The St. Rita’s Healthcare System Case Study Val convened the regular meeting of the EIM team.

Use the the St. Rita’s case study in chapter 10 and appendix A in your textbook to answer the following questions. There is a maximum of 8 points. 

1. What are the key takeaways from the case study vignettes in chapter 10?

2. Should Joan or Val have anticipated that the EIM team did not have the necessary experience and diversity and appointed Sheila and Wayne as members of the team earlier?

LIT Chapter 10 Data Security Management The St. Rita’s Healthcare System Case Study Val convened the regular meeting of the EIM team. She was happy to announce that Wayne and Shelia had been appointed by Joan Morton as permanent members of the team. "I thought I knew HIPAA security until I went through and read all of its parts in the regulation text at the HHS website." said Monte. "It seems almost overwhelming." "HIPAA security is a big job," responded Wayne "and that is why I’m thankful that we’re pursuing a DO program at St. Rita’s. I can see the benefits for both security and privacy implementation and mostores through a formal organization of data stewards." "I certainly now understand the need for both a security and a privacy officer," said Fred. "Although pma and security are clearly related. I can definitely see the differences between them. HIPAA Privacy Rules app. to all PHI no matter if it is paper, electronic, or other media, whereas HIPAA Security applies to ePHI "And HIPAA Privacy has so many standards on uses and disclosures of PHI: so many responsibilities with release of information and tracking releases." added Denise. "But I can see where we have to coondans both security and privacy." "Precisely," said Wayne. "Shelia and I work closely together and we work with other compliance official at St. Rita’s including legal counsel, risk management, and human resources. urces. HIPAA must appear seamless to our end users. For example. HIPAA training here at St. Rita’s encompasses both privacy and secure And recently, we’ve implemented one HIPAA hotline for both security and privacy issue resolution In way end users don’t need to think about whom they should contact for help. It’s one hotline. We make decision where to triage the issue once it is received." After finishing their discussion on HIPAA security. Wayne got started on an overview of security plants and management, integrating into his presentation how HIPAA security regul with a listing of strategies typically used and then led into the security area y regulations applied. Wayne started e security organization and security plan. Developing a Data Security Program Healthcare organizations must have protections in place to safeguard their information assets Like protection of business asset, data security should fulfill the needs or requirements of the following: Stakeholders" needs: Includes privacy and confident haniness associates, and stakein Govern

304 AppendixA The Heath mary Figure AL Continued BAs must obtain authorizations prior to marketing. Grandfather clause for BA agreement transition allowing covered entities and BAS to continue to operate under existing contracts that already have a HIPAA-compliant agreement in place with varying compliance deadlines Sale of PHI is prohibited. Sale of PHI means that the covered entity or BA receives payment for the PHI from or on behalf of the recipient of the PHI. Compound authorizations for research are permitted that include informed consent for the research study as well as the use of PHI in the clinical trial. Authorizations for future research for use or disclosure of PHI must adequately describe the future uses or disclosure. Any Individually identifiable health information of a person deceased more than 50 years is no longer considered PHI under the Privacy Rule. Covered entities are now permitted to disclose a decedent’s PHI to family members and others who were involved in the care or payment for care of a decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the CE. Covered entities can disclose proof of immunization to a school where state or other law requires it prior to admitting a student. Written authorization is no longer required, but an agreement must still be obtained, which can be oral Covered entities must provide the recipient of any fundraising communication with a clear and conspicuous opportunity to opt out of receiving any further fundraising communications and the individual’s choice to opt out is treated as a revocation of authorization under the privacy rule. The Notice of Privacy Practices (NPP) must include certain new statements about the uses and disclosure of PHI Requires health plans that post their NPP on their website to update the NPP on the website when material changes are made to the NPP Covered entities must provide individuals with an electronic copy of their PHI. Form and format of electronic copics must be in a machine-readable format Fees for paper and electronic copies may cover labor and supplies, but may not include a retrieval fee. Timeliness for responding to requests for paper and electronic records have been changed. The Breach Notification Rule’s "harm"threshold is removed and replaced with a more objective standard. Source AHIMA 2013. This appendix focuses primarily on the general provisions and modifications to the security rule. Privacy regulations are briefly outlined at the end of this appendix. The effective date for the HITECH regulations w compliance date was September 23, 2013, with the exception of ations was March 26, 2013 and the exception of varying deadlines for business associate agreements As of July 27. 2009, enforcement for HIPAA security compliance was moved from the Centers for for Medicare and Medicaid Services" (CMS] Office of Electronic Standards and Security to the HHS Office for Civil Rights (OCR). The HITECHAS mandates improved er forcement of the Privacy Rule and Security Rule. Enforcement of HIPAA security is taken seriously by covered catities and others who must follow HIPAA security rules. Enforcement results are available for review by Pok beginning in 2003 24 the HHS website. HIPAA Privacy and Security Rules HIPAA Privacy and Security Rules are located in Parts 160, 162. 164. and Subparts A. C. D. and E under Fire Admin urative Simplification provisions. Subpart A includes the gene lodes the general provisions, Subpart C covers the many Standards for the protection of ePill, Subpart D includes the standards for the notification in the cave of a Plil breach, and Subpart E covers the standards covers Subparts C and D in detail since these are spe hards for privacy of individually identifiable health information To4. are specific to electronic data security. Figure A 2 provides the puther of wbparts an a reference tool. Key terms related to HIPAA are listed and defined in the beginning of chapter It

