Check Request Status610-994-7500

What to Do and Not Do When Changing Health Information Management Vendors

 

 

 

 

 

 

 

 

The April 2019 Journal of AHIMA article “What to Do (and Not Do) When Changing HIM Vendors” served as a virtual roundtable featuring the experiences of three HIM leaders who successfully navigated HIM service vendor transitions. The MRO client panelists were Cindy M. Phelps, RHIA, Sr. Director, TSG Business Relationship Management, Carilion Clinic; Sherine Koshy, MHA, RHIA, CCS, Corporate Director HIM, Penn Medicine; and Kathleen J. Edlund, M.M., RHIA, Director of HIM, Trinity Health.

Topics discussed in the roundtable included challenges, lessons learned and practical strategies that help ensure quality service and a lasting collaborative partnership. As moderator of the discussion, I had an opportunity to focus on each expert’s type of vendor transition: transcription, EHR and Release of Information (ROI).

Challenges

Choosing the right vendor can be a challenging and daunting task, especially if your current service has been in place for a long time. Whether the service being considered for outsourcing options is in-house or with another vendor, the key to a successful transition is in the planning.

Some of the common challenges that prompted the panelists’ organizations to seek a better solution were: the need to have all users on one platform, service and quality issues, communication problems and lack of client support.

Lessons Learned

From their experiences addressing the challenges listed above, each HIM expert offered lessons learned and suggestions for other organizations to consider when transitioning service vendors. Here is a summary of their recommendations:

  • Conduct benchmark, research, and reference checks.
  • Establish key performance indicators (KPIs).
  • Engage multidisciplinary teams.
  • Conduct a pilot test.
  • Communicate and collaborate to build a trusted partnership.
  • Create a project charter.
  • Provide training and education.
  • Complete pre-implementation assessment documentation.
  • Create a visual diagram model of the process flow.
  • Ensure understanding of ancillary departmental (EHR) software systems.
  • Preserve a working relationship with the outgoing vendor.

Strategies to help ensure a lasting collaborative partnership

Each panelist offered components of a strong, collaborative partnership that promotes ongoing optimal outcomes. Here are five essential factors:

  • Monthly review meetings and open communication to discuss successes, concerns and issues with the vendor.
  • Engagement and availability of the vendor in the daily operational business.
  • Vendor sharing latest trends with development and with their other clients.
  • Annual onsite business review to highlight current state and share future state with key stakeholders.
  • Investment in the training and resources necessary to meet the needs of your organization.

The Journal of AHIMA article provides additional details regarding lessons learned, strategies and expert recommendations. To download a copy of the article, fill out the form below.

Download the Journal of AHIMA Article

Read More

2019 HCCA Compliance Institute Recap

 

 

 

 

 

 

 

 

The 23rd Annual HCCA Compliance Institute provided a wonderful learning experience focused on compliance in various areas of healthcare delivery. MRO was fortunate to have several representatives attending informative sessions and engaging in meaningful conversations with other attendees.

I was pleased to have the opportunity to co-present with our client, Melissa Landry, RHIA, Assistant Vice President of Health Information Management (HIM), Ochsner Health System on “Incident Response: Best Practices in Breach Management.” We covered the following topics during our presentation:

  • Current Environment and Statistics Related to Healthcare Breaches
  • Breaches under HIPAA and State Law
  • HIPAA Security Rule Safeguards that Address Incident Response Plans
  • Best Practices for Incident Response Plans
  • The First 24 Hours Following a Breach

Fill out the form below to request a copy of our presentation.

Session Takeaways

Of the numerous breakout sessions and learning tracks I attended, there were two in particular that I found to be very informative and insightful—updates from the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) and the Center for Medicare and Medicaid Services (CMS).

OIG Update

Joanne Chiedi, Principal Deputy Inspector General, HHS OIG, provided an enlightening keynote address. Her presentation encouraged compliance professionals to be bold and take action. Chiedi shared that at this time of disruptive innovation in healthcare, compliance must engage in these innovative conversations. Here are a few of her other key points:

  • We cannot oversee what we do not understand. Effective oversight requires understanding how healthcare is delivered today and how it will be delivered in the future.
  • Give Compliance the data. If anyone in your organization has data, Compliance should have access to it.
  • Compliance and innovation must advance together. Compliance can and should play a big part in getting innovation right in healthcare.

