Verisma to Show Latest Advancements at AHIMA22

Verisma to Show Latest Advancements at AHIMA22

What’s New?

Pending HIPAA updates, rising labor costs, hybrid workforces, cyber security threats – the landscape of health informration management is changing and so are we! Visit us at booth #411 at AHIMA 2022 October 9-12 in Columbus, Ohio to see our latest advancements in automation: including:

  • Enhanced robotic processing
  • Self-service requests
  • Commercial audit management
  • Request intake
  • Radiology image request
  • Request monitoring and data intelligence

What Really Excites Us

Education, tradeshow booths, and dinners in the city are all part of the fun, but the real draw to events like this is simple – the people.

Do we hope you’ll remember our latest technology and awesome giveaways? Yes!

But most importantly, we hope you remember us. We can’t wait to meet you!

3 Reasons You Miss Turnaround Times (and what to do about it)

3 Reasons You Miss Turnaround Times (and what to do about it)

It’s 4:45 pm and your shift is about to end. You take one final glance at the queue of new patient record requests and unbelievably, it’s at zero. “Great!” you think, “My team has visibility on everything that needs to be processed and is well on their way to responding within 30 days. Even if we only had 15 days, we could handle this!”

Now let’s be honest – this is a fantastical scenario. Most, if not all, healthcare organizations have a backlog of requests they’re aware of but haven’t processed. Thankfully, if you track the date those requests entered your system, reaching the HIPAA-required turnaround time should be doable, right?

Not always. Here’s three reasons why:

1. Your backlog is bigger than you think

If you manage turnaround times based on your intake queue, you need 100% certainty that record requests make it to the queue on day one. Are there requests sitting on the fax machine? Are there several sitting in someone’s email inbox? Are they on vacation?

There’s risk in what you can’t see. If your organization has multiple locations with a decentralized ROI process, this problem compounds.

To confidently say your organization meets required turnaround times, you need 100% visibility across the intake process.

2. Your backlog is smaller than you think

We all know it’s unavoidable – duplicate requests. Whether by accident or due to impatience, this redundancy is an inefficient use of time and resources.

3. You’re not prioritizing effectively

First in first out isn’t always the best process. If all record requests in your system look the same, how do you know which are from patients vs attorneys? How many are for continuity of care?

COVID, hybrid workforces, Information Backlog requirements, and the upcoming anticipated HIPAA changes with a reduced turnaround time to 15 days have put more pressure on healthcare organizations to move to a streamlined unified process.

Verisma’s disclosure management experts are here to guide you through the process. Well-orchestrated policies and procedures paired with leading technology designed for ROI workflows are the key to achieving improved productivity, enhanced patient/requestor experience, and actionable metrics on your ROI operations success.

Specifically, the Verisma® advanced Release Management (VRM®) platform with its powerful Verisma Inbox™ technology:

  • Utilizes smart barcode technology that automates the entire request intake by healthcare facility, giving you 100% visibility
  • Flags duplicate requests to reduce multiple releases of the same record to the same requestor
  • Centralizes and automatically categorizes all requests based on rules you specify so you can prioritize effectively

Verisma Inbox™ technology is the first of its kind and continues to offer more automation capabilities at no extra cost to our clients. Come see our latest innovations at AHIMA 22 booth #411.

Not going to AHIMA? Request a demo any time here.

Webinar Recap:  Software Supply Chain Risk – Effective Third-Party, “Nth”-Party Management

Webinar Recap: Software Supply Chain Risk – Effective Third-Party, “Nth”-Party Management

On August 10th Verisma hosted a webinar where Verisma’s Chief Information Security Officer, Jim Staley, provided the HIM community with vital information on how to protect Protected Health Information (PHI) from third-party cyberattacks. This topic is not only timely, but something all of us need to be aware of and take steps for in order to protect our critical PHI.

The top 2 enforcement actions by the Department of Health and Human Services and OCR in 2021 were: 1) Patient Right of Access to their medical information and 2) ransomware attacks. In 2021 there was a 21% increase in cyberattacks in the Healthcare Industry. Supply chain attacks are an emerging kind of threat that target software developers and suppliers. The goal is to access source codes, build processes, or update mechanisms by infecting legitimate apps to distribute malware. The proliferation of third-party, patient-facing technologies makes healthcare organizations more vulnerable. When a single organization has multiple apps or technologies integrated into its systems, any of these technologies could be the weak link and act as a point of entry.

