Publications For Your Medicare Beneficiaries
New! The Medicare Learning Network (MLN) has released a new product titled Publications For Your Medicare Beneficiaries. This factsheet lists a variety of beneficiary-related publications available to assist providers in responding to patients questions related to Medicare, all of which can be printed and provided to patients. This product is available in downloadable format here. Check it out – links to more than 70 different publications!
The 2007 Physician Quality Reporting Initiative
New! Anew Medicare Learning Network publication titled The 2007 Physician Quality Reporting Initiative (PQRI) (November 2010) is now available in downloadable format here. This booklet is a compilation of CMSs various educational resources relevant to the 2007 Physician Quality Reporting Initiative.
Guidelines for Teaching Physicians, Interns, and Residents
The Guidelines for Teaching Physicians, Interns, and Residents (revised December 2010) is now available in downloadable format here. This factsheet provides information about payment for physician services in teaching settings, general documentation guidelines, and evaluation and management documentation guidelines.
HIPAA EDI Standards Web-Based Training
The Medicare Learning Network is now offering therevised HIPAA EDI Standards web-based training (revised January 2011) for CE credit. The goal of this activity is to provide information to physicians, suppliers, and healthcare professionals regarding electronic billing and other healthcare electronic transactions such as the Administrative Simplification provisions of HIPAA, electronic transaction standards and code sets required by HIPAA, and an overview of the steps involved in the Medicare electronic data interchange process. To take this training, go here and click on Web-Based Training Modules under Related Links Inside CMS. There are 15 other web-based training classes available on the same site.
Understanding the Remittance Advice: A Guide for Medicare Providers, Physicians, Suppliers and Billers
The publication titled Understanding the Remittance Advice: A Guide forMedicare Providers, Physicians, Suppliers and Billers (revised October 2010) is designed to educate institutional and professional providers who bill Medicare with general remittance advice (RA) information. It includes instructions to help you interpret the RA received from Medicare and reconcile it against submitted claims and provides guidance on how to read Electronic Remittance Advices (ERAs) and Standard Paper Remittance Advices (SPRs), as well as information on balancing an RA. This publication may be downloaded here. If you are training an employee to be a biller or post payments, or if you want to understand more about your billing yourself, this is an excellent resource.
Evaluation and Management Services Guide
The publicationtitled Evaluation and Management Services Guide(revisedDecember 2010) is now available in downloadable format from the Medicare Learning Network here. This guideis designed to provide education on medical record documentation and evaluation and management billing and coding considerations. The 1995 Documentation Guidelines for Evaluation and Management Services and the 1997 Documentation Guidelines for Evaluation and Management Services are included in this publication. This is another great resource that you can use to train staff, physicians, and other providers, or to get up to speed yourself if E & M codes are not part of your education or experience.
Image Credits:
Dancing Seniors: Image by StevenM_61 via Flickr
Money Rainbow: Image by TW Collins via Flickr
CLIA (Clinical Laboratory Improvement Amendments of 88) is the basic set of regulations governing all laboratories that test human specimens (with rare exceptions). It is the minimum standard for labs.
CLIA has given deemed status to several other agencies allowing them to accredit labs and inspect the labs in CLIAs stead. COLA is one of these agencies (as are CAP and The Joint Commission). All accrediting agencies must be at least as strict as CLIA, or to phrase it a different way, all accrediting agencies must have the same regulations as CLIA does, and then may add additional regulations on top of the CLIA regulations if they wish.
There is little difference between CLIA and COLA from a regulatory viewpoint. COLA enforces a few more requirements than CLIA does, but the differences are relatively minor. One example is that COLA requires correlation studies be done when a new instrument is installed to compare the new instrument to an old instrument or a reference lab method and CLIA does not. Another is that CLIA requires an overlap of old control lot numbers to new control lot numbers but doesnt specify a number of times they must be run together; COLA requires overlapping old and new 5 times. So there are differences, but it is pretty easy to see that the differences in regulations are not extreme. CLIA publishes their Interpretive Guidelines on the Internet for all to read so you have ready access to the information as to how a regulation is going to be applied; COLA does not and will not share their Interpretive Guidelines (they consider it proprietary information), so understanding how a questionable regulation will be applied is left to a guess or a phone call to COLA headquarters in Maryland.
From a personnel standpoint, there is no difference between CLIA and COLA. COLA follows the CLIA requirements for personnel qualifications and responsibilities, both for moderately complex labs and for highly complex labs.