This presentation offered a comprehensive overview of the current healthcare ecosystem along with a description of the role compliance professionals play in upholding quality standards and processes.

CMS Update

Kimberly Brandt, Principal Deputy Administrator for Operations, CMS, joined the conference to deliver this update. Here is a preview of announcements that we can expect from CMS:

  • Patients over Paperwork
  • Interoperability and MyHealthEData
  • Opioid Epidemic
  • Program Integrity

This presentation provided attendees with the inside scoop and a great overview of what is on the horizon with CMS.

Continue Your Compliance Education by Attending MRO’s Upcoming Webinar

Privacy and security within a healthcare enterprise are top of mind in an era of regulatory reform and breach. With risks including financial penalties, lawsuits and reputational damage, healthcare organizations are seeking ways to mitigate risk and ensure proper disclosure of PHI through new technology and HIPAA-compliant policies and procedures.

In MRO’s upcoming webinar “Enterprise-Wide Disclosure Management: Closing the Compliance Gaps,” I will cover the benefits of implementing an enterprise-wide PHI disclosure management strategy to close compliance gaps. This session is pre-approved by AHIMA for one (1) CEU in the privacy and security domain. Secure your spot today by registering here.

Request HCCA Incident Response Breach Management Slides

Read More

MRO Celebrates Health Information Professionals Week

 

 

 

 

 

 

 

 

During Health Information Professionals (HIP) Week, MRO enjoys celebrating our Health Information Management (HIM) partners and staff, who perform their duties masterfully throughout the year. We have the pleasure of working with the industry’s most dedicated professionals whose expertise upholds high standards of integrity.

With appreciation for this year’s HIP Week theme “Health Information Professionals Driven by Health Data,” MRO affirms its commitment to protecting client data. This core responsibility is reflected in our recent HITRUST CSF Certification and SOC 2 Type II audit.

MRO’s expert Protected Health Information (PHI) disclosure management teams equip our HIM partners with the safeguards, services and resources needed to sustain a superior reputation for compliance, service quality and patient satisfaction. Resources include guidance from renowned industry experts, along with passionate teams of Release of Information (ROI) specialists eager to provide high levels of customer care.

HIM’s Everyday Heroes

At MRO, our mission is simple. We aim to share the right PHI with the right requesting parties, in the most compliant, efficient and secure way. And, we do more than share medical records. We make a difference in the lives of patients—sometimes we even save lives.

The work of HIM matters, especially Release of Information. Proper ROI enables better coordination of care, helps patients secure disability benefits, and supports patients through insurance claims or lawsuits when medical records are required. The fast and accurate sharing of medical records can make a lasting impact for a patient in need.

Many MRO employees have been recognized as personal heroes to patients and other requesters of health information whom we have had the privilege of helping. They email us, send cards and gifts, and make phone calls to share their positive experiences with MRO. We regularly highlight these exceptional HIM professionals in an employee development and recognition program fittingly called MRO’s “Everyday Heroes.” We are proud to have our heroes serving over 8,500 healthcare locations and their patients across the U.S.

HIM Expert Resources

HIM leaders at many of the nation’s top health systems trust and rely on MRO’s KLAS-rated #1 Release of Information services and team of renowned experts. Our leadership team was skillfully assembled to provide our HIM partners with the best guidance and support possible, as together we navigate the complex world of compliant PHI disclosure.

Throughout the next year, you will have the opportunity to learn more about MRO’s experts in advertisements appearing on the back cover of the Journal of AHIMA. Each issue will feature a different expert resource provided to MRO clients.

Just released, the April issue of the Journal features MRO’s Rita Bowen, MA, RHIA, CHPS, CHPC, SSGB, Vice President of Privacy, Compliance and HIM Policy. An HIM superstar and Past President of AHIMA, Rita has over 40 years of experience and expertise. She and her team empower HIM professionals through consultative reviews of PHI disclosure policies and procedures, privacy analytics, and a variety of HIPAA compliance resources and tools. Be sure to check out each issue of the Journal and visit our accompanying website to learn more about MRO’s HIM experts.