HIPAA Privacy and Security pgore A.2. Outline of HIPAA Privacy and Security Rules continue to operate baker is compliance dalian Part 164-Security and privacy yerent for the PHI Finan ise Subpart A-General provisions $164.102 Statutory basis the research study is well $164. 103 Definitions 164.104 Applicability describe the future meet in $164 105 Organizational requirements $164 106 Relationship to other parts years is no longer considered Subpart B [reserved] and others who were inched Subpart C-Security standards for the protection of cPHI s inconsistent with ary prior $ 164302 Applicability $164.304 Definitions $ 164 306 Security standards: General rules other law requires it prior to $164.308 Administrative safeguards A must still be obtained, which $ 154 310 Physical safeguards $ 164 312 Technical safeguards with a clear and caution 16431- Organizational requirements he individual’s choice to opt out $16431 6 Policies and procedures and documentation requirements 1 164318 Compliance dates for the initial implementation of the security standards It the uses and dicloage of Fin P on the website abcal medd Subpart D-Notification in the case of breach of unsecured PHI $ 164 400 Applicability $ 164.402 Definitions. I. Form and format of cleanser 1 164 404 Notification to individuals 1 164.406 Notification to the media include a retrieval fer. 1 164 408 Notification to the secretary # 164 410 Notification by a business associate en changed. h a more objective standard 1 164.412 Law enforcement delay 1 164 41 4 Administrative requirements and burden of proof sitpart E-Privacy of individually identifiable health information 1 054 500 Applicability 1 454.501 Definitions 154 502 Uses and disclosures of protected health information: General rules the security nuik. Privacy myshows 154 504 Uses and disclosures: Organizational requirements gulations was March 26, 2043 alt 164 506 Uses and disclosure losures to carry out treatment, payment of healthcare operation for business associate zero 164 508 Uses and disclosures for which an authorization is required re Centers for Medicus ed Medical 1 164 510 Uses and disclosures rex res requiring an opportunity for the individual to aprove or to afind Civil Rights (OUR The HITECHAS 164 512 Uses and disclosures for which an authorization or opportunity to upme or object in my mind BL of HIPAA security is taken scion 14 314 Other requirements relating to uses and disclosures of protested health isfruiting it results are available to reviewty gear 154 520 Notice of privacy practices for protected health information M4 522 Rights to request to request privacy protection for probes bed health information 1 154 524 Access of individuals to protected health information 164 436 Amendment of protected health information 1 154 328 Accounting of disclosu isclosures of protected health information 1 154 530 Administrative requirements 14534 Compliance dates for initial implementation of the privacy standards Subparts A. C. D. and E itions, Subpart C ames

306 Appendix A The Health hamner Portability and att Subpart C: Security Standards for the Protection of ePHI "her. the HIPAA Security Rule and the Privacy Rule make up what is commonly considered HIPAA for the safeguarding Will The Privacy Rule regulations (discussed later) pertain to all PHI while the Security Rule deals specifically was with both covered emities and BAs mast comply with the standards, implementation specifications, and requirements of HIPAA with respect to the ePHI of a covered entity. HIPAA security is divided into five provisions, including: General rules Administrative safeguards Physical safeguards Organizational requirements and policies Procedures and documentation requirements Line details of each of these provisions are briefly described in this section. The HIPAA Security Rule explanation that follows is based upon the Security Standards Final Rule and amendments through March 26. 2013 and is available as the HHS website. The HIPAA security provisions follow what has already been established in the information systems field as best practices for the development and implementation of good security policy and closely parallel the mechanisms for minimizing security threats that should be part of any data security plan, as discussed in chapter 10. General Rules The Security Standard General Rules provide the objective and scope for the HIPAA Security Rule as a whole. They specify that covered entities must develop a security program that includes a range of security safeguards that pots individually identifiable health information maintained or transmitted in electronic form. The following provide addocal detail of the General Rules. General requirements: These are requirements all covered entities and BAs must follow in their security pages For example, these include: . Basuring the confidentiality. integrity, and availability of all ePHI the covered entity creates, receives, mike Protecting PHI against any reasonably anticipated threats or hazards to the security or integrity of PHI Protecting PHI against any reasonably anticipated uses or disclosure not permitted under the HIPAA Pres . Emuring compliance with HIPAA security rules by work force members Flexibility of approach: HIPAA alows covered entities and BAs to adopt security protection measures appropriate for each organization. Flexibility takes into consideration the organization’s size and compless irchemical infrastructure, hardware and software capabilities, security measure costs, and the probability and cia of the potential risks to eAl. For example, security mechanisms in complex organizations, such as a later are different from those in small organizations, such as a small group practice. rule: Sundarda- Security standards covered entities must comply with include the following sections in the . 164 308, Administrative safeguards 164 310. Physical safeguards 164.312. Technical safeguards 164314. Organizational requirements 154.316, Policies and procedures and documentation requirements and documentation requ tements. man mount comply with the administrative, physical, and technical safeguards and standards for policies pre dowmentation specifications: These specificslices define how to implement standards for administer and technical safeguards, Implementation specifications are either "requir and HAs must use all "required" implementation specifications. For those imp required" or "addressable." Conversion implementation specification day the when the. the covered chilly the bri Ghast conduct a risk assessment remembers the ape

Collepals.com Plagiarism Free Papers

Are you looking for custom essay writing service or even dissertation writing services? Just request for our write my paper service, and we'll match you with the best essay writer in your subject! With an exceptional team of professional academic experts in a wide range of subjects, we can guarantee you an unrivaled quality of custom-written papers.

Get ZERO PLAGIARISM, HUMAN WRITTEN ESSAYS

Why Hire Collepals.com writers to do your paper?

Quality- We are experienced and have access to ample research materials.

We write plagiarism Free Content

Confidential- We never share or sell your personal information to third parties.

Support-Chat with us today! We are always waiting to answer all your questions.