Industry sign banking idaho business associate agreement secure
we early tomorrow morning as well we will the presenters will take questions throughout the best way to do that is simply to type your question into the left side of your window you should see a chat box that will alert us that we have a question we'll try and stop periodically I myself Robert and all of the presenters will stop periodically through and address the questions we often get a lot of questions which is encouraging we really appreciate that if for some chance we do not get through all of the questions today we will put together a document with the questions and all of the answers and that will go out tomorrow with the deck and the recording as well so again we encourage questions and we welcome them as well so I just want to do some quick introductions first I'll introduce Robert Zimmerman he's the CEO managing partner of Q IP solutions which is the maker of HIPAA hi-tech Express Robert has many years of experience and information security cyber security risk management and audit and since 2012 when he founded Q IP he's been helping covered entities as well as business associates achieve HIPAA compliance as well as patient-centered medical home recognition so Robert thanks for joining next is Nancy huge used the chief business development officer and managing member at sync now she has a strong background in both healthcare and financial services where she dissolves new programs to assist her clients and taking their organization to the next level welcome and thanks for joining Nancy all right next is dr. Jeff hospitality is a plastic surgeon business operator and entrepreneur he's the founder and chairman of the Society of physician entrepreneurs and dr. Jeff will be presenting the unique aspect from our unique perspective of business associates during our presentation today thanks for joining dr. Haas Feld pleasure for myself my name is Adam bouillon I'm an attorney I work with QIT solutions where I focus on HIPAA privacy and do a lot of work with business associates so with that I will turn it over to Robert okay well thank you everyone for joining we're going to try to make this as interactive as possible we're going to ask questions among ourselves and we really do as Adam mentioned appreciate if people do have comments and questions please use the chat to bring them up as we go because we find it usually if you have a question there's three or four others that would also like to hear the same thoughts and answers so our agenda today HIPAA will very quickly talk about why this matters what's the business opportunity we'll go into the HIPAA requirements overview what do you really need to do to be compliant what are some of the critical steps and actions we'll spend some time talking about the unique nature of the business associate relationship what are the requirements under HIPAA for business associates what are some of the critical things needed all round agreements and then we'll talk a little bit about a tool that can help that can make the process much easier to do and lastly we have questions there but please ask questions as they come up as we go so there's really healthcare is changing and what this means for anyone in the business associate community it can be an opportunity but it can also be challenges there's rapid change in technology in the demand for value from patients payers and others who were involved in it and if you're trying to market to the healthcare industry you see that every day but a real plus side it is a growing opportunity it's a growing economy whether it's Obamacare our aging population and the baby boomers as they move into the high health care NEADS age bracket that just continues to grow and then government through the many programs commonly called Obamacare but the Affordable Care Act others from the American Recovery Act and just the increasing regulation that seems to be occurring in the industry so all these things are really coming together to help open up new opportunities for anyone who is in the healthcare industry so what are the key risk why are we here today there has been a traditional under investment in security when you look at any of the charts from Poneman or any of the organizations that really do the statistics around security and privacy health care is anywhere from five to ten years behind most other industries whether its financial retail etc the math digits the meds or the digitization of patient records has really increased the opportunity for attacks so not only has there been a less than stellar investment in security now we're opening up with the fact that we are digitizing records we're providing information out on the web in databases that formerly might have been behind someone's counter we're now putting out there where it can be lost so on etc this is a very fragmented industry unlike many industries and anyone who's worked in the retail or financial regulations have been around for a long time whether the financial regulations or PCI and retail but in the health care industry it's been very fragmented there has not been an overall set of regulations and the difference too is when the financial industry comes down and says everyone will do this they really do have a hammer because you can't work with them unless you follow the PCI requirements unfortunately the federal government through ONC and OCR they have not had that same kind of hammer now they are increasing audits and they really are increasing them at a rapid rate but it's still nothing like the enforcement that was seen to date from some of the other industries and then I think all of us are more and more interconnected whether it's through business associates relationships patience opportunities whatever it might be so we're really changing the whole idea what healthcare is from basically where you visit a doctor your information was there to now it can be shared by all kinds of different groups organizations etc so this increased complexity is equalling data breaches and when you look at the stats that are out there I've lost records in the first six months of 2015 over third a third of it is in the health care industry and another 30% in federal government with about half of that in groups like the VA and CMS and others so healthcare related so you're looking at the number of breaches tied to any type of healthcare being close to 50% of the breaches