2019 Webinars: Supporting Your HIM Continuing Education

To support the ongoing education of MRO’s clients, our many credentialed employees, and all HIM professionals, we recently launched a complimentary PHI disclosure management webinar series, led by our industry experts.

The series consists of four sessions throughout 2019, each pre-approved by AHIMA for one CEU in the privacy and security domain.

Wednesday, April 10

The Rising Tide of Payer Requests for Medical Records: How to Shore Up Your Defense >>Register

Thursday, June 27

Enterprise-wide Disclosure Management: Closing the Compliance Gaps >>Register

Wednesday, August 14

Cybersecurity in Health IT: Trends and Tips for Safeguarding PHI >>Register

Wednesday, November 13

Clearing the Confusion: Attorney Misuse of Patient-Directed Record Requests and How to Cope >>Register

Happy HIP Week

We hope all Health Information Professionals enjoy this special week. Thank you to our clients and our employees for all that you do, and Happy HIP Week from all of us at MRO!

Sign Up for Future Blog Posts

Read More

Five Takeaways from the 28th National HIPAA Summit

 

 

 

 

 

 

 

 

The month of March holds important projections for the healthcare industry—especially for those involved in privacy, security and patient access to health information. It is when the annual National HIPAA Summit is held every year in Washington, D.C., and this year was no exception.

The 28th National HIPAA Summit was held March 4 – 6 at the Grand Hyatt Washington. Thousands of healthcare professionals gathered to discuss current challenges, future goals and expert predictions for our industry. This year’s event focused on the changing landscape of healthcare privacy, security, HIPAA and Protected Health Information (PHI). Here are my five top takeaways from the National HIPAA Summit 2019.

  1. Beacons of Change: GDPR and CCPA

Passage of both the European General Data Protection Rule (GDPR) and the California Consumer Protection Act (CCPA) is paving the way for stricter standards and expansion of HIPAA. GDPR and CCPA serve as the new measuring sticks for 2019 privacy conversations in healthcare. With this shift come increased compliance risks for providers and business associates (BAs), alongside greater privacy right of action for individuals. For example, presenters at the HIPAA Summit suggested that all stakeholders should be governed by revised guidelines including those currently carved out of the HIPAA rule.

  1. Uptick in Audits

Speakers also suggested there will be an increase in third-party audits to assure a culture of compliance within organizations and BAs. Audits currently conducted reveal four ongoing concerns in healthcare privacy and security:

  1. Lack of BA agreements
  2. Incomplete or inaccurate risk analysis
  3. Impermissible disclosure of PHI
  4. Recurring compliance issue—gaps from risk register not closed

Significant attention remains focused on network servers compromised by hackers and malware. However, smaller breach incidents where patterns are identified but no mitigation efforts occurred will also be investigated.

  1. New Approach to BA Assessments

With regard to BA assessments, generic risk assessments completed by BAs at the request of covered entities (CEs) have become obsolete. A new approach suggests that BAs provide information specific to three aspects of risk:

  1. Describe delivery of the BA’s services
  2. Identify the BA’s risk components
  3. Detail how the BA works to close privacy and security gaps

In addition, HIPAA Summit attendees reiterated that best-practice criteria for vetting BAs include compliance with HITRUST and SOC 2 certification.

  1. Push for Greater Patient Access to Health Information

From HIMSS to the HIPAA Summit in 2019, the healthcare industry is squarely focused on the patient. Patient engagement, patient satisfaction and patient access to health information are top goals for most healthcare provider organizations in the year ahead. Similar to a call for better patient access, heard during a December 2018 congressional briefing, summit presenters pushed for specific improvements for the healthcare consumer:

  • Harmonize information across all states for easier patient access
  • Give the patient (or directed requester) information from the designated record set (DRS)
  • Ensure right of access to the requester (patient and/or their representative)—a primary audit focus with penalties associated with any type of information blocking or hindrance to obtaining health information

Unless providers have contacted the patient and the patient states otherwise, requests for information should be processed by the CE in accordance with existing guidance. Proper alignment of processes to policy helps mitigate breach risk when processing patient-directed requests (PDRs) for information. For example, a specific individual must be named to receive information.