From an inspection standpoint, there can be notable differences, depending on the state in which the lab is located. CLIA is a federal program but is administered at the state level in each state. While the regulations they enforce are the same, the quality of the CLIA departments from one state to another varies widely. COLA is a nationwide program and the inspectors move freely between states as needed to inspect labs. Both agencies train their inspectors, so in a perfect world all inspections would be the same within an agency. Unfortunately, however, that is not the real life situation. The quality of the inspectors and the inspections they perform can vary widely in each agency. In many states, CLIA is short-staffed so delays are common. On the whole, COLA is probably a little more uniform throughout the country than CLIA is, but CLIA is usually more dependable with post-inspection routine and follow-up than COLA.
The costs associated with CLIA and COLA are pretty much the same. Both base their costs on the number of non-waived tests performed in a years time. All labs pay CLIA a Certificate Feethe cost of renewing the CLIA identification number. And all non-waived labs pay a Compliance Fee to cover the cost of their inspection, but the Compliance Fee is billed by the inspecting agency, so if youre inspected by CLIA the Compliance Fee will be billed by CLIA and if you are accredited by COLA, the COLA fee covers the cost of the inspection.
Several states have state lab regulations on top of CLIA regulations that are enforced. Pennsylvania, New York, Massachusetts, Maryland, Illinois, and California are several examples. Whenever there is state licensure of labs in addition to CLIA licensure, the fees will usually be higher because there will be both a CLIA and a state fee. If your lab is located in a state with additional state regulations, be sure and find out how the state regulations differ from CLIA and/or COLA (depending on which you choose for compliance). And be aware that when CLIA amends a regulation to make it less strict, COLA and/or the state may not follow suit. Also be aware that if your lab fails to maintain accreditation with one of the agencies other than CLIA, they will lose their CLIA Certificate as well unless they can pass a CLIA inspection. The accrediting agencies carry just as much weight as does CLIA.
Whenever I am asked which agency I recommend for a new lab, my answer is it depends In some states, CLIA is absolutely the best choice (North Carolina is one of those states) because the department is very well run and the inspectors are very well trained and highly accessible when assistance is needed. In other states, CLIA is a disaster and COLA is absolutely the best choice (California and Louisiana being two examples). In the great majority of states, it really doesnt matter which agency is chosen because overall they both do excellent jobs.
Consultant Elizabeth Knollmeyer, B.S., MT (ASCP) has over 40 years experience in the laboratory industry. She specializes in financial, operational management and compliance issues for both hospital and physician office laboratories. Libby has a wide variety of experience with her areas of special expertise including financial review and management, Quality Management protocols, Outreach development, compliance and regulatory assistance, lab design and up fitting, lab remodeling, and market research for IVD manufacturers. She works independently and with large consulting groups to provide interim management for hospitals, and serves as adviser to lab equipment and supply distributors. She can be reached at (336) 288-5823 or at eknollmeyer@triad.rr.com.
Most medical facilities have refrigerators, but do you know the guidelines surrounding refrigerators and freezers? Laboratory Consultant Libby Knollmeyer debuts on Manage My Practice with answers to your most-asked questions.
What kind of refrigerator do I need?
If you need to COOL only…
In most cases, a good quality household refrigerator will suffice if the cubic footage is adequate for what needs to be stored and nothing has to be frozen.
If you need to FREEZE and COOL…
If frozen storage is required, either a NON self-defrosting freezer or a freezer designed to maintain constant temperatures will be required. Household refrigerator-freezer combinations are generally not suitable for critical frozen storage since they must get above the freezing point temperature to self-defrost. While most freezer compartments of refrigerator-freezers will maintain -15C (except for the self-defrost cycle), many vaccines and quality control materials require frozen storage at -20C or colder, which a household refrigerator-freezer will NOT maintain reliably.
When frozen storage is required at -20C or below, a freezer designed to maintain extra-cold temperatures will be required. There are some under-counter models which are relatively inexpensive and require much less floor space than upright freezers or chest freezers. If a household freezer is purchased for reagent, quality control, or vaccine storage, a chest freezer is recommended because the cold air does not fall out of the unit when the door is opened and thus the temperature is more stable.
What about small dormitory refrigerators?
Small dorm refrigerators may be used when temperature stability is not a critical issue, but be aware that they do not maintain constant temperatures nearly as reliably as larger refrigerators or refrigerator/freezer units. These are great for any beverages you keep specifically for patients or for cold packs for injuries or injections.