so it's not just that it's that health care is behind but the issue is individuals from the outside are realizing the opportunity but just as important internal breaches are way up and and that's something I think most people don't realize is but the breaches that have been reported on the next page here a good 80 to 90 percent of them really do have an internal cause that's either people aren't following policy they don't understand the policy they're not doing some basic IT has not put in some type of security safeguard just because maybe it fell through the cracks so a lot of the breaches are caused by human error I'm not necessarily hacking so this is just some of the numbers you can see how large they are and what the consequence is from a financial aspect some of these are overwhelming because when you add in that the average cost per record is somewhere around three hundred and sixty three dollars you can just multiply those out and see what the financial aspect of a breach really is so I'm going to turn this over to Nancy and then on to Jeff to talk a little bit about why it matters why is a business associate should you care why should you get involved in this and ensure that you are HIPAA compliant secure and auditable amazing thanks Robert good afternoon everybody so I am looking at this from a business development perspective being in the industry for 25 years working in healthcare from both a third-party collection agency to a first-party to insurance follow up etc I now work consultant patch so I'm I work directly with the CFL's of hospitals as well as senior revenue cycle and it's coming up over and over and over again in my discussions that they are now realizing that they need to start auditing so to speak their business associates typically as all of you know that have been working in the industry for a long time Hospital hires a collection agency or an insurance follow-up company and they do the contract and pretty much that's the end of it they don't have unless you're an extremely sophisticated health system you're not out auditing your vendors and that's changing so this is a big opportunity for those that actually go through the HIPAA compliance can actually show their health care either their current health care clients that they're compliant and specifically when marketing to new opportunities there's you know a huge opportunity for those of us that are civil complaint as you're competing against the ones out there that quote-unquote say they're HIPAA compliant but you know really haven't gone through any really have no protocols in place it's interesting I was at a conference last week and probably talked to a hundred hundred fifty collection agencies and everybody said oh we're nepo compliant I said exactly what do you do and none of them could tell me so you know I I'm looking at this from a business development perspective saying to those of you that go through this process I would add it get your sales people out there right away I will put it on all of your marketing material and I would let your health care providers know that you know you've taken the appropriate steps to become compliant to safeguard their data which is going to be you know in 2016 2017 this will be the focus I think we have another slide here I think I've probably pretty much gone through all of this but absolutely the you know the cost of the fines when the healthcare providers are out auditing you and they can show you've actually followed the protocol you've set in place then you're less likely to become an issue if there is a fine from the healthcare provider side I think that covered that all unless anybody has any questions on that Oh actually one quick thing I just went through an RFP for a very large public health system and HIPAA compliance was three pages of the RFP I wanted all of the standards protocols procedures for HIPAA compliance for the company that I was pursuing this opportunity with so it is becoming a big factor you know what I would add here is just that more and more companies are asking if you're going to do business with them and we hear that all the time from groups that we talk to they're saying are you HIPAA compliant can you show us that you're HIPAA compliant so there's a big revenue as Nancy said but then there's also the reputational damage if you do have a breach you can pretty much figure you're going to have a real business disruption not just because the auditors are going to show up you're going to have to do all the breach management but then you're going to lose potential customers because they're going to go somewhere else it's just natural the bad publicity is going to hurt any business associate for some amount of time so Jeff you want to talk about some of the specific drivers in healthcare sure be happy to so the my perspective is that of a practicing otolaryngologist facial plastic surgeon I practice her over 25 years and then left the practice of medicine to become an entrepreneur so I not only manage a medical debt collection agency but I interact with physicians in all walks of life both in in their practices and in their business so I have a really good understanding of what Doc's are going through what they have gone through and as a business associate what I have to do in order to gain their trust and their business and with Obamacare we all have to understand that accounts receivable is going to go up the the the ACA just intensifies a problem that has been ongoing of cost shifting so now the deductible the coinsurance the copay is much higher and as a result you have people with four or five thousand dollars out of pocket before insurance even kicks in so debt is going to be a significant problem and for those of you that are medical billers on the phone it becomes an issue as well and in terms of getting the bills paid because that's where you get your revenue from so there's lots of debt being written off during this time and more than eleven percent of all patient debt is written off go to the next line so I think that you may have wanted this back Bob but let me let me just before we before I finish up this portion of it just to say that we have you know we have enough enough on our plate as practicing physicians the regulatory environment is such that we have lots of things that we have to worry about in terms of what you do in your practice to take care of patients now now not only do we have to become