Greater patient access to information is an important step to improve patient satisfaction and create positive patient experiences. In fact, it is one of three key results highlighted in a recent blog post about MRO’s partnership with Saint Luke’s Health System.

  1. Interoperability Promotes Data Sharing, Streamlines the Business of Healthcare

My final takeaway from the HIPAA Summit 2019 was renewed emphasis on interoperability in an effort to streamline the business of healthcare—especially data sharing between providers and payers. Both the OCR and ONC have announced initiatives around interoperability. Two areas in particular were discussed.

Electronic claims. An electronic claims attachments rule was passed in 2012, but has not been widely adopted or enforced. Enforcement of electronic remittance advice (ERA) will reduce paperwork between providers and clearinghouses, with the potential to save $8 billion annually. Facilities will be reviewed for compliance via the “optimization program” versus process audits.

Health plans. Getting data back to health plans is vital to success under value-based reimbursement. Our patients are health plan members. We all have the same purpose—to improve the health of those we serve. Direct exchange of information between CE, provider and plan support this goal while streamlining processes across all stakeholders. The ability for patients to also contribute electronic health data for better patient care coordination is the industry’s audacious goal.

HIPAA was first signed into law in 1996. Today, 22 years and 28 HIPAA summits later, I still learn and advance in concert with healthcare industry changes. Keeping abreast of predictions, such as those listed above, ensures every healthcare professional gains the knowledge they need to deliver high-quality care while protecting privacy, security and patient access to health information.

MRO is committed to keeping our clients and the HIM industry up to date on the latest happenings. To receive updates from MRO when we release new blog posts, complete the form below. You can also learn more in our upcoming PHI disclosure management webinar series, which kicks off April 10, 2019 with a session focused on payer requests for medical records, including audits and reviews.

Sign Up for Future Blog Posts

Read More

Four PHI Disclosure Management Webinars to Catch in 2019

 

 

 

 

 

 

 

 

As we move into 2019, it is important for healthcare professionals to stay up to date on the latest trends and best practices for managing Protected Health Information (PHI) disclosure across healthcare enterprises.

In MRO’s upcoming 2019 “Best Practices in PHI Disclosure Management” webinar series, the latest trends and best practices for organizations to consider will be covered. There are four parts to this webinar series, and each session is pre-approved by AHIMA for one (1) CEU in the privacy and security domain.

Below are the four session topics in our webinar series, which MRO’s subject matter experts will go into more detail. To register, click here.

Webinar Watch List: Payer Audits, Compliance, Cybersecurity and Patient-Directed Requests

1) The Rising Tide of Payer Requests for Medical Records: How to Shore Up Your Defense
Payer requests for medical records are challenging, time-consuming undertakings for healthcare organizations, typically requiring the release of hundreds or thousands of patient records. MRO’s payer relations expert Greg Ford, Senior Director of Requester Relations and Receivables Administration, will share tips and best practices to shore up your defenses against the rising tide of payer requests for medical records.

2) Enterprise-Wide Disclosure Management: Closing the Compliance Gaps
Privacy and security within a healthcare enterprise are top of mind in an era of regulatory reform and breach. With risks including financial penalties, lawsuits, and reputational damage, healthcare organizations are seeking ways to mitigate risk and ensure proper disclosure of PHI by implementing new technology and HIPAA-compliant policies and procedures. In this webinar, I will cover the benefits of implementing an enterprise-wide PHI disclosure management strategy to close compliance gaps.

3) Cybersecurity in Health IT: Trends and Tips for Safeguarding PHI
In an era of evolving cybersecurity threats, healthcare leaders are challenged to be vigilant in their efforts to minimize risk and implement new, robust safeguards to protect the privacy and security of patient data. MRO’s security expert Anthony Murray, CISSP, Vice President of Information Technology and ISSO, and I will provide best practices for safeguarding PHI across your healthcare enterprise.