Jim explained that third-party attacks leverage trust between two or more organizations, making them difficult to defend against. Third-party attacks allow attackers to breach multiple targets at once, providing attackers with both scale and efficiency. A traditional cyberattack targets a person, organization, etc. which then gives the attacker access into that one organization’s data or systems. Phishing emails are the most common way used to gain access.

Third-party attacks work a bit differently in that an attacker will try to compromise a vendor. Once the vendor is successfully compromised the attacker then leverages the trust relationship between the vendor and ALL the vendor’s customers to (potentially) compromise all the customers’ systems and data. The initial attack takes the same amount of effort for the attacker, but the payoff is orders of magnitude higher.

Types of third-party attacks:

  • True third-party attacks: one of your vendors is attacked and the attacker then uses that to get to you. (Ex. Target in 2013 where Target’s HVAC vendor was compromised)
  • “Nth”-party attacks: one of your vendor’s vendors is attacked and then the attacker pivots to get to your vendor and then to you. (Ex. The law firm that your vendor uses is attacked, leading to an attack on your vendor, and then from the vendor to you. Law firms are a very popular target right now because of this leverage!)
  • Software supply chain attacks: some piece of commonly used software is attacked, usually by inserting malicious code into the patch cycle (Ex. Solar Winds attack in 2021). When the patch is pushed to all the vendor’s customers, all the customers get infected as soon as they apply the patch.
    • Note: this type of attack is rare and requires a high level of sophistication. DO NOT be hesitant about deploying patches. Unpatched environments create a much higher level of risk!

As a covered entity or business associate who engages a vendor, it is your responsibility to understand the completeness of the vendor’s security control environment. One tool we use to do this is leveraging established and accepted security frameworks that provide either guidance or tools to ensure security. There are many widely accepted security frameworks that describe the controls (“safeguards” under HIPAA) that are appliable to a given type of business or situation. These frameworks are designed to provide “commercially reasonable assurance” that the vendor is meeting the minimum legal requirements for security controls. It is important to understand the different frameworks and the types of assurance they offer.

Before diving into the different frameworks and some of the differences between them, let’s take a look at the three types of controls that are measured by the frameworks:

  • Administrative Controls – these are typically policy (what to do or not to do) and procedure documents (how things are to be done).
  • Technical Controls – firewalls, anti-virus software, and encryption are all examples of technical controls
  • Physical Controls – examples include having designated secure areas for people, data, and systems with locked doors and secure badge entry systems

One way to differentiate between the types of security frameworks is to look at those that are externally certified by an auditor vs. those that may not be. It is important for HIM leaders to be aware of these frameworks so that they can adequately evaluate a vendor and the vendor’s security prior to signing a contract for service from them.

Risk management frameworks that don’t necessarily provide external validation and certification include:

  • NIST – National Institute of Standards and Technologies (nist.gov): This is required by law for all Federal agencies and many State agencies and for companies wanting to do business with those companies. Highly flexible because the same framework has to be applied to agencies as different as NASA and your local Parks & Rec department. Because of this it can be highly complex to implement. Because it is issued by the Federal Government, it is considered the “gold standard” from a legal perspective.
  • CIS Critical ControlsCenter for Internet Security (cisecurity.org): Widely used commercially for performing rapid assessments of the most critical controls. Very simple and flexible and is easily customized to any type and size of business. Focuses highly on the technical controls that have been proven to be the most effective in stopping real-world attacks.
  • HIPAA Security Rules: HIPAA is also a type of framework that provides both required and “addressable” safeguards (i.e., controls) that covered entities and business associates must follow. One of HIPAA’s safeguards is that it requires detailed Business Associate Agreements (BAAs) to be in place not only for all contracts between covered entities, and between a BA and their vendors. But it’s important to note that just having a Business Associate Agreement that requires the vendor to be HIPAA compliant does not in itself necessarily constitute due diligence on the part of the covered entity; additional due diligence is often required. Another important but often overlooked HIPAA safeguard is that all covered entities and business associates are required to perform an annual HIPAA-centric security risk assessment, and these assessments (or the lack of them) are often used by OCR to determine the severity of penalties. Make sure that you and all of your vendors are doing these!