HIPAA compliant in our own practices and our own hospitals but we have to be able to manage our vendors and whether that's a vendor that does medical billing or medical collections or anyone that handles pH I it is the responsibility of the provider to manage that relationship and to verify that all of these entities are compliant with the HIPAA regulations it's no longer acceptable just to ask and say are you compliant I'm glad you are now you have to both trust and verify that those vendors are HIPAA compliant and do some sort of an audit that is the least painful possible for you and your staff to make sure that if anything ever happens your entity is covered and that's what we ship we've tried to do with this program we got a question in a jet that fits very nicely to what you just mentioned here and it's someone who has practiced it appears and worked in Pakistan and has a common here in Pakistan it appears they don't have the issue of data being stolen or maybe they don't have the HIPAA requirements being enforced I think you might be that and also the health care there and the government influence is a lot different but the question really is why other companies steal data quite honestly because there's money in it the value of a healthcare record is worth 50 times that of a credit card record the other real thing is credit card now and financial they can tell because of algorithms and other things that built into it and probably all of us have gotten the phone call within minutes that there's something strange going on in healthcare it can take days and months before it can be identified that somebody has stolen the information and I know somebody got their card stolen the individuals were using it in Arizona and the only way they found out is when they started getting billed 30 days later so there's a lot more potential for and value and thieves and others are seeing it and then internally there's a lot you can you do with the data and there's the potential value of it for that too so very quickly this is what HIPAA covers it's protected health information it can be in either paper or electronic form it includes all copies archives backups as we're going to see as we talk about business associates and what you have to do it is not just covered entities which is commonly the provider your doctors hospitals but it's anyone at all who's part of that ecosystem who handles pH I so business associate so it can be application development software companies billing in collections as we've mentioned laboratories really anybody who is within the sphere of handling pH I so what our business partners and auditors asking for so when you're trying to work with an organization whether it's a fellow a business or a covered entity a hospital or university medical system an individual provider clinic they're asking for risk assessment and a lot of this has come down from the requirements from ONC which is the federal government's I want to say arbitrator but also the organization within Health and Human Services that has developed the requirements so they're looking for a risk assessment they want to see an inventory and flow of pH I data so where is your data and where does it go so what are the interfaces what are the databases that store this data they want to see up-to-date policies and procedures and I think both Jeff and Nancy at a conference they were recently at that is what auditors seem to look for
hey want to see some real evidence that you have policies procedures in place that you're actually doing what you say you're doing and then you have some data that goes along to show that yes the policies are in effect then what is the evidence that you're actually training people because as we mentioned the vast majority of breaches problems issues are from human error and it's the fact that oftentimes staff is not trained or people just are not doing those basic things they need to do every day do you have a tested disaster recovery and contingency plan so if there is a problem will you be able to continue to operate I think any organization wants to make sure that they have somebody who's a partner that they can depend and rely on they want to see evidence that the pH I is encrypted both in as it is it's transferred and travels among different organizations and databases but also at rest so that's a key item that anyone who is going to look for in this day and age and then do you have implemented and monitored access controls this last one around certifications a lot of the larger organizations are pushing and requesting that that business associates they deal with so like the Etna's of the world of Blue Cross's that you receive a certification from high trust or some other similar organization but at a minimum because of pushback they're looking to see the items that we have listed here the compliance is overwhelming if there's any organization has so much compliance it's hard to keep track of it so what is really key is a structured straightforward approach to attempting to meet it so just like tax with TurboTax and it reached that great success because it drove you through a standard process if you're going to be successful in a process like HIPAA you need to have a process in place you really do need to do those the basic are tackling so start with the assessment the risk assessment identify where your gaps are develop a work plan to remediate those tasks and track everything and then report so that you know where things are you can report it internally externally to management etc and then lastly which often gets dropped is the monitoring this is not a one-time only process you actually have to show evidence and make sure that you are doing the day-to-day activities ah we got a question here about high trust certification high trust was started by the large organization so it's the extensors that Deloitte's the Aetna's of the world basically to have a standard around security for themselves and to really say we're going to take the lead on this we're going to get a standard in place it is very costly to attain because it was really developed for the large organizations you need to first make sure that you've done everything so you do all your remediation and then you actually have to pay I trust to come in and do a valuation total cost is usually anywhere from 80 to 100 thousand dollars and up so that is what high trust is we have a question here about that