truth vs untruth

More HIPAA Myths

Last week’s blog about HIPAA myths was popular and generated some questions. Today we’ll address those questions and other myths that keep circulating.

It’s understandable why untrue ideas are repeated and believed. Sometimes the untruth starts with a germ of truth, but is modified and then it overlaps with the original true concept, and later it becomes hard to tell the difference.

HIPAA law is a narrow specialty, and sometimes ideas are taught by non-specialists who misunderstood the HIPAA rule to start with, or missed the rule change, or a new interpretation from the Office for Civil Rights (OCR), the agency that enforces HIPAA. HIPAA has been around for over twenty years and continues to evolve and change.

Information travels far and fast on the internet and ideas are easily spread. It’s not always easy to tell what’s current and true, because sources may not be clear. Even good sources have misleading information. It may not be wrong, but is only part of the story, so it is misleading unless you know the whole picture.

Truth vs. Fiction in HIPAA

Risk Analysis at the main office is enough to comply with HIPAA

If an organization has protected health information (PHI) at more than one location it must do site-specific Risk Analysis – Risk Management at each location. Remember that Risk Analysis is about more than electronic records and equipment that maintains PHI. It requires an evaluation of the physical layout, an inventory of locations of non-electronic PHI, compliance with the Notice of Privacy Practices rule, and a list of all workforce, including their dates of training. The biggest case about site specific Risk Analysis was the one OCR brought against Fresenius Medical Care, a kidney dialysis company with offices around the world. Fresenius was hit with a $3.5 million fine for taking the shortcut to Risk Analysis by only completing it at headquarters.

Ransomware attack is just a ‘security incident’, not a breach

Any ransomware attack that encrypts PHI is presumed to be a HIPAA breach, according to OCR. However, that presumption can be overcome if you can affirmatively show that PHI has not been compromised. If ransomware happens, investigate immediately to learn whether compromise occurred.

The NIST cybersecurity framework process is enough for HIPAA Risk Analysis

Not true. This is a commonly held belief by many IT professionals who rely on the National Institute of Standards and Technology (NIST) for guidance. NIST is an essential source of information. However, this particular conclusion is an example of guidance that is incomplete. OCR warns that following the “NIST CSF” process does not replace a complete HIPAA Risk Analysis.

We Bust HIPAA Myths

Separating truth from fiction is essential to stay compliant with HIPAA. Beware well-meaning advice unless you know the information is complete, and true.

If you have a question about what is true, please write and let us know at info@hipaaetool.com. We will answer you.

 

Share This Post

Maggie Hales

Maggie Hales is a lawyer focusing on health information privacy and security. As CEO of ET&C Group LLC she advises health care providers and business associates in 36 states, Canada, Egypt, India and the EU, using The HIPAA E-Tool® to deliver up to date policies, forms and training on everything related to HIPAA compliance.

Copyright © 2023 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job®
are registered trademarks of ET&C Group LLC

Terms of Use | Privacy Policy | Cookies Policy | Privacy Settings | HTML/XML Sitemap

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

Office
8820 Ladue Road Suite 200
St. Louis, MO 63124

Powered by JEMSU