How should I monitor the temperature of the refrigerator or freezer?
If refrigerated or frozen storage is required by a manufacturer, staff members should monitor and document the temperature of the refrigerator and/or freezer on a daily basis. If the monitored temperature is outside the range provided by the manufacturer, corrective action must be taken and documented to remedy the problem.
For refrigerators and freezers, thermometers suspended in a liquid solution are preferable to one that measures the temperature through the air in the unit since they do not react immediately to the opening of the door or temporary removal of the thermometer to be read. The thermometer used should be either National Institutes of Science and Technology (NIST) certified or NIST traceable. The laboratory or med-surg vendor can assist with selection of a reliable and acceptable thermometer.
Remember that state-supplied vaccine programs as well as accreditation agencies such as Commission on Office Laboratory Accreditation (COLA), Clinical Laboratory Improvement Amendment (CLIA) and Joint Commission on Accreditation of Healthcare Organizations (JCAHO) require cooling/freezing documentation. Many vaccines and medications are also extremely expensive, so it behooves the practice to protect that investment. A sample form to document temperatures is available here.
What if the power goes out?
Transfer the materials to a refrigerator that is operable, if possible, or keep everything in coolers with ice packs. For frozen materials, especially medications, it is imperative that the frozen state be maintained to preserve the integrity of the materials. Long term power outages (e.g. hurricanes or major winter storms) are a real problem. If that is common in the practices area, it would be worth the money to purchase a generator.
Could the power go out without me knowing it and the contents be compromised?
Yes, the penny method is to sit a penny on top of an ice cube or small container that youve frozen water in. If the power is out long enough for the contents of your freezer to thaw, the ice cube will melt. This will cause the penny to drop to the bottom of the ice cube tray – so check the position of the penny daily. If everything has refrozen but the penny is at the bottom of the ice cube, then everything probably thawed to an extent where it is now unsafe to use.
What is the rule about storing medical supplies, medication or vaccines in a refrigerator or freezer with drinks or food?
Dont do it. Ever.
Consultant Elizabeth Knollmeyer, B.S., MT (ASCP) has over 40 years experience in the laboratory industry. She specializes in financial, operational management and compliance issues for both hospital and physician office laboratories. Libby has a wide variety of experience with her areas of special expertise including financial review and management, Quality Management protocols, Outreach development, compliance and regulatory assistance, lab design and up fitting, lab remodeling, and market research for IVD manufacturers. She works independently and with large consulting groups to provide interim management for hospitals, and serves as adviser to lab equipment and supply distributors. She can be reached at (336) 288-5823 or at eknollmeyer@triad.rr.com.
Note: I get great pleasure in finding resources for my readers, and today I have a showstopper! Carol Flagg is co-owner of HITECH Answers and is visiting Manage My Practice to announce a free resource for eligible providers and hospitals.
*******************************************************************************************
For the past two years HITECH Answers has been a vendor neutral resource for education on details of the HITECH Act. In that time, weve amassed a significant library of recorded webinars for viewing, along with a body of exclusive white papers and research.
But the time for analyzing the HITECH Act has ended. Similar to the purpose served by the 62 Regional Extension Centers (RECs) , our goal is to support as much as we can the process of adoption of a certified EHR system that meets meaningful use criteria. Given the sheer number of health care providers needing significant help and guidance through this process, we have transitioned our existing web-based subscription model to function as a Virtual Extension Center.
This Virtual Extension Center, or VEC, supports health care providers and hospitals looking for education and analysis throughout the HITECH life cycle in a 100% virtual environment. In a nutshell, our VEC widens the education circle and opportunity for all Eligible Professionals and Eligible Hospitals. Weve also made membership to our VEC completely free for EPs and EHs for the entire life cycle of the HITECH Act.
So what, exactly, is the VEC? And how does it function?
First and foremost, this newly created VEC houses all of the existing recorded training material and research accumulated over the past two years. This information is readily accessible upon members logging on to HITECH Answers. Heres what has been added to round out VEC membership:
- Meaningful Use for EPs and EHs Live webinar events hosted twice a month that focus specifically on the details for achieving Stage 1 meaningful use for EPs and EHs.
- Upcoming live web casts on tax implications for incentives for EPs and EHs, workflow, ICD-10 migration, HIPAA security assessment, the pros and cons of SaaS, EHR contract negotiation and more.