it does not necessarily hold a lot of weight I think in the larger groups it does but what we're seeing now is instead of necessarily just high trust because a lot of organizations were pushing back at the cost is what people are looking for those items that we showed there so there's other types of certifications that you can get there's an organization the healthcare a technology access foundation that set one up for the small and medium where it's basically you know fifteen to twenty thousand dollars to do it same thing designed around an audit methodology to ensure security and privacy so the idea of high trust was good to get a standard I think maybe it got a little carried away because it was it's being driven by both of the larger organizations the security and privacy puzzle just real quick these are the key things to do I think we've talked about them the activities that you really do need to complete to be safe secure to be able to say yes I am HIPAA compliant and more importantly to ensure you don't have a breach and the only other thing there I would say those are just some of the key plans that anyone is going to ask to see do you have a risk management plan do you have an incident response plan do you have a contingency and business continuity plan and a physical security plan so I'm going to hand this over to Adam going to drive through some of the key unique things that a business associate has to do over the next several minutes thanks Robert so I think we've laid a great foundation to this point to make the case for why it is important why it's important for business associates as well as covered entities so I want to take some time and really discuss substantively who business associates are and then what's required some of you on the phone may actually be wondering if you are a business associate so let's analyze that first there are two questions that you need to ask to determine if you are a business associate also you may if you are business associate you may in fact have business associates yourselves which in the HIPAA world we are generally referred to as subcontractors but you would then have a relation or a responsibility to have business associate agreements with them and we'll talk more about paas in a second so two questions the first is do you does your organization perform some service or some function for a covered entity and if you answer the answer to that is yes then do you need access to protected health information or phi2 perform that service or function if you answer yes to both of those then but for some very limited exceptions you are a business associate I'll just throw in what the exceptions are really quickly we talked about things like conduits these are organizations like the United States Postal Service FedEx the phone company where there's sort of a transfer of pH I but that intermediary doesn't and a very very normal course doesn't have access to it it's in a box or it's you know they would actually have to to listen to the phone call which would be inappropriate and otherwise nefarious activity they don't need access to the phi2 perform the service or function and secondly would be those with incidental access these are typically thought of when we think of maintenance or janitorial service they may be taking out the trash they may be repairing some in a room or pH I is stored or house but they don't need access to the pH I to perform that service so the two exceptions again are the conduits and those with incidental access otherwise everyone who falls within this definition of performing a service or function and needing access to phi2 perform a service or function would be a business associate so common types of business associates we talk about those would persistent access EHR vendors some type of service providers vendors or agents so staffing companies and some instances are attorneys and a lot of instances are and application developers application developers it's usually 5050 with them and it depends on who the app developers customer is so if the customer is for instance a hospital or a health insurance plan then they're providing a service for covered entity and therefore therefore the app developer or whoever's maintaining that that mobile application would be a business associate if for instance we look at for maybe Fitbit their customers they're performing a service or a function mostly for the individuals themselves and therefore they would not be a business associate so when you talk about app developers you talk about who's the customer you are an app developer and your customer is a covered entity a health plan or hospital or healthcare provider than your business does if you're selling mostly directly to consumer then you're probably not so we talked about the two common non business associates incidental access and conducts also another common business associate is workforce but in HIPAA has a very broad definition of what's classified as workforce so technically if you have a contractor on site in some instances they can be considered your workforce and therefore not a business associate and other instances they are a business associate because they're not a member of your workforce so assuming you've determined that yes you are a business associate what is now required so fundamentally you have to have a business associate agreement executed with any covered entities you do work for or any business associates you do work for and any business associates or subcontractors that do work for you so you're exchanging transfer and phi2 a subcontractor or you're receiving it from someone you need a business associate agreement in both directions has to be executed you also need an inventory of all pH I that is received and that is also transferred out you need to know what information is coming in you need to know what information is going out so and virtually any point in time you can say this is the pH I have access to or this is the pH I eyes I was given access to and then transfer out of my organization and finally you need to be able to do you need to do a periodic review of where the pH is so as I mentioned you need to consistently being updating you know the flows of pH I into and out of your organization also some other things you need to do everyone must do a security risk assessment periodically we recommend every 12 to 18 24 months in some circumstances and shorter if for instance you've