4) Clearing the Confusion: Attorney Misuse of Patient-Directed Record Requests and How to Cope
The OCR’s 2016 guidance on patient access was meant to remove roadblocks for patients and their personal representatives when requesting medical records or PHI. However, instead of adding clarification for healthcare providers, the 2016 guidance opened the door for third-party requesters and attorneys to inappropriately request medical records under the guise of patient-directed requests, resulting in rising challenges for healthcare providers. MRO’s legal expert Danielle Wesley, Esq., Vice President and General Counsel, and I will provide clarity on the topic and cover strategies and tactics for combatting the related issues.

Register today for our first webinar, on the topic The Rising Tide of Payer Requests for Medical Records: How to Shore Up Your Defense.

Register for "The Rising Tide of Payer Requests for Medical Records: How to Shore Up Your Defense"

Read More

How Saint Luke’s Health System Enhanced Release of Information Workflows and Improved the Customer Experience

Saint Luke’s Health System (SLHS) includes 16 hospitals, home care, hospice, behavioral health services, and physician practices across Missouri and Kansas. The health system receives 49,200 Release of Information (ROI) requests annually. As SLHS continues to expand, their HIM management team, led by Sharon Korzdorfer, Health Information Management (HIM) Director, is committed to delivering the highest quality health information services to its patients, who may request information concerning care provided by SLHS.

In 2018, Korzdorfer realized that in order to respond to a rise in monthly ROI request volumes compliantly and efficiently, they needed advanced technology and services. After evaluating multiple vendors, SLHS selected MRO to handle Protected Health Information (PHI) disclosure management across the enterprise. Their decision was based on several factors, including MRO’s dedication to clients, patients and other third-party requesters, layers of support from responsive teams of experts, and the ability to leverage technology to improve workflow. MRO’s reputation as a true partner to providers was also a key factor.

“Reputation goes a long way,” said Korzdorfer. “Sales teams can sell anything, but what I have heard consistently from my HIM peers is that MRO always comes to the table prepared to meet and exceed expectations.”

Enhanced Release of Information Workflows: Leveraging MRO’s Technology

SLHS implemented MRO’s flagship Release of Information platform, ROI Online®, along with MROeLink®, a bidirectional interface between the ROI solution and the health system’s Epic EHR.

The MROeLink tool automates manual steps for working in both an ROI system and the Epic EHR. Eliminating manual processes reduces the time needed to process requests and minimizes human error. SLHS leadership knew a system integration method would be a vital component in improving efficiencies and accuracy.

In addition to enhancing the ROI workflow through MROeLink, MRO introduced ways to further improve productivity and service quality, including implementing new processes for responding to the rising tide of payer audits and reviews, such as HEDIS and Medicare Risk Adjustment, by shifting requester relations and correspondence to MRO’s National Service Center.

Improved Customer Experience

As a result of improved workflows, technology integrations, and moving requester relations to MRO’s service center, SLHS reports reduced requester complaints, reflecting improvements in the patient and requester experience.

The Results

Through a partnership with MRO, SLHS saw impressive results, including improvements to turnaround times for ambulatory requests, continued high accuracy levels and an improved customer experience for patients and other requesters of PHI.

Korzdorfer said, “Throughout my experience with the company—from sales, through implementation and training, to the current operational partnership—MRO’s industry experts have been accessible, responsive, communicative and eager to help. It is so refreshing that MRO cares.”

To learn more, download MRO’s Saint Luke’s Health System Case Study by completing the form below.

Receive a copy of our Saint Luke’s Health System case study

Read More

An Enterprise-Wide Approach to PHI Disclosure Management: Closing the Gaps in Compliance


In an era of regulatory reform and breach, privacy and security compliance is top of mind for health systems. Healthcare leaders are seeking ways to mitigate risk—including financial penalties, lawsuits, and reputational damage—by improving Protected Health Information (PHI) disclosure management processes. Many are embracing the benefits of taking an enterprise-wide approach and standardizing technology, policies and procedures across points of disclosure within their health systems.

