The HITECH-HIPAA Updates: New Changes to the Regulations, New Enforcement, and Audits

1. HIPAA History and Changes
1. Structure of the HIPAA Regulations
1. Privacy Rule
1. Individual Rights
2. Restrictions on Uses and Disclosures
2. Security Rule
3. Breach Notification Rule
4. Enforcement Rule
2. Origin of Changes to HIPAA
3. Overview of HIPAA Amendments
1. Expansion of Application
2. Individual Rights
3. Restrictions on Uses and Disclosures
4. Breach Notification
4. Scope of Changes
1. History of Implementation
2. Status of Changes
2. HIPAA Business Associates
1. Who Is and Is Not a Business Associate?
1. The Significance of the BA Designation
2. How Business Associates Have Changed Under HIPAA
1. Expansion of Regulations To Business Associates
2. New Kinds of Business Associates
3. Appropriate HIPAA Policies for a Business Associate
4. HIPAA Business Associate Agreements
5. BAs and Security Compliance
1. Risk Analysis and Business Associates
3. Changes to Individual Rights Under HIPAA
1. New Rights Concerning EHRs
1. Copies of Electronic Records
2. Accounting of Disclosures
3. Necessity for New and Updated Policies
2. New Rights on Restriction of Disclosures
1. Requests Must Be Honored
2. Requires New Policies, Processes, EHR Support
3. New Rights Concerning Sale of PHI
4. Changes to CLIA, HIPAA, and Laboratory Information
5. Rewriting the Notice of Privacy Practices
4. New Restrictions on Uses and Disclosures
1. Changes to Minimum Necessary
2. New Marketing and Fundraising Limitations
1. Marketing Definitions Revised, Complicated
2. Necessity to Honor Opt-Outs
3. New Controls on Sale of PHI
4. New Responsibilities for EHRs
1. Must Help Manage Individual Requests, Rights
2. Must Provide Access for Individuals
3. Must Provide Access Reports, Accountings
4. What to Ask Your EHR Vendor About HIPAA

5. HIPAA Enforcement
1. Changes to the Enforcement Rule
1. New Tiered Penalty Structure
2. Willful Neglect of Compliance
3. New Higher Penalties
2. Enforcement Actions
1. Investigations and Settlements
2. What Happens When You Ignore HHS-OCR
6. Preparing for HIPAA Audits and Breach Notification
1. Review of Questions Asked in Prior Audits
2. Expansion of HIPAA Audits Under HITECH
3. Exploration of the HIPAA Audit Protocol
1. Scope of the Audit Protocol
2. Using the HIPAA Audit Protocol as a Tool for Compliance Management and Documentation
3. Policies, Procedures, and the NIST HIPAA Security Rule Toolkit
4. HIPAA Breach Notification
1. Who, What, When, and How
2. Avoiding Breaches
3. Learning from Breaches
5. Using Audit Drills to Be Ready for Audits and Breaches
7. Planning Your Compliance Effort
1. Consider Compliance As A Series of Projects
2. Selecting Your Compliance Team
1. The Importance of Top-Level Support
3. Selecting Your Compliance Management Tools
1. The HIPAA Audit Protocol
2. The NIST HIPAA Security Rule Toolkit
4. Providing and Documenting Training
5. Updating and Maintaining Your Compliance Plans

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a variety of health care providers, businesses, universities, small and large hospitals, urban and rural mental health and social service agencies, health insurance plans, and health care business associates. He serves on the HIMSS Information Systems Security Workgroup, co-chairs the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and co-chairs the WEDI HIPAA Updates and Privacy and Security Meaningful Use sub-workgroups. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at AHIMA national and regional conventions and WEDI national conferences, and before the New York Metropolitan Chapter of the Healthcare Financial Management Association, Health Information Management Associations of New York City, New York State, Virginia, and Vermont, the Connecticut Hospital Association, and the Hospital and Health System Association of Pennsylvania. Sheldon-Dean has nearly 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related Web sites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master's degree from the Massachusetts Institute of Technology.