HITECH Mandates Major Changes in HIPAA Compliance Policies
The Health Information Technology and Clinical Health Act (HITECH) which officially took effect on February 18, 2010 significantly increased HIPAA privacy safeguards and compliance requirements for Covered Entities and broadened the scope of HIPAA compliance to include Business Associates of Covered Entities. While the increased complexities of the HITECH law may be addressed efficiently in time by Electronic Health Record (EHR) software, ongoing development HIPAA HITECH compliant software is a complex, expensive process. Covered Entities must be very careful in selecting EHR and IT software. A Department of Health and Human Services Policy Committee Privacy and Security Tiger Team meets regularly to address the issues regarding HIPAA HITECH compliant software and procedures.
Despite the difficulty and expense of converting to EHR, the requirements for paper based health records are identical to those for electronic records and apply to Covered Entities now (except paper records must be kept three years longer).
HIPAA HITECH Privacy and Security Compliance Policies
In Mr. Hales' opinion, the HITECH statute, Titles XIII and IV, Pub. L. 111-5, 123 Stat. 226 (February 17, 2009) and regulations published in the Federal Register (which may be downloaded by clicking below) provide substantial guidance on which to base HIPAA HITECH compliance policy. Future changes are likely to be incremental and readily incorporated in a Covered Entity's HIPAA Privacy Compliance Policy. Therefore, Covered Entities are encouraged to work with their counsel and operations personnel to develop and implement compliance policies now. The HIPAA HITECH Compliance Policy may be modified as necessary based on new regulations or better practices developed during implementation.
How to Prepare Effective HIPAA HITECH Compliance Policies
Effective Compliance Policies must be clear and easy to implement. Mr. Hales recommends that each policy contain procedures including forms when appropriate. Standardized policies with specific procedural guidelines help to ensure consistent implementation throughout the organization and reduce the risk that a legal issue may become a legal problem.
HIIPAA HITECH policies should be developed by a team that includes legal counsel, management and operational staff. Together this team can develop useful policies and procedures from the complex laws and regulations. Above all, avoid the use of legal jargon or the simple restatement of published regulations. Laws and regulations are written by and for lawyers. They must be translated into policies and procedures that can be understood and used by staff all day every day. Boilerplate policies are available on the Internet. They are useful, at best, only as a guide for your team to develop policies that are right for your facility.
Note that a well written Compliance Manual with clear procedures is also an excellent training tool.
The HITECH statute and regulations published in the Federal Register on July 14, 2010 may be downloaded by clicking below. They provide strong guidance for the development of compliance policies but they are complex and densely written. Each Covered Entity must work with legal counsel and operations staff to translate the law into useful, standardized, clear policies and procedures.
