Every covered entity must conduct a security risk assessment as outlined by HIPAA (HHS).  Additionally, the covered entity should develop information security policies that further protect PHI and respond to the most current security risk assessment.

A comprehensive questionnaire that highlights existing and potential security and privacy violations.  An assessment is required every year. 

Your existing Business Associate Agreements may not include the new Omnibus rules as mandated through HIPAA.  Updated Business Associate Agreements are required by September 2014 for a covered entities business associates. 

If a covered entity is attesting for Meaningful Use (MU) and a Security Risk Assessment (SRA) has not been completed, 100% of stimulus dollars may need to be returned upon demand.

When a Covered Entity experiences a security or privacy breach, fines and penalties can be assessed if you are not compliant. HHS’ Office of Civil Rights has an established penalty schedule.  The costs can be detrimental to any business.

Failure to comply with HIPAA may result in fines and penalties.  Fines may range between $100’s of dollars to $1,500,000.  Criminal penalties can range from 1 to 10 years.  Severity of fines and penalties depends on how much “reasonable diligence” you have performed as well as other factors.  Reasonable diligence means that you have taken the proper steps to protect the private health information. Sample questions that need to be asked of a Covered Entity are as follows:

Have you done the Security Risk Assessment?

Have you updated your Business Associate Agreements?

Have you updated your Information Security Policies?

You and only you are responsible for taking the steps needed to safeguard Personal Health Information (PHI).

Every Covered Entity must have policies in place that describe how the entity will manage various security issues as it relates to protecting PHI.  An entity's policies need to be customized to fit specific needs and requirements while adhering to HIPAA guidelines. 

Yes.  At a minimum, an entities employees must complete training on HIPAA guidelines once per year.  It is important to make sure you have proof of completion for each staff member (physicians included).

GSG Compliance will provide you a project based quote.  Prices are based on volume of work required, size of Covered Entity and number of locations.  Regardless, our pricing has been scaled appropriately to reflect each covered entities needs and we will always deliver affordable, efficient and compliant products and services.