had a breach or some major change in how you operator or your technology that you deploy but fundamentally everyone must do a security risk assessment this applies both to covered entities and to business associates you must have as Robert touched on documented policies and procedures and documented is an important term there and it's one that the government and other organizations when we talk about audits and monitoring of business associates is focused very much on it's not enough to say yes we do this we have a practice you know we we have access control you know it's it's it's a setting on our on our operating system or whatever the case may be you actually have a document that says what your access policy is you have to have a document for instance that says that you train your your staff and this is when you train them on you know you can't just say yes we train you have to show the documents what you train when you train it how you train and you have to have a designated security officer the name there doesn't mean anything they could be you know the officer of almost anything but what we're looking for is a specific point of contact you have to identify somebody within your organization who is the champion for this endeavor and also as was touched on you need specific incident and breach response protocols and a team of individual it can be a team of one not quite recommended but it can be a team of people who handle in the event that you have a breach or an incident you have to know ahead of time what you're going to do to remediate to notify therefore you need to know who to notify how to notify and very importantly is how how quickly you need to notify because all of these things notifications very time-sensitive and lastly on this on this brief list is training we're going to talk more about training and I want to reiterate what Robert said I think one of the best things that anyone can do for for themselves when it comes to being HIPAA compliant being prepared and to limit breaches is to have consistent training in good training of their workforce so let's talk quickly about business associate agreements now on these two slides there are ten things that every by rule every business associate agreement must contain I don't want to go through these at length the slide will as I mentioned we'll send this out tomorrow so you'll have these list of 10 things pretty easy to find otherwise but what's important is that you you're thinking you're contemplating certain things you know what and the business associate agreement must outline for the reasons why access to pH is given reporting you know if you have a breach will you how quickly were you report that to the covered entity I touched on notification timing being very important there are some things in here about as a business associate you sort of in certain instances may absorb some of the covered entities requirements when it comes to the privacy role and for and this is usually thought of in terms of if you're if you're the holder of pH I may be paper documents and the covered entity doesn't have access to it as readily as you do somebody needs access to their documents you may be the one actually providing those instead of the covered entity and number nine here is important and it is having subcontractors your subcontractors agree to the same provisions as you agree and I'm just going to have a question here yes the question is our customers need to sign bas with us and our subcontractors need to sign bas is that correct yes that is correct so it goes both ways if you think of for instance your your organization as as the middle stop so information is coming from a covered entity to a business associate and then that business associate is transferring that information out to another organization one good example I think is as it's been touched on earlier is debt collection billing a medical debt collection so covered entity may transfer that to one organization who may buy a lot of debt that organization they have the pH I they need the pH I to perform that service they become the business associate then this organization that has purchased all of the debt may then send that to someone to do individual collections that may be an attorney to do collections work it may be somebody to a non-attorney but they're then sending it out to an another another organization that that third organization then becomes a business associate as well of the second organization so the covered entity the buyer of the debt and then the collector of the day if you will so the buyer and the collector are separate organizations but both business associates so another follow-up question to that is is who is responsible for initiating those business associate agreements when we talk about the letter of the rule there's no one in the rules HIPAA who's given specific responsibility for initiating although the rules require is that a document be executed in practice I think it's oh it's it's always better to take the initiative and request a business associate agreement before generally it's always better to be done before it's needed before pH is transferred I think sort of in sort of old or traditional contracting practices you think about you know sort of the first to the race or the first in the race and that's always better from a contracting general contracting perspective so I would always like to see someone initiate and say here's a copy of my business associate agreement let's negotiate let's start from here and so also getting back to the slide number ten is an important one as well to highlight and that is that if you have reason to believe or if a covered entity or somebody who's who you have a business associate agreement executed with has reason to believe that you are are handling the pH I appropriately you've had a breach they can terminate that contract immediately they have to terminate that contract or you have to cure the mistake so we've talked a lot about the importance of you know HIPAA compliance and making sure everything is in order that's a big one you know you could easily if you have a problem if you have an incident or you have a breach you could lose that contract immediately because the covered entity has a duty to cut off your your access to pH I if you're doing if you're not protecting it appropriately so some other important things these are not necessarily these are not requirements in hepa but I think they're important to to point out so business associate agreements do not have to be their standalone agreement do not have to be a standalone agreement they don't have to have a specific signature for that agreement it can be sort of an attachment or an appendix or hand end them to a larger service contract and in some instances that's a better way to go as I m