- Live web cast for our VEC members who are vendors and HIT consultants that address pressing topics and needs in conducting business in this industry.
- Attendance to live webcast interviews and presentations from leading national experts.
- Access to exclusive white papers and research found only in our VEC.
- Direct access to independent experts to help answers your specific questions.
An obvious large part of the VEC will be our live events. We debut our event offerings with these two important topics Meaningful Use for Specialists andEHR Contract Negotiations.
Meaningful Use for Specialists Qualifying for CMS EHR Incentives
January 18, 2011, 7 pm EST
Event summary: A first glance at the Stage 1 Core and Menu Set objectives makes sense for primary care, but what about specialists? How can Psychiatrists, Oncologists, Radiologists, Urologists, and other specialists meet the requirements and objectives outlined in CMS EHR Incentive Program? EPs that are specialists can still achieve the CMS incentives based on the flexibility that is incorporated into two primary areas: Menu Exclusions and Quality Measures.
EHR Contract Negotiations: Q & A with William OToole, OToole Law Group
January 25, 2011, 7 pm EST
Event summary: The HITECH Act of the American Recovery and Reinvestment Act of 2009 is driving new technology acquisitions unlike anything seen in the healthcare information technology (HIT) sector since Y2K. Specific terms and warranties in Electronic Health Record (EHR) agreements are absolutely essential for the protection of provider customers. Competent and experienced legal advice is extremely important. Get your questions answered in this special Q & A session.
You can visit our Events Page to learn more about these sessions.
And you can learn more about qualifying for a free membership at Become A Member or you can contact me at: carol@hitechanswers.com.
************************************************************
Disclosure from Mary Pat: HITECH Answers sells my book on their site, and I am a Consulting Expert to HITECH Answers.
For more information on the Medicare accreditation requirement for entities billing the technical component for advanced diagnostic imaging (CT, MRI, PET/Nuclear Medicine) effective January 1, 2012, read my post here.
—————————————————————————————–
Medicare Learning Network (MLN) just released MM6912, effective August 2, 2010: Mailing To All Individual Practitioners, Medical Groups and Clinics and Independent Diagnostic Testing Facilities (IDTF) Who Are Billing or Have Billed For The Technical Component of Advanced Diagnostic Imaging Services
What exactly is an IDTF?
Some suppliers that perform diagnostic tests, other than clinical laboratory or pathology tests, are required to enroll with Medicare as an Independent Diagnostic Testing Facility (IDTF). Not all suppliers that perform these diagnostic tests are required to enroll as an IDTF. Generally, entities can bill for the technical component of the diagnostic tests without an IDTF enrollment if it has the following characteristics:
- A physician practice that is owned, directly or indirectly, by one or more physicians or by a hospital
- A facility that primarily bills for physician services and not for diagnostic tests
- A facility that furnishes diagnostic tests primarily to patients whose medical conditions are being treated or managed on an ongoing basis by one or more physicians in the practice
- The diagnostic tests are performed and interpreted at the same location where the practice physicians also treat patients for their medical conditions
- If a substantial portion of the facility’s business involves the performance of diagnostic tests, the diagnostic testing services may be a sufficient separate business to require enrollment as an IDTF. In that case, the physician or physician group practice can continue to be enrolled as a physician or physician group practice but are also required to enroll as an IDTF. The physician or group can bill for professional fees and the diagnostic tests they perform on their patients using their billing number. Therefore, the practice must bill as an IDTF for diagnostic tests furnished to Medicare beneficiaries who are not regular patients of the physician or group practice.
Who will receive a mailing?
Enrolled physicians, non-physician practitioners, including single and multi- specialty clinics, and IDTFs who have billed the Medicare program for the technical component of advanced diagnostic testing services within the preceding six month period and who continue to have Medicare billing privileges with Medicare contractors (carriers and Part A/B Medicare Administrative Contractors (A/B MACs)) are affected.
Image via Wikipedia
If you have billed the Medicare program for the technical component of advanced diagnostic testing services within the preceding six month period and continue to have Medicare billing privileges with Medicare contractors, you will receive a letter from your Medicare contractor advising you of the need to become accredited by January 1, 2012, in order to continue to provide these services and bill Medicare.
When more than one physician or non-physician practitioner is operating within a group, such as a single specialty or multispecialty clinic, only the group will receive the letter, not each of the individual physicians or non-physician practitioners working for the group.
What will the mailing say?
