HIPAA & HITECH Part 1: Policies & Procedures

Analyze a pharmacy case where pill vials containing PHI—names, addresses, phone numbers, doctors' details, and medications—must be disposed of regularly, highlighting HIPAA and HITECH policy implications.

Clarifies HIPAA's administrative simplification, streamlining electronic transactions and PHI and ePHI protection. Covers EHRs, NPIs, and business associate agreements, binding business associates and subcontractors to HIPAA privacy and security standards.

Report case study 1 results: CVS paid 2.25 million. Enact a corrective action plan: revise privacy policies and procedures, train staff, appoint a third-party auditor, FTC monitoring for 20 years.

Evaluates the risks of unencrypted ePHI on fifty-seven hard drives and the implications of storing them and other company documents in a leased facility during the statutory retention period.

Define the key HIPAA principles and how PHI, minimum necessary access, and administrative, physical, and technical safeguards protect health information under HIPAA and HITECH and consent, privacy notice, and authorization.

Blue Cross Blue Shield of Tennessee reported 57 unencrypted drives stolen, exposing over a million subscribers’ data; OCR imposed a 1.5 million penalty and required privacy and security policies, trainings.

Analyze case study of a city hospital's outpatient infectious disease division, serving HIV and AIDS patients and delivering care in off-site community settings.

Build a HIPAA/HITECH compliance foundation by enforcing privacy and security standards, monitoring transaction formats, and translating policies into procedures and workforce training.

Mass General loses 192 patient PHI files containing HIV and AIDS treatment after documents are left on a subway, resulting in a $1 million penalty and a corrective action plan.

Build and monitor a viable hipaa/hitech compliance plan, identify risks and vulnerabilities, and implement well-drafted policies to mitigate harm and support audits.