ntioned a couple times notification is important if you're in California I know you specifically have different notification provisions that are shorter than HIPAA so just you know make sure you know where you're at and what the timing is so you can get that into the contract and further down the line you can have your practices with what with what the timing requirements are destruction or return of pH I at the end of the contract whatever is most appropriate for your specific circumstance that just has to be pointed out and specified in the kind of business associate agreement and finally you know just with any contract and demonstration is important is there going to be indemnification who's going to indemnify whom something to consider something to think about again does that doesn't have to be in the BAA that can be in another contract but you would want to make sure that it's in there somewhere in some contract that you have so quickly going to switch we have an example of a business associate agreement here it it appears very small but I just want to give you a feel for it and I will include this tomorrow in the email with the deck and the recording so you can you know have more time with it and let us know if you have any questions then so it would just have definitions and then we talk about what's the business associate going to do or you know what's the subcontractor going to do if this is a business associate agreement between a BA and their subcontractors you can see f there has timing timing instances what are the permitted uses that's again an important one that has to be in there you can kind of see and then then we have so for this one everything from term and termination to the end is things that we included in this sample because it was designed to be a standalone agreement again those things could for the most part be well not all of those things could be cut out but a lot of these things in this page could be cut out especially in the miscellaneous section so the miscellaneous section could be removed if it's part of a larger agreement and moving back to our slides quickly so as far as next steps go and we put a lot of information out there I just want to sort of quickly organize some of these things and determine what's important so first identify if you're business associate and furthermore if you are if you have business associates if you are do you have business associate agreements in place with covered entities as well as with your subcontractors if not you really should execute those quickly have you done a risk assessment in the last 18 months or so if not you should conduct one policies and procedures as we touched on there's a long list of what policies and procedures are likely appropriate and as we done before training is important you would want to you know first implement policies and procedures and then train your staff on those policies and procedures okay thank you Adam we're going to go full circle here and hit a couple of key points from an implementation perspective why train and I think the slide says it all it's to reduce risk and we've talked about this already the greatest risk to pH is that negligent when you look at where breaches have occurred in the past where they're probably going to happen in the future when you look at the individuals who are handling it most people are doing something else whether you're a health care provider or you're in the collection area or you're developing applications and medical devices your focus is more on something else it isn't necessarily on security and privacy so one of the key things is to keep the training as straightforward and simple as possible and also focus it on what you really need to do too much training talks about the requirements and and they train on hip-hop what you really want to train on is what's a good password what's going to prevent a problem what are the standard things you need to do every day why is access control important why is it important to do vulnerability scanning so that people really understand why it's a risk and then they'll put more importance in it as they go forward so who when where what are some of the things it's not just full-time employees but you also want to Train part-time temps contractors you want to make sure they understand it because when you look at this they're going to be touching all the data they have access to it if they are not trained you're just setting yourself up for potential problems so you really do want to look at not just your full-time employees but anyone else who might be touching pH I when it's not a one-time-only process we really need to do it on onboarding with new employees but then on a regular basis so as things change there's helping like putting out little announcements on a regular basis with some highlights what good access control is have you changed your password lately just things to keep people thinking and building a culture within the organization that security and privacy is important and then you can do it all a lot of different ways it can be on-site classroom training I really believe the better way is elearning because people can do it when they want it can be focused they can go back to it multiple times and hopefully they walk away with more than if it's just an on-site classroom training the other thing it's always good is if you can show real example so their solutions you can show what vulnerability scanning is you can show a tool like we're going to show very quickly here just some screen prints so that people can really get something they take away from from the training so one thing that can make the effort easier and you can do this all by hand and we were talking about high trust that has requirements and it's basically a methodology and there's certain things you have to do but when you look at that it is very manual what really does make a job easier is if it's an automated solution so very quick we were just going to talk about some of the highlights that hit the high tech Express we like to call