You must be accredited by one of the three Centers for Medicare & Medicaid
Services (CMS) approved national accreditation organizations by January 1, 2012,
in order to be eligible to continue to furnish the technical component of advanced
diagnostic testing services to Medicare beneficiaries and submit claims for those
services to your Medicare contractor.
Your contractor will be mailing the letter quarterly beginning with July 2010 through July 2011. If necessary, follow the instructions in the letter to become accredited by January 1, 2012, in order to continue billing for the technical component of advance diagnostic imaging services. Make sure that your office staffs are aware of these new accreditation requirements and begin the accreditation process as soon as possible to protect your Medicare billing rights for these services.
Why do IDTFs have to become accredited now?
Section 135(a) of the Medicare Improvements for Patients and Providers Act of
2008 (MIPPA) amended section 1834(e) of the Social Security Act and required
the Secretary, Health and Human Services, to designate organizations to accredit
suppliers, including but not limited to physicians, non-physician practitioners and
Independent Diagnostic Testing Facilities, that furnish the technical component
(TC) of advanced diagnostic imaging services.
What qualifies as an advanced diagnostic imaging procedure?
MIPPA specifically defines advanced diagnostic imaging procedures as including:
Diagnostic magnetic resonance imaging (MRI),
Computed tomography (CT), and
Nuclear medicine imaging, such as positron emission tomography (PET).
MIPPA expressly excludes from the accreditation requirement x-ray, ultrasound,
and fluoroscopy procedures. The law also excludes from the CMS accreditation
requirement diagnostic and screening mammography, which are subject to quality oversight by the Food and Drug Administration under the Mammography Quality Standards Act.
How long does it take to become accredited?
Since CMS expects that it may take as much as nine months from the time you initiate the accreditation process to completion, you should begin the accreditation process for advanced diagnostic imaging services as soon as possible, but not later than March 2011.
Who are the accrediting organizations?
CMS approved three national accreditation organizations — the American College
of Radiology, the Intersocietal Accreditation Commission, and The Joint
Commission — to provide accreditation services for suppliers of the TC of advanced diagnostic imaging procedures. The accreditation will apply only to
the suppliers of the images themselves, and not to the physician interpreting
the image. All accreditation organizations have quality standards that address the safety of the equipment as well as the safety of the patients and staff.
If you have questions, contact your Medicare carrier and/or A/B MAC at
their toll-free number, which may be found here (zip file.)
Image via Wikipedia
Image via Wikipedia
The letter will look like this:
[DATE]
[Supplier Name and Address]
Dear Physician/Non-Physician Practitioner/IDTF owner:
In accordance with Section 135(a) of the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA), suppliers, including but not limited to physicians, non-physician practitioners and Independent Diagnostic Testing Facilities that furnish the technical component (TC) of advanced diagnostic imaging services must be accredited by January 1, 2012 in order to continue to furnish these services to Medicare beneficiaries.
Our records indicate that you have furnished advanced diagnostic imaging procedures such as diagnostic magnetic resonance imaging (MRI), computed tomography (CT), and nuclear medicine imaging such as positron emission tomography (PET) within the last six months. If you are not accredited by one of the organizations shown below by January 1, 2012, you will not be eligible to bill the Medicare program for advanced diagnostic imaging services. This letter requests that you take the necessary action to become accredited by the January 1, 2012 deadline. Since we expect it can take up to nine months from the time you initiate the accreditation process to completion, we urge you to begin the accreditation process for advanced diagnostic imaging services as soon as possible.
MIPPA expressly excludes from the accreditation requirement x-ray, ultrasound, and fluoroscopy procedures. The law also excludes from the CMS accreditation requirement diagnostic and screening mammography which are already subject to quality oversight by the Food and Drug Administration under the Mammography Quality Standards Act.
The Centers for Medicare & Medicaid Services (CMS) approved three national accreditation organizations the American College of Radiology, the Intersocietal Accreditation Commission, and The Joint Commission – to provide accreditation services for suppliers of the TC of advanced diagnostic imaging procedures. The accreditation will apply only to the suppliers of the images themselves, and not to the physician interpreting the image. All accreditation organizations have quality standards that address the safety of the equipment as well as the safety of the patients and staff. The accrediting organization that issues your accreditation will notify Medicare once your accreditation is complete and approved.
To obtain additional information about the accreditation process, please contact the accreditation organizations shown below.