In the December 2018 issue of HCCA’s Compliance Today publication, I authored “Enterprise-wide PHI disclosure management: Closing the compliance gaps,” which covered the following four topics.

Increased Focus on Small Healthcare Breaches

Small breaches affecting fewer than 500 patients at a time have become more frequent than the large cyberattacks we see publicized in the news. A cause of these breaches is improper disclosure of PHI during the Release of Information (ROI) process. With increased frequency and impact on patient privacy, small breaches are getting more attention from the OCR.

Small breaches can be just as costly as large ones in terms of penalties and reputational damage. The risks involved with multiple disclosure points and the lack of standardized processes make PHI disclosure difficult to direct and track, making breaches more likely. An enterprise-wide approach to PHI disclosure management is the recommended solution to the challenges faced by healthcare organizations.

PHI Disclosure Across the Enterprise

Although HIM departments still hold primary responsibility for handling PHI disclosures, other areas— including radiology, business offices, and physician practices— increasingly receive requests to release PHI. The issues around this trend pose risks that can lead to privacy breaches. Here’s why:

  • ROI is not a core responsibility of non-HIM staff—and it is not their top priority.
  • Other departments lack sufficient knowledge of rules and regulations governing the compliant release of patient information.
  • Specialized training and multi-tiered Quality Assurance are required to properly disclose PHI.

Quality Assurance Gaps in Release of Information

Quality and accuracy are important aspects of compliant PHI disclosure. However, since ROI workflows involve a variety of manual steps and are complex, there is room for error. Some startling statistics outlined in the HCCA article include:

  • Approximately 30 percent of all submitted ROI authorizations are initially found to be invalid.
  • With more than 100 possible combinations of errors or omission points across a wide variety of request types, up to 10 percent are processed with errors if the only line of defense is the person onsite logging the request.
  • 5 percent or more of patient data in EMRs have integrity issues, including comingling of patient records.
  • Well-trained ROI specialists will catch most of mixed records. However, with just one level of quality control, 1 in every 200 requests will included comingled records.

As a best practice, ROI authorizations and PHI should be checked for accuracy multiple times by specially trained ROI staff and sophisticated technologies to avoid non-compliant requests and/or comingled records. This can be best achieved if PHI disclosure management processes across a healthcare enterprise are streamlined through HIM.

Enterprise-Wide Approach to PHI Disclosure Management

A centralized, enterprise-wide approach to disclosure management is the optimal solution to the imminent challenges that healthcare professionals face. By standardizing processes throughout an organization and applying best practices under HIM’s expertise across the system, healthcare organizations can ensure a steady enforcement of enterprise disclosure policies, a manageable workflow, Quality Assurance and a consistent experience for patients and requesters of PHI. This approach enables healthcare organizations to have complete confidence in achieving compliance. An enterprise-wide strategy not only protects a patient’s privacy, it also protects the institution against breaches, financial risk, lawsuits, and reputational damage.

For more information on breach prevention and tips to protect your organization download MRO’s eBook “Breach Prevention: Tips and Best Practices to Safeguard your Healthcare Organization”

Download MRO’s eBook "Breach Prevention: Tips and Best Practices to Safeguard your Healthcare Organization."

Read More

HITRUST—What It Is and Why It Matters

What is HITRUST?

Founded in 2007, the Health Information Trust Alliance (HITRUST) evolved in response to the growing privacy and security challenges faced by the healthcare industry. Aligned with its mission to “champion programs that safeguard sensitive information and manage information risk for organizations,” HITRUST provides broad access to common risk and compliance management frameworks.

For example, the HITRUST CSF®, the cybersecurity framework, is a certifiable framework that provides a comprehensive, flexible and efficient approach to regulatory compliance and risk management. Established in 2015, it is a widely recognized security framework focused on the healthcare industry in the U.S. To ensure an inclusive set of baseline security controls, the HITRUST CSF leveraged nationally and internationally acceptable standards including ISO, NIST, PCI and HIPAA. As a result, the framework has been used successfully to demonstrate HIPAA compliance.