it the TurboTax and compliance but the main real key here is we've changed the paradigm and I think this is what you want to look for in any solution or anything you use it has it been changed from a technical solution to something you can really use and what's been done here is the requirements have all been turned into a clock into questions so instead of having pages and pages or requirements to look for everything is in very straightforward yes/no type of questions there's help as you go about it so you can really get a feel for this is what I really need to do and I think most organizations and we hear this every day and Adam knows as to well they just want to do what they really have to do tell me what I really need to do to be secure don't tell me everything in the world because that's not what I am is my organization so that's really what we've tried to do here and as you go about the task focus in on what kind of organization you have and what is really important to protect yourself reduce the risk of a breach and be ready for an audit so if I check Express it's an all-in-one SAS solution the concept behind it is as we mentioned the questions kind of tell you how you're doing how are you doing against the requirements where are your gaps that then drives to a scoring and analysis a very simple and we're using a prioritized approach so you take and you determine what are my real risk what's my priority it's going away from the traditional Big Bang all-encompassing approach to whatever my real risk it's what PCI is done it's what sarbanes ended up doing I'm saying okay let's focus in on our biggest risk and then we'll get to the other items as we can after that first pass it has a work plan of remediation so unlike a lot of solutions out there or spreadsheets that just do assessments this actually helps you go through the process drives you through the process just like TurboTax tells you exactly what you need to do step by step and then very valuable and we heard at a conference last week one of the individuals using the solution said the template library the documents are like gold because you don't have to do them yourself you don't have to reinvent the wheel it's all here for you any document at all that you might need to be compliant or you might need to show to an auditor and it's all in a nice library so it's all available if the auditors can go right there and look at it if they want you can access it very quickly as a person who was an IT auditor in one of my lives there's nothing like being able to show an audit or something quick and they'll move on to the next but if you can't show it that's when they start asking for this and that and they really can become very burdensome to your business and your operations I Jeff Paul spelled who's familiar with the solution he's used it maybe he could add a couple of words on you know the value and also you know from an organization what they can really you know attain from this so I think the the takeaway from this is that not only do you have to say that your organization is HIPAA compliant but you have to prove that it's HEPA compliant just like if you're audited by the CFPB or anyone else who comes in if you don't have written policies and procedures in place and available no matter what you do you're no longer in compliance that's the bottom line it's that way for providers even if they follow the letter of the law if it's not written down and accessible to some who comes in you are not in compliance and that's a problem for all of us it's a problem for your physicians is a problem for all of us whether you're medical biller or a collector or developing technology that's going to be interoperable with your electronic health records and your devices so all of these things make it very vulnerable to be able to access personal health care information and what we've tried to do is understand the perspective of both the physician and the business associate and say how do we do this and live in a world with all these regulations and still do business and do business efficiently this is the answer thank you Jeff and I think the real key here and I'll say this too is it's if you can get all this and you can save time and money and it's very straightforward easy to use the organization is more likely to use it and follow it and that's really the the concept behind it so we like to it with this and then we'll open it up for questions and really for any of the people home on the phone the time is now I think organizations have this tendency to wait and saying well maybe this is all going to pass but it's not going to people are asking more and more business partners are you HIPAA compliant are you secure when you look at the healthcare industry it's in a growth mode and there's no end in sight to that so the opportunity opportunities are huge so it's a real chance for you to take advantage of it we got a question on the cost it's a very reasonable solution and it really comes in two components there's the solution itself and there's a varying rate depending on the size and complexity of the organization but it really is in the the range of 1,500 to 2,000 dollars and up so it's a very reasonable solution tied to that and we find this is really a key to success we provide coaching through the process and it can be as little as an hour a week but it helps you really go through the process we answer questions we provide a lot of the technical guidance the solution has been designed if you're really a very technical savvy organization you can do it on your own but what we see is the groups that have the most success they have some guidance here because it keeps them going you don't get frustrated there's an answer and it also gives you goals that you need to attain each day yeah so we have another we have another question about is the tool help you as ba understand what subcontractors to you I also need to sign this does it yeah and so I'll sort of expand what Robert was saying so we've actually when you see the solution you see it from one perspective but we have to essentially mirroring solutions one is for covered entities and one is specific for business associates so while the one for covered entities helps those organization analyze who their business associates are it the mirroring one the business associates specific one all the policies on the templates are drafted specific for business associates for