The buzz surrounding HIPAA in contact centers is getting louder, and with good reason: As of September 23, 2013, healthcare providers, health plans, other HIPAA covered entities and their business associates must comply with the new Privacy and Security requirements. Those who fail to comply by the deadline or experience breaches in customer data security may face with substantial fines and penalties.
This blog post will be one of several regarding HIPAA, and what we (software vendors and users) must do to comply with it. To ensure we all have a basic and common understanding of HIPAA, this first blog post will address some general definitions, including how Startel and our customers are designated per HIPPA and how the Privacy and Security Rules apply to us.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. These Rules help to protect the privacy of individual’s health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care.
Before we can discuss the HIPAA Privacy Rule and HIPAA Security Rule, we must mention who these Rules apply to.
Covered Entities and Business Associates
The HIPAA Rules apply to both covered entities and business associates:
Covered Entity (CE)
: CEs are basically any person, business, or government entity that furnishes, bills, or receives payment for health care in the normal course of business. Examples include physicians, hospitals, pharmacies, health care clearinghouses (billing services) and health plans/insurers.
Business Associate (BA)
: A business associate is a person or organization that performs a function on behalf of a covered entity. Examples of a BA include software vendors (such as Startel), third-party billing companies, claims processors, collections agencies, and outsourced contact centers. BAs must also agree to the privacy and data security requirements of HIPAA. A business associate could be a contact center outsourcer that handles calls for a covered entity or a collection agency working on their behalf.
Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules’ requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information. In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules.
The Standards for Privacy of Individually Identifiable Health Information, also known as the Privacy Rule, establishes a set of national standards that protects individuals’ health information – called “protected health information (PHI)”. PHI is “any health information that is individually identifiable”. Examples include an individual’s name, date of birth, social security number, address, as well as health status and payment/billing information. The Privacy Rule addresses the use and disclosure of PHI whether in written, oral, or electronic format by covered entities. It also sets standards for individuals’ privacy rights to understand and control how their health information is used.
The Security Standards for the Protection of Electronic Protected Health Information, or the Security Rule, is a national set of security standards for protecting certain health information that is held or transferred in electronic form (ePHI). The Security Rule addresses the technical and non-technical safeguards that covered entities must put in place to secure individuals’ ePHI. Technical safeguards include access control, audit controls, integrity controls and transmission security. Each of these technical safeguards can be addressed with software solutions, including encryption technology and secure messaging.
In March 2013, the long-awaited Omnibus Rule made the most sweeping changes since the HIPAA Privacy and Security Rules were first implemented. The new rule expands the definition of a business associate to include “any downstream subcontractor that creates, receives, maintains, or transmits PHI on behalf of the business associate.” Business associates and their subcontractors who have access to PHI are directly liable for compliance with the HIPAA Privacy and Security Rules. In addition, among the changes is an enhanced opportunity for the Office for Civil Rights to enforce compliance.
Why am I sharing all of this information to you and why is it important? Since both Startel and our customers (telephone answering services and contact centers) are considered business associates we are therefore:
• Required to comply with the Rules’ requirements, including the Obnibus Rule, to protect the Privacy and Security of PHI. We have until September 2013 to become compliant.
• Directly liable for compliance with certain provisions of the HIPAA Rules. Penalties can be civil or criminal and may cost thousands of dollars and possibly imprisonment.
In my next blog post, I will address how Startel’s solutions address a pressing topic area: Encryption of PHI/ePHI, and specifically, what information/devices must be encrypted to ensure HIPAA compliance.