyone walk them through it and that is really fundamental to to HIPAA compliance whether you're covered entity or business associate I mentioned OCR who's really the Enforcement Division for HIPAA and the first thing they do whether it's a breach investigation or an audit is they literally walk in or shooting email and they say show me your security risk assessment and it is it is really that fundamental and increasingly we're finding that people have not done one at all or have not done one in two years and it really needs to be done timely so I encourage people to participate in that if for no other reason then quickly and seamlessly complete a security risk assessment so that if you're ever asked that question you have an answer and also covered entities are asking that of their business associates as well on March 25th we're going to talk about thi inventory which is another fundamental thing you have to know where pH is entering your bids and what it's doing it for lack of a better term within your business who has access to it what servers it's on is it is it accessible and mobile devices if you don't do that it's very difficult to put any technical safeguards or physical access safeguards in place because you really have no idea where it is and a pH I inventory is critical and then on April 15th we're going to work through some workforce training the more even going back to anthem I mean we're looking we're finding now that anthem the anthem breach was probably something that initiated with phishing emails to probably a handful if not more or was not less of anthems employees and they were not properly trained on what to look for when to identify a phishing email and a vast majority an incredible amount of HIPPA breaches are as a result of an untrained workforce it's not it's very rarely malicious it's always they just didn't know what they were supposed to do or what to be looking out for it's really really critical yes training is is something that must be done according to HIPAA but it is really fundamental and very very critical and preventing preventing a breach so we're going to spend some time on that so these are four four things that we're going to head we'll probably add one a 6-1 on breach notification because it is important and it does get somewhat complex from a business associate standpoint so we'll probably add something to that regarding breach notification so that's our our plan for the next several weeks we're excited we're trying to give people specifically business associates a leg up trying to help them get the ball rolling not just be aware of what they need to do but really figure out how to do it because it only goes so far to keep telling people that they need to do something at some point somebody's got to come in and say you know here's a good way to do it and that's what we're going to try and do you know I'm in DC and we work a lot with federal government and they are they are relaxed if if nothing else for helping people achieve compliance they're very good at telling them that they need to comply but not necessarily telling them best practices and what to do and that's really what we want to achieve here so you can go to our website q IP solutions comm we have a specific section on business saussage which has the entire schedule as well registration information on there and I will send out an email later today or tomorrow which will include the entire schedule and registration information so that really concludes our presentation for today we have recorded this and we will post a link and include that with the slides and full registration information for the remainder of the series in an email that will come within 24 hours or so and I'll also have mark and i's email in there please let us know if you have any questions we're happy to answer them we're we're passionate and excited about this for whatever reason judges if you will but but this is this is much what keeps us up at night as anything else and and we do like trying to get people on the road to to compliance so look for that email soon and so as I mentioned our next session will be in two weeks we're going to hold these at the same time on Wednesdays and every other week and as I mentioned will be the next one will focus on business associate agreements and how to execute those from a va standpoint so I know yep I've not received any question yet so if there are any will hold here for a second and let those let anyone address those if not feel free to to ask us any questions in follow-up and our follow-up communication or by email so Barker thanks for the time I appreciate it and I appreciate everyone who attended and we look forward to talking to you in the interim and also reconvening on on the 25th of February excellent thanks Adam thanks a lot thanks to all joint