HIPAA in the Real World (Part 4): Culture of Compliance

It doesn’t matter how many patients are involved, there’s always a risk that HHS is going to come in.

They could come in proactively or they could come in reactively after a data breach. So it’s really important, more than ever to pay attention. Secondly, physicians and medical groups and healthcare facilities are covered entities and they must understand the privacy and the security rule in some detail to ensure that they are compliant. It isn’t enough to just say oh, we have some policies somewhere in HR, we’ve got a binder and it’s collecting dust. I mean really, those things have to be not only updated but people have to have an awareness.

As I mentioned, a culture of sensitivity of HIPAA practices and understanding of common violations. Understanding of the kinds of things that employees can do and awareness of where files are and what kinds of disclosures are being made. Simply an all-around grasp of what the issues are so that you can spot violations before they occur and then take steps to have the responsible persons within the institution make sure that these things are handled ahead of time.

Remember that compliance includes training the workforce and creating policies and procedures and implementing those. So, as to minimize the risk of data breaches. So it’s not simply having the forms, it’s also making sure that people are trained. That people are aware. That people read these things and that they become really living documents to help the organization ensure that it’s compliant all around.

So to wrap up, HIPAA is no longer something that only large hospital chains need to think about. The HIPAA audits are coming. Every practice and practitioner must be fully responsible for HIPAA compliance.