Here is a list of 12 reasons why compliance is not optional for CE’s and BA’s:
- HIPAA and HITECH requirements are laws, currently in effect, and CE’s and BA’s must be compliant with them right now.
- The HHS has hired more auditors to actively review CE’s and BA’s for HIPAA and HITECH compliance.
3. The HHS has increased enforcement activities.
4. HITECH SIGNIFICANTLY increased possible sanctions and penalties.
5. State Attorney Generals are actively enforcing HIPAA and HITECH compliance.
6. Civil actions have already been filed.
7. Lawsuits have already been brought about for HIPAA violations because of poor safeguards and inadequate information security and privacy programs.
8. Lawsuits can result in heavy financial compensation payments that can put your business out of business.
9. ARRA funds require not only the risk assessment, but also actions to address risks; e.g., implement policies, procedures, and an effective and appropriate program.
10. Breach pain can include:
• fines, penalties and sanctions
• likely audit
• brand lessens in value
• bad press
• loss of clients, customers and patients
• lawsuits
• loss of insurance coverage and/or increased insurance premiums
• loss of ARRA funds
• loss of health plan contracts
11. Your own employees can report you under the whistleblower laws.
12. If you sign a BA agreement and you have not made a good effort to be compliant prior to signing the agreement you may be guilty of willful neglect, and be subject to criminal prosecution fines, as well as breach of contract.
The antecedent was garnered from correspondence with Rebecca Harold, the nation’s leading privacy, HIPAA, and HITECH expert.
HCP National provides risk management and training as it relates to insurance exposures. We are not in the practice of law or accounting. We are insurance brokers and risk consultants.
