HIPAA 2022 – New Guidance and Rule Changes

Format: On-Demand Webinar
Presenter: Jim Sheldon Dean
Duration: 90 Minutes

HIPAA has seen a lot of activity recently, from a new push to provide individual access to records, new limits on those rules from the courts, new enforcement actions pertaining to access, and new regulations to complement the HIPAA rules for access. Business Associate responsibilities for compliance have been better defined, and requirements for the establishment of those relationships have been relaxed in some cases for the COVID-19 emergency, but relaxations end when the emergency ends. Emergency circumstances have permitted numerous communications not normally conducted in order to most effectively provide services during the pandemic. And now new changes to HIPAA have been proposed, to ease access by individuals and sharing of Protected Health Information where appropriate, and try to relieve some of the administrative burdens of the rules. These proposed changes may go into effect in 2021 or 2022.

This session will look at the current state of HIPAA and identify recent guidance and court decisions affecting HIPAA, as well as expected changes in the rules in the coming year, and the focus and results of various HIPAA enforcement actions.

Over many years, the heads of the US DHHS have indicated that patient access of information is a key priority in order to improve the health of the nation. Patient rights under HIPAA have been expanded to include several rights of access, and detailed guidance has been issued on access to records. And more than a dozen of the most recent HIPAA enforcement actions have been against entities that did not provide patient access to records properly. HHS is now using HIPAA Individual Access Rights to effectively implement new rules on prohibitions to Data Blocking.

The rules having to do with patient access of records need to be reflected in every healthcare-related organization’s policies and procedures. The guidance provides clear and detailed information on how to provide access, what can be charged for in fees, and what the individual’s rights are when it comes to access to information. The rallying cry for easy patient access and transfer of information increases daily and is no longer escapable.

At the same time, a recent Federal court decision has changed some of the aspects of the individual access rules pertaining to transmitting records to third parties at the request of the individual. Additionally, HHS has issued guidance when HIPAA Business Associates are involved, regarding the responsibility for the timing, and form, and format of replies to requests for access, and the responsibilities for compliance with the fee requirements. To top it off, individual access rules may be modified under the proposed HIPAA rule changes, reducing the time to provide requested information, and making access easier for individuals.

The COVID-19 Emergency has created new demands on communications and has made clear the need to provide services remotely to the extent possible. Providers need to communicate more, between themselves and with their patients, and the time to implementation of new services to meet these needs is almost zero, leaving no room for the usual processes of approval and adoption that health care is used to. In order to facilitate the delivery of services and necessary communications during the emergency, the US Department of Health and Human Services has issued guidance relaxing some HIPAA requirements pertaining to teleconferencing tools and reiterating HIPAA allowances for communication with family and friends of patients.

Social distancing to help prevent the spread of the novel coronavirus is effective, but patient care has typically required a face-to-face encounter, which can cause the spread of the virus as infected individuals travel to and from appointments. It is essential to be able to provide telemedicine services in order to reach most individuals without risking more harm. HHS has announced the relaxation of enforcement pertaining to the use of teleconferencing technologies to provide remote medical services, allowing the use of such services to expand quickly, but limits on “public-facing” conferencing technologies remain. Providers need to adopt the necessary technologies without fear of HIPAA violation enforcement actions during the COVID-19 Emergency and must understand the limits of what is permitted in order to best serve patients and their families.

HHS has also issued guidance to remind healthcare providers of the allowances for communications with family and friends, with disaster relief organizations, and to prevent a serious and imminent threat to the health or safety of individuals or the public.

This session will discuss the issues surrounding the use of various communication technologies under HIPAA controls, and the recent guidance and declarations from HHS about HIPAA, and the response to COVID-19, including a discussion of Business Associate responsibilities for compliance under new guidance from HHS.

Learning Objectives:

• Learn about the new proposed changes to the HIPAA Privacy Rule and how they may affect your operations.
• Understand the guidance and apply the HIPAA rules on providing information under the regulations for individual requests for PHI, and learn how the process may be changing under the proposed rules.
• Know the extent of the limitations on the fees charged to individuals for access of their records, and the new changes according to a Federal Court ruling.
• Understand how individual requests to direct their information to a third party are treated differently, and differences when paper vs. electronic records are requested.
• Know what parties are responsible for compliance with the timeliness, form, and format requirements for individual requests, and what parties are responsible for the fee requirements for individual requests of PHI.
• See how entities that have not managed individual access properly have been sanctioned by the US Department of Health and Human Services.
• Understand how the new rules on data sharing work with the HIPAA individual access rules.
• Learn about communication needs during the Emergency.
• Find out about the types of Telemedicine and Teleconferencing technology, and HIPAA requirements.
• Learn about the Relaxation of Enforcement of some HIPAA rules to facilitate communication.
• Find out about the rules for permitted communications with Family and Friends of patients.
• See how HIPAA allows communications that are necessary in First Response circumstances, disclosures to Disaster Recovery agencies, and disclosures to Prevent a Serious and Imminent Threat.

Areas Covered in the Session:

• Proposed New Changes in HIPAA Privacy Rule
• Recent guidance and declarations from HHS about HIPAA and the response to COVID-19
• Types of Telemedicine and Teleconferencing technology, and HIPAA
• HIPAA Individuals Access Rules
• New Changes according to Federal Court Ruling
• Communication needs during the Emergency

Suggested Attendees:

• Healthcare CEO
• Healthcare CFO
• HIPAA Privacy Officers
• HIPAA Security Officers
• Information Security Officers
• Risk Managers
• Compliance director
• Compliance Officers
• Health Information Managers
• Information Technology Managers
• Information Systems Managers
• Medical Office Managers
• Chief Financial Officers
• Systems Managers
• Chief Information Officer
• Healthcare Counsel/lawyer
• Operations Directors
• Medical offices
• Practice groups
• Hospitals academic medical centers
• Insurers
• Business associates (shredding, data storage, systems vendors, billing services, etc.)
• HR Manager
• Records Release Manager

About the Presenter:

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities. He is a frequent speaker regarding HIPAA, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference. Jim Sheldon-Dean has more than 39 years of experience in policy analysis and implementation, business process analysis, information systems, and software development, and eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Jim Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.

After Registration: You will receive an email with login information and handouts (presentation slides) that you can print and share to all participants at your location.

System Requirement Operating System: Windows any version preferably above Windows Vista & Mac any version above OS X 10.6

Internet Speed: Preferably above 1 MBPS

Headset: Any decent headset and microphone which can be used to talk and hear clearly

Can’t Listen Live? No problem. You can get access to an On-Demand webinar. Use it as a training tool at your convenience.

For more information you can reach out to the below contact: Toll-Free No: 1-302-444-0162 Email: support@skillacquireupdate.com