Risk management frameworks that do provide required external auditing, verification, and certification include:

  • SOC 2 – American Institute of Certified Public Accountants (aicpa.org)
    • There are other types of “SOC” audit reports, but “SOC 2” is the one that applies to a company’s security controls
    • Annual audit performed by an accredited CPA firm
    • Can be Type I (“point in time”) or Type II (“over a period of time”)
    • Failing any of the Trust Criteria can result in a “qualified” report, at auditor’s discretion
    • Not as prescriptive as some other frameworks because the company has the flexibility to write its own control statements
    • Should be done every year, but “Bridge Letters” may be issued by the company if they don’t do a SOC 2 within a given year. The Bridge Letter is the company’s official statement that there have been no significant changes in their control environment.
    • Typically, 75 to 150 controls that are audited
  • HITRUST r2 Validated Assessment – (hitrustalliance.net)
    • There are several HITRUST assessments that provide varying levels of assurance; the R2 validated assessment provides the highest
    • Full audit every other year, with “interim” assessments in the off years
    • Failing any of the 19 domains results in failing the certification
    • Very prescriptive, controls are provided based on scoping, and then scored based on the completeness of policy and procedure documentation plus evidence that the control has been implemented.
    • Typically, 300 audited controls, and can be over a thousand depending on the scoping
    • Leverages NIST and provides a report that shows how the company is doing against the relevant NIST standards.
  • ISO-27000 – International Standards Organization (iso.org)
    • An internationally recognized standard that provides an externally audited certification that is accepted around the world, not just in the US. In healthcare this is typically used by medical device manufacturers who sell in multiple countries, and by larger international law firms.

As HIM leaders are charged with protecting PHI, we should be looking for vendors who are leveraging security frameworks that provide some level of externally validated certification. We don’t have to be experts in all the details of cyber security, but we need to understand what these various certifications mean when evaluating a vendor. Understand not just your third-party, but also your “Nth”-party risks, all the way down to your entire vendor supply chain. Require ALL vendors who provide software or who have any kind of direct access to your systems to have at the very least a SOC 2 Type II report that is renewed annually. HITRST is a high bar for small vendors but is rapidly becoming the standard in healthcare especially for larger technology vendors who deal with large volumes of PHI, such as Verisma. Any certification requirements should be written into your Business Associate Agreements. Ask the vendor to supply a SOC 2 or HITRUST r2 certification report. Read reports and ask questions about findings and corrective action plans. It is possible for your vendor to be certified but still have gaps. Understanding any relevant gaps is key to understanding and managing your risk, so read the reports carefully! Do an annual inventory of your vendors and identify what they have access to and assess whether the access they have is the minimum required for them to do their job.

In conclusion, protecting PHI from cyberattacks is not just the job of the IT Department, but it is also the responsibility of Healthcare Leaders to ensure the many vendors we deal with and who have access to our PHI are certified to protect our most valuable information.

HIPAA Update from the Office of Civil Rights

HIPAA Update from the Office of Civil Rights

Date:
Wednesday, June 22, 2:00 – 3:00 PM EDT

Category:
Information Protection; Access, Disclosure, Privacy and Security

Presenters:
Timothy Noonan
Deputy Director for Health Information Privacy
Office of Civil Rights

Presentation Content:

Hear directly from the Deputy Director for Health Information Privacy at OCR on the latest news and trends related to HIPAA.  A lot has been happening over the last year with the announcement of the NPRM regarding HIPAA changes.  Comments have been received and are currently under review by OCR.

Hear about other updates on OCR rulemaking and guidance that directly impacts your HIM release of information operations.  Learn about the recent trends in breach reporting to OCR and what you can do to make sure your organization stays clear of being reported to OCR.   Mr. Noonan will also inform the attendees of recent HIPAA settlements and civil monetary penalties.

Attending this very informative webinar will help you learn where things are and where they are going under HIPAA and how to keep your organization compliant. 

Learning Outcomes:

  1. Understand about OCR rulemaking and learn how this directly impacts you in HIM.
  2. Learn the latest trends in breach reporting and how to avoid a breach in your organization.
  3. Understand what the latest HIPAA settlements are and how they could have been avoided.
Managing Patient Requests for Amendments – One Health Systems’ Story

Managing Patient Requests for Amendments – One Health Systems’ Story

By Barbara Carr, RHIA

The 21st Century Cures Act’s goal of increasing information sharing and enabling patients to have their healthcare data delivered conveniently to their computers, cell phones, and mobile applications has increased privacy and security worries for many healthcare organizations. Having the right data security and processes in place to enable information sharing is forefront as this new era of patient access continues to drive a more educated and engaged patient population demanding governance over their health information. We can expect that the once rare occurrence of record amendment requests will soon be a regular activity that will need to be carefully and accurately managed.

Presently, the Patients’ Right to Access must be granted within 30 days regardless of record location (onsite vs. offsite), and regardless of media type. One 30-day extension applies but must be communicated to the patient and documented. Any denial of access also needs to fit within this 30 day/60 day time frame.

The growing tech savvy and health aware public wants access and control over their health information. This has led to an increase in demand for the release of information to the patient. As we are all aware, the electronic health record is not always neat and tidy and easy to digest. Patient records also have a high degree of “copy and paste” type notes leading to issues with accuracy of information from visit to visit. With more patients reviewing their records than ever before, perceived interpretations and actual transcription errors require a more robust ability to address the influx of questions, corrections, and possible amendments.

It requires a dedicated team to handle these requests to ensure consistency of process and compliance and should not be left up to each area within the organization to address on their own. Having a streamlined way in which you handle requests for amendments is imperative for HIPAA compliance and overall patient satisfaction.

During our May ROI Roundtable Webinar Series, we were honored to have Mercy del Rey, Assistant Vice President and Chief Privacy Officer for Baptist Health System South Florida, and a Verisma client, speak to us on how their 12 hospital and 200+ outpatient center health system has employed a centralized process to address the significant growth of patient record amendment requests over the past decade.

Baptist Health South FLorida began their journey to a centralized process right from the inception of HIPAA, by establishing a corporate privacy office that would also be responsible for handling all patient amendment requests. With the advent of HIPAA and Right to Access, HITECH, Meaningful Use, and the explosion of the electronic medical record, they saw the volume of requests for amendments dramatically increase. The advent of patient portals, the information demand related to a global pandemic , and the government’s increased push for information interoperability and sharing, has further increased the volume of requests. In 2003, Baptist Health South Florida received 7 requests to amend healthcare information. That number has steadily grown to well over 300 requests a year at present.

Mercy demonstrated how they carefully evaluate each amendment request with questions that include:

  • Does this error affect the care received?
  • How will this affect future care?
  • Legitimacy of the request such as “I fell at Walmart, not at home”.
  • Where are all the places in the record that we need to have addendums?
  • Will the record need to be re-coded and re-billed once a change has been made?

 

Having a central and dedicated trained and knowledgeable team review each request and make these determinations is essential for process consistency and overall amendment accuracy. This requires a detail review of the request and the medical record in question, as well as the ability to reach out to the clinician(s) involved who will review the request and review the medical record to determine whether the amendment can/will be made.

Some of the many roadblocks/challenges her team faces include a clinician’s willingness to review and amend a record, technical challenges that may affect the ability to capture the associated information across the record set, detangling medical records across multiple platforms, old paper records, complex requests that may require varying degrees of interpretation, and the careful management of unrealistic patient expectations. To help with these challenges, Mercy’s team looks to others in the organization for assistance in removing these roadblocks. They work hand-in-hand with the Patient Experience team to help manage to the patient communication process. For clinicians unwilling to cooperate, they have stablished an escalation process up the chain of command to their Chief Medical Officer. In addition, they work closely with Health Information Management on issues such as the detangling and updating of a medical record. As Mercy relayed, “It takes a Village”.

Key to process compliance and overall success, includes all new employees, including the physician staff, are trained on the amendment process as a part of their orientation and onboarding. This ensures that everyone is aware of the process from the beginning of their employment. Baptist Health System South Florida makes their patient amendment request form available on-line which automatically routes all new requests directly to Mercy and her Privacy Office. In addition, they receive requests from the Patient Experience team who sometimes receives the request as a part of their patient complaint filing process.

This centralized and accountable approach to handling patient amendment requests has enabled Baptist Health South Florida to maintain a scalable, highly organized, and compliant approach to handling patient requests for amendments all while keeping the patient’s needs, safety, and overall satisfaction at the forefront of their efforts.

Patient Request for Amendments – The Impact of Increased Patient Access to EHI

Patient Request for Amendments – The Impact of Increased Patient Access to EHI

Date: May 18, 2:00 – 3:00 PM EDT

Presenters:

Mercy del Rey
Assistant Vice President/Chief Privacy Officer, Baptist Health South Florida

Barbara Carr, RHIA
HIM Advisor, Verisma Systems, Inc.

The 21st Century Cures Act’s goal of increasing information sharing and enabling patients to have their healthcare data delivered conveniently to their computers, cell phones