their needs it also helps them analyze specifically who their business say who their business associates who their subcontractors would be and helps them negotiate those relationships and those contracts along the way so we've taken some great pains in many instances to know to sort of develop the content-specific for business associates but I think it's definitely necessary we've seen a lot out there that's really focused on covered entities exclusively well and a lot of times that's helpful there's a lot of nuances that business associates must be aware of and you know really don't apply to covered entities themselves so and I would just add one other thing to this from the VA perspective we have a whole stream of documents that have been tailored to be a so it's not just that there's different activities that you do but the documents have actually been tailored for what a BA needs to see and do versus what a provider might have and obviously there's different things a VA may not need notice of privacy practices to give to a patient so we've tailored everything to those two views and it's I think that's one of the nice things about the way the solution has been designed it's not hard coded for anybody whose program everything is very flexible so we can tailor it not just to bas but to different states and different requirements that might be there so I'm going to do one final call for questions if anyone has questions we've got about two or three minutes remaining we can get probably a couple more in I do have one other question and then we'll do something some closing remarks so this this question is really directed at either dr. Haas Feld and/or Nancy and it's really the question is you know you both are touched on you know help the physicians out and sort of using your preparation the safeguards that you have in place as a business associate to draw to draw to help develop business and I guess the question is functionally you know what do you show covered entities or potential business opportunities I mean would you would you recommend I mean we're not missing you know you're not necessarily going to show them all of your documentation but what's the best way to to show to a potential opportunity business-wise that you know what take HIPAA seriously and I have my house in order well the HIPAA hi-tech Express is a great example of what you can show to a potential client in terms of the steps that you've taken and one of the things that that you know everyone has to realize is that this is not just dedup downloading documents this does take some work on your behalf from the people on your staff in order to make sure that these things happen otherwise you just you just have a pile of documents but you don't have the procedures in place and the security measures in place so there are things that you will have to do in order to get to that level of compliance and then if you can show a potential client here's what we do because we have a culture of security and privacy in our medical billing firm in our medical collections firm in our medical technology firm and we understand that you have to manage that we're going to help you do that it becomes a very easy proposition for the hospital the ambulatory surgery center or the single physician to be able to look at it understand it and say that he trusts you and you verified that trust so doctor hospitals from your perspective as a physician if a potential vendor came to you and said preemptively you know hey I've got I know I'm a business associate and you know here's what I'm doing to protect any data that it is that I'm provided actually for me I mean is that something that that would be viewed as pressive good or otherwise I don't know I think that's something that th
t is viewed as a requirement now you can't just take somebody's word for it that they've met you know that their shop is HIPAA compliant you need to show me something you need to show me what you've done in order for me to be able to say you know I you know I've done my vetting that this person you know has taken the appropriate measures to pho safe and secure and for us as business associates we have to realize we no longer get off the hook it used to be that if a business associate had a breach the the covered entity could say well we're going to just fire you if you don't rectify the breach now we're liable they can come after us just as they do the the providers and they're not coming after us with you know five and ten thousand dollar fines they could potentially come after you with with hundred thousand and a million dollar fines if it's repetitive and the nature of the fun nature they of the above the breach yeah I mean that's that's very true one thing I was remiss in not mentioning before is the fact that as you touch on business associates are now primary are have direct liability and can be fined directly by OCR by state agencies as well as you know talking about litigation and I believe it's the third largest fine HIPPA related fine is for a business associate so and traditionally that was not the case it would be fine that would that would it would be the covered entity themselves it would be fine but now the fines go directly to the business so we're a couple minutes over I do want to thank everyone for joining as I mentioned a couple times earlier I will email everyone a copy of the deck as well as a recording I just need to wait for that to post up and as well as a copy of the business associates sample business associate agreement which is actually taken directly from HIPAA hi-tech Express you'll get a feel for exactly what the documents look like enough's as Dr Haass spelled mentioned it is you know it is something that you have to put some work into so we we sort of tee it up every place you need to make a decision which is a lot more helpful than a blank page and you know just start drafting so on that if there are no more questions you'll have our contact information it's on this last slide continue to ask us questions as they come up regarding whether you're business associate or you may have a subcontractor you're not sure where they fall or any other questions you have along the way so my behalf of want to thank all the presenters Robert dr. Haas valid and Nancy and thank everyone who is who joined us today and we'll send out that email tomorrow and let us know if you have any questions going forward thanks everyone thank you