Image by Jon Olav via Flickr
American College of Radiology (ACR)
1891 Preston White Drive
Reston, VA 20191-4326
1-800-770-0145
Intersocietal Accreditation Commission (IAC)
6021 University Boulevard, Suite 500
Ellicott City, MD 21043
1-800-838-2110
The Joint Commission (TJC)
Ambulatory Care Accreditation Program
One Renaissance Boulevard
Oakbrook Terrace, IL 60181
1-630-792-5286
If you have questions about this letter, contact [carrier or A/B MAC phone number/contact person].
Sincerely,
[Name of carrier or A/B MAC]
******************************************************************
Supplier Billed Advanced Medical Imaging CPT codes for Section 135 (a) of the MIPPA to Receive Accreditation Requirement Notification Letter
70336 70540 71250 72125 73200 74150
70450 70542 71260 72126 73201 74160
70460 70543 71270 72127 73202 74170
70470 70544 71275 72128 73206 74175
70480 70545 71550 72129 73218 74181
70481 70546 71551 72130 73219 74182
70482 70547 71552 72131 73220 74183
70486 70548 71555 72132 73221 74185
70487 70549 72133 73222
70488 70551 72141 73223
70490 70552 72142 73225
70491 70553 72146 73700
70492 70554 72147 73701
70496 70555 72148 73702
70498 70557 72149 73706
70558 72156 73718
70559 72157 7371972158 73720
72159 73721
72191 73722
72192 73723
72193 73725
72194
72195
72196
72197
72198
72200
75557 76360 77011 78000 78811
75559 76376 77012 78001 78812
75561 76377 77021 78003 78813
75563 76380 77058 78006 78814
76390 77059 78007 78815
76497 77078 78010 78816
76498 77079 78011 78891
78015
78016
78018
78020
78070
78075
78099
With so much going on in healthcare, it would not surprise me if a lot of practices missed the February 2010 deadline for three expanded HIPAA rules. This expansion was dictated by the Health Information Technology for Economic and Clinical Health (HITECH) Act passed by Congress in February 2009.
If you haven’t already, get started now with the new requirements.
- New obligations for business associates (BA) – February 17, 2010 Remember that a BA is a person or organization outside of your entity with whom you share protected health information (PHI) so they may provide services to you. Good examples are your billing service, collection agency, attorney, consultant, computer vendors, attorneys and providers of documentation abstracting or coding services. Under HITECH, BA have the same responsibilities for breaches as the healthcare entity does, but it is the healthcare organization’s responsibility to have an updated, signed BA agreement in place that describes this new responsibility. Here is an excellent example of a BA agreement (first link under Publications) that you can download and tweak for your practice.
- New disclosure agreement provision – February 18, 2010 This is a big one! Patients now may waive their right to have you file their medical insurance, pay for your services themselves and request that their medical information NOT be disclosed to their insurance plan or any other entity. In other words, patients may elect to become “self-insured”. I recommend that you create a new financial class for these patients so they neither fall into the standard self-pay/financial assistance class or into their actual insurance class. These patients, if you have any, will need to be identified according to their wishes, which could mean that they want you to file insurance for some services and not for others. This means their record must be tagged for what records can be released and what records cannot. There could be an argument made either way for whether or not these patients should receive self-pay discounts that you have in place for your non-insured patients. I would be interested to know how different groups have decided to handle this. There are sample forms for PHI disclosure accounting and for patients to request an accounting of PHI disclosures in the Manage My Practice Library under Operations.
- Information breach notification – February 22, 2010
We’ve heard a lot about this one as the media (along with HHS) must now be notified if a PHI breach involves 500 people or more. Breaches are being reported weekly as non-encrypted laptops are stolen or repurposed, and as copier hard drives (story here) go unnoticed as a security risk. If a breach involves 500 people or less, each individual must receive written notice with details of the breach, the information disclosed, and the steps being taken by the practice or entity to avoid any future breaches, as well as explaining the rights of the patient(s) in protecting their private healthcare information. Several of my employees have received notification letters from health plans and they have been horrified that this could happen. Note that entities that secure health information through encryption or destruction don’t have to provide notification in the event of a breach!
Enforcement is also beefed up.
Criminal penalties will apply to covered entities that violate privacy rules AND to those organizations individual employees (can you track who accesses whose records when?) Civil penalties have been increased and harmed individuals may share in the booty. Probably most importantly, HITECH gives state attorneys general the power to enforce HIPAA rules.
Other resources:
