1. Select Questions to ask your HIPAA Privacy Officer
HITSS It Out of the Park
April 8, 2015

2. Wi-Fi Access NOT so you can play your Candy Crush
Wi-Fi Access NOT so you can play your Candy Crush!!!! SSID: Events Password: ccjf2015 you should not have to login as long as you see the Event in your available WiFi list

3. Tweet me your questions @brandonho13 Or Text me at 808 277-8231

4. How much do you want us to pay you? Would $1 Million/year be enough?

5. Would you like to work fewer hours?

6. Are we confident in our workforce education program for Privacy and Security?

7. Challenges
Are workforce members actually getting the training or are they just clicking through to get a cert?
Is our training targeted and appropriate?
One size fits all?
How often do we train? How often do we revise our training?
Are we truly engaged?

8. What are the breach notification policies and procedures?

9. Challenges Does everyone know what to do? Who to contact?
Public notification? What are the rules?
500 is the magic number
Not sure? Then you’ve probably hit the magic number
Err on the side of caution?
Can your organization take that kind of hit?

10. Are mobile devices and laptops that store, transmit, and access PHI secured with encryption?

11. Challenges Personal devices are ubiquitous
What is the policy for personal devices?
Are those devices encrypted?
What is your policy for laptops, mobile devices, systems, etc?
Are you up-to-date on the most recent technologies?
Remember, encrypted=no breach!

12. Is the sanctions policy of HIPAA being applied as written?

13. Challenges 4 tiers of sanctions for the CE
What are the sanctions for employees?
Civil lawsuits?
No right of action against the CE…may not be true anymore.

14. Has our organization updated our business associate agreements?

15. Challenges Expanded definition of who a CE is.
Now includes subcontractors, health information organizations, e-prescribing gateways, data transmission services on behalf of a CE, Personal health record (PHR) vendors
Liability and responsibility is now equal on all parts.
Can your organization sustain that kind of hit?

16. How current is our Risk Analysis Documentation as required by the Security rule?

17. Challenges Examine potential threats and risks
Mitigated? Transferred? Accepted?
Size matters!
Can you absorb those costs?
Can you afford not to?

18. Is the new right to request restrictions policy fully implemented?

19. Challenges Paid in full, out of pocket?
Request for restriction needs to be honored.
Has this been appropriately communicated to providers and your ROI section?
Has your NoPP been revised to inform patients of these changes?

20. Out of the box!

21. How can Privacy and Security be revenue generators?

22. Smaller vendors…what can we do?

23. Time for your questions:
Feel free to shout them out or send them to me via text or tweet.

24. Tweet me your questions @brandonho13 Or Text me at 808 277-8231