Development
of a HIPAA Compliance Strategy
The Time to Act Is Now
By
Paul W. Shaw and Jerome B. Tichner, Brown Rudnick Freed & Gesmer
Still in the wake of preparation for the anti-climactic Y2K bug,
physicians now face another significant and potentially expensive
hurdle: compliance with regulations arising out of the Health
Insurance Portability and Accountability Act of 1996 (HIPAA).
On
Dec. 20, 2000, President Bill Clinton issued final HIPAA privacy
regulations establishing standards for the protection of patient
records and health care data. These regulations, coupled with
recently enacted rules for the standardization of electronic claims
and transactions, have placed significant pressure on physician
practices to evaluate their methods for handling, transferring
and storing patient information.
Here
we attempt to provide a basic roadmap for evaluating your practice
and implementing a compliance plan.
Early
Action Can Save Dollars and Headaches
The deadline for physician practices to conform with these new
HIPAA standards is in two years (three years for some small practices).
However, it is crucial to begin developing a compliance strategy
now. For most physicians, achieving compliance will involve modifying
and/or developing new policies, procedures, and information systems,
as well as adapting existing contracts and/or relationships with
what HIPAA calls "business associates" (for example, software
vendors or billing consultants).
Since
a mere review of these practice elements can take months, those
who delay developing a compliance strategy will likely find themselves
running out of time as the compliance deadline approaches.
Violation
of HIPAA's privacy regulations can lead to significant fines and
potential criminal prosecution. Therefore you should start now
to take the following measures:
