The Office of Civil Rights, the enforcement arm of HHS, has ramped up its HIPAA Privacy and Security audit activity over the last few years and it seems as though we read weekly about another company agreeing with OCR to pay multi-million dollar fines for privacy and/or security failures. HIPAA privacy and security should be at the top of every compliance officer’s priority list. Unfortunately, it isn’t always at the top of the list. In addition, the HIPAA Privacy and Security Rules have been around so long, many of us have forgotten the basics. In this session we are going to take a step back and focus on those all too important basics so that we can reinforce that foundation of knowledge that protects us against failures and ultimately penalties. The focal points include but are not limited to:

• What is PHI? Many believe that it is just sensitive claim information but it is much broader.
• What uses and disclosures constitute “health care operations” and “Payment”?
• What common situations require an authorization? What information can you provide to the plan sponsor?
• What information is required to verify a caller’s identity?
• When exactly does a breach occur?
• What provisions should be in a business associate agreement?
• How do recent state laws, such as the CCPA, interact with HIPAA?