1. HIPAA Privacy the Morning After - What do we do now?
Healthcare Privacy Roundtable
June 5, 5:00 PM
Ross Hallberg
Chief Compliance Officer and Chief Privacy Official
John Muir / Mt. Diablo Health System

2. The practical, operational reality is always different from the policy
Who actually understood and learned what?
Fixing misunderstandings
- The hype and perspective problems
Communication and resolution of new issues
Follow-up training
What does all this imply for on-going training?
Will all those policies, procedures, and forms we developed actually work?
The practical, operational reality is always different from the policy
author’s perspective
Dealing with new and better ideas on how to do things
Evaluating management’s implementation of policies and procedures
Did we achieve compliance?
If not, then remediation

3. On Organized Health Care Arrangement and Hybrid Entity
Sure glad we did both of these, but did we miss anything?
Are there physician issues just waiting to happen?
Have we adversely impacted patient care or safety?
Somewhere, somehow - seems possible
I hope we are vigilant and speedy in identifying and resolving
Privacy safeguards and Security regulations
Let’s try not to do things over again
But it all has to fit together

4. What are we REALLY going to do about --
Accounting of disclosures
Attaching medical record amendments everywhere
Longer term procedures
- record keeping and documentation - mitigation
- dealing with violations - issue resolution
- management ownership - BA agreements
- policy and procedure ownership and modification
HIS application vendor issues
NOPP tracking, amendment tracking, accounting of disclosures, no information patients, etc.
Did you get any application help on time? We didn’t