HITRUST regularly updates the CSF to incorporate new standards and regulations to make sure the framework remains relevant and current. As new regulations and security risks are introduced, provider organizations and third parties that adhere to the CSF can be well prepared with optimal security based on quarterly updates and annual audit changes.

Why HITRUST Is Important to BA Risk Management

As healthcare organizations face increased risk of privacy and security breach, recognizing the significant role played by their Business Associates (BAs) is critical. Conducting due diligence is essential before the partnership begins, and is part of the provider’s ongoing risk analysis to ensure partners have HIPAA-compliant policies in place to safeguard the privacy and security of protected health information (PHI). In recent years, many provider organizations have incorporated the HITRUST CSF as part of their third-party assurance process—requiring that BAs obtain CSF certification. This is largely due to the increased number of breaches involving third-party vendors.

Healthcare organizations that entrust PHI to a BA must ensure that sensitive information is properly safeguarded. Best practice is for providers to partner with compliant, secure BAs that offer compliance knowledge, guidance and value beyond the standard contracted services. Obtaining CFS certification demonstrates integrity and commitment to privacy and security practices aligned with stringent regulatory requirements and expectations of the healthcare industry.

With those priorities top of mind, MRO announced in May 2018 that its Release of Information platform ROI Online® had earned HITRUST CSF Certified status for information security. HITRUST incorporates a risk-based approach that includes federal and state regulations and standards to help organizations address challenges through a comprehensive framework of prescriptive and scalable security controls.

As healthcare’s most widely adopted security framework, HITRUST provides an industry standard for BA risk management and compliance. Covered entities can look to HITRUST certification for assurance that the foundation for implementing a framework with security controls required to safeguard PHI is already in place.

To learn more about the importance of HITRUST CSF and MRO’s journey to achieve certification, watch our video “MRO’s PHI Disclosure Management Platform ROI Online® Earns HITRUST CSF® Certification.”

Sign Up for Future Blog Posts

Read More

Heard on the Hill: AHIMA and AMIA Call for Better Patient Access to Health Information in Congressional Briefing

AHIMA and AMIA Call for Better Patient Access to Health Information in Congressional Briefing

On Wednesday, December 5, 2018, I visited Capitol Hill with colleagues from AHIMA and the American Medical Informatics Association (AMIA) to address challenges around patient access to health information and to propose ways to modernize HIPAA to better support patient care. As HIM and privacy professionals are aware, the Office for Civil Rights (OCR) released guidance on patient access to health information in February 2016. However, healthcare leaders have been calling for an upgrade to the 22-year-old HIPAA regulation for some time. The recommendations from AHIMA and AMIA were as follows.

Converge HIPAA with Health IT Certification

We recommended creating a new term, Health Data Set (HDS), which would encompass all clinical, biomedical and claims data maintained by the covered entity (CE) or business associate (BA). The data set would be supported through the certification program at the federal Office of the National Coordinator for Health Information Technology (ONCHIT), enabling individuals to view, download or transmit this information electronically to a third party and access this information via API.

We also suggested the revision of the HIPAA Designated Record Set (DRS) and the requirement that Certified Health IT provide the amended DRS to patients electronically while maintaining computability. This revision would give providers and patients greater clarity and predictability regarding what constitutes the DRS.

Extend the HIPAA Individual Right of Access to Non-Covered Entities

In an effort to provide uniformity of health data access, we suggested establishing a uniform health data access policy that would apply not only to CEs and BAs, but also to non-covered entities such as developers of applications/technologies including mHealth and healthcare-based social media.

Encourage Note Sharing with Patients in Real Time

To enhance patient access to health information, we recommended promoting communications efforts such as OpenNotes through Medicare and Medicaid payment programs, such as the Merit-based Incentive Payment System.

Clarify Existing Regulatory Guidance on Third-Party Access to Patient Data

This especially relates to third-party legal requests that seek information without appropriate patient direction and beyond what is part of the DRS. I reported that ROI vendors and providers continue to be challenged with the discernment of third-party versus patient requests for transmittal to a third party. Third-party requesters demand the patient pricing, and the documentation does not always provide assurances that the requester is the patient or that the patient is aware of the request.

