How to Decide which HIPAA Policies You Need to Adopt
October 2, 2014 - online event CA USMentorHealth
webinars@mentorhealth.com
Phone:8003851607
Fax:302-288-6884
Overview: The webinar will explain the process for covered entities and business associates to use to decide which policies to draft, adopt, implement, and enforce to achieve HIPAA compliance and the process for deciding what should go into each policy. Writing a policy is easier than one may think. It is a three-step process: researching, drafting, and revising. This webinar will teach you to ask questions, solicit help, collect samples, keep the principles of substance, organization, coherence, style, and correctness in mind while you are drafting, send your draft out for review, incorporate comments, implement the policy, and repeat as necessary. The prospect of developing and writing perhaps as many as 70 policies to attain HIPAA compliance may still seem daunting, but this webinar will teach you how to make a checklist, take it step by step, and enlist the help of others when you need it. Part of that first step is figuring out which policies you may need and why. Why should you attend: The majority of the DHHS civil money penalties and settlements in lieu thereof involve, sometimes with other violations, failure to perform a written risk analysis, failure to develop required policies, and failure to conduct adequate HIPAA training. These penalties usually are in the seven-figure range. Failure to conduct a written risk analysis, adopt required policies, or conduct required training qualifies as "willful neglect," which carries the highest civil money penalty ("CMP") and which penalty cannot be waived by DHHS as can violations due to a reasonable cause. DHHS entered into a settlement with Massachusetts General Hospital for $1 million for a breach involving leaving paper PHI records on a subway. The sanction was because Massachusetts General had not trained its workforce on proper security for PHI taken offsite and did not have a work-at-home policy. Significantly, HIPAA does not even mention working at home, much less specifically require such a policy. Areas Covered in the Session: Background for figuring out which policies you may need: gap analysis and risk analysis to deal with required, addressable, and other policies under HIPAA before you can even begin to figure out how to do the next steps below of figuring out what specifics to put into the policies. Researching Ask questions. Learn why you need to nail down the answers to at least 12 questions before you try to write a policy and how to do so Solicit help. Learn whom to solicit help from both within and outside your organization and when and why and how Collect samples. Learn what samples to collect and from whom Drafting Substance. Learn what substance means and how to achieve it Organization. Learn how to draft a clear beginning, a clear middle, and a clear end Coherence. Learn how to connect your ideas so that readers will not have to wonder where something came from or why Style. Learn how to write for your target audience as simply and clearly as possible Correctness. Learn how to get rid of the static in your writing Revising Review. Learn whom to contact to review your drafts Incorporate. Learn how to resolve disputes and incorporate changes Implement. Learn how to lay out a plan for implementation of the policy, including publishing, distribution, implementing (and perhaps even training the workforce on the policy), and schedule for annual review and revision, if necessary Questions and answers Who Will Benefit: HIPAA Compliance Officers HIPAA Security Officers HIPAA Privacy Officers CFOs CEOs COOs CIOs Human Resources Directors Business Office Managers Alice M. McCart has been an editor for more than three decades and an attorney admitted to practice law in Illinois since 1993. She has master’s degrees in teaching and journalism and enjoys freelance editing, tutoring, and teaching effective writing to adults. She has held positions in the federal government, in professional associations, in the corporate world, in private law practice, and in HIPAA consulting.