Archive for Compliance Monitor
Q: How does CMS handle a Health Insurance Portability and Accountability Act (HIPAA) complaint once received?
A: Upon receipt of a complaint, CMS will notify the filed against entity of the complaint, and provide them with an opportunity to demonstrate compliance, or to submit a corrective action plan. CMS has the discretion to conduct compliance reviews or on-site evaluations of covered entities' procedures to verify that they are compliant with the standard transactions or use the national identifiers. CMS also has the authority to impose financial penalties on any entity that is not compliant and has failed to correct their systems.
This Q&A is adapted from the CMS FAQ website page. To view this and other FAQs click here.
2. No
3. I don’t know
To submit your answer, go to “Quick Poll” at HCPro’s Corporate Compliance Web site.
Q: Is a business associate (BA) that discovers a breach ever responsible for notifying the individual(s) affected, media outlets, or HHS? Or does the BA only have to notify the covered entity (CE)?
Q: Are we required to “certify” our organization’s compliance with the HIPAA Security standards?
A:
No, there is no standard or implementation specification that requires a covered entity to “certify” compliance. The evaluation standard § 164.308(a)(8) requires covered entities to perform a periodic technical and nontechnical evaluation that establishes the extent to which an entity’s security policies and procedures meet the security requirements.
The evaluation can be performed internally by the covered entity or by an external organization that provide evaluations or “certification” services. A covered entity may make the business decision to have an external organization perform these types of services. It is important to note that Health and Human Services does not endorse or otherwise recognize private organizations’ “certifications,” and such certifications do not absolve covered entities of their legal obligations under the Security Rule. Moreover, performance of a “certification” by an external organization does not preclude Health and Human Services from subsequently finding a security violation.
This Q&A is adapted from the CMS FAQ website page. To view this and other FAQs click here.
- Inform patients of their rights and how they can exercise them
- Disclose the organization’s privacy practices
- Detail the organization’s responsibilities under the law
- Inform patients of the uses and disclosures of protected health information (PHI) required or allowed by law
- Explain how patients can access their medical records and modify their information
Get blog updates in your e-mail
Subscribe to our e-zine
Click here to learn how!