Our experience with some high-volume third-party requesters includes their demand for patient pricing and threats of, or actual submission of, OCR complaints. While we are steadfast in our commitment to patients’ privacy, the ongoing dispute by third-party requesters declining to provide reimbursement for healthcare costs in responding to these requests increases the administrative burden on both the health systems and the OCR.

We are asking that the 2016 guidance be updated to specify the original intent that a patient may direct their information to a third party who is specifically “acting on their behalf regarding a healthcare decision.”

MRO is presently working alongside industry experts to construct a white paper that will delve deeper into this topic and provide recommendations. We will share the paper on our blog once it is released.

 

Additional Resources and Media Coverage:

HealthIT Security – AHIMA, AMIA Call for HIPAA Upgrade to Support Patient Access

MedPage Today – Rules Needed for Better Patient Record Access, Say Experts

AHIMA and AMIA – Full Recommendation

Sign Up for Future Blog Posts

Read More

Breach Prevention: Bolstering Quality Assurance in Release of Information Workflows

Health Information Management (HIM) and healthcare compliance professionals will concur that there is heightened awareness of small breaches across the healthcare industry. And though small privacy breaches affecting fewer than 500 patients per incident are not usually publicized as widely as large-scale cyberattacks, the impact can be just as detrimental to healthcare organizations.

A small breach can be as simple as making an error in the Release of Information (ROI) process, involving a patient’s Protected Health Information (PHI) mistakenly sent to the wrong person—or the wrong patient’s PHI sent to the correct requesting party.

When you look at the stats, there is plenty of room for those types of errors. MRO’s research shows there are as many as 40 disclosure points across a single healthcare system. Most of those disclosure points tend to be outside of the HIM department, where individuals not trained in proper PHI disclosure management are handling the release of PHI. This trend of expanding disclosure points is one of the key factors driving breach risk in the Release of Information process.

Another risk factor involves gaps in the Quality Assurance (QA) processes. Research shows that roughly 30 percent of all Release of Information authorizations are initially invalid. And if Release of Information workflows lack redundant QA checks, up to 10 percent of those invalid authorizations are processed with errors.

Moreover, 5 percent of patient information in electronic medical records (EMRs) have integrity issues, including comingled patient records. MRO’s research shows that without proper QA measures in place, 1 in 200 records released will contain mixed patient information—which means an organization releasing 100,000 requests annually could potentially release 500 comingled records. That’s 500 potential breaches by way of errors in the Release of Information process.

Filling the Gaps in ROI Workflow to Minimize Breaches

Given the potential risk of breach due to improper PHI disclosure, healthcare leaders should closely review gaps in their PHI disclosure management processes and consider ways to enhance workflows to improve accuracy and quality. Here are some recommendations.

First, deploying an enterprise-wide strategy for PHI disclosure management will standardize policies, procedures and technologies across a health system. As part of that strategy, a streamlined Release of Information workflow helps eliminate inconsistencies, inefficiencies, distractions and errors.

Second, redundant QA checks are vital for PHI disclosure accuracy. Even the most experienced ROI specialists are subject to human error. Multiple layers of QA are needed throughout the lifecycle of an Release of Information request, from receipt through delivery, to ensure accuracy and compliance—and prevent a privacy breach. Best practice is to bolster workflows to ensure multiple teams review both the authorizations and medical records associated with each Release of Information request prior to release.

Providing a “second set of eyes” on all authorizations and PHI before release helps reduce improper disclosures. These additional quality checks should come from a combination of trained ROI specialists and record integrity technology that uses optical character recognition to locate and correct comingled records. For example, MRO offers its patented IdentiScan® record integrity application to ensure PHI disclosure accuracy. This tool scans records for patient identifiers throughout the record set, helping ROI specialists identify and correct mixed patient information prior to release. The right combination of people and technology promotes improved accuracy and minimizes breach risk.

Patent Issued to MRO for IdentiScan Application

Learn more about the benefits of IdentiScan® by watching our video. Complete the form below to request a demo of MRO’s ROI solution, which ensures 99.99% disclosure accuracy.

Request a Demo of MRO’s KLAS-rated #1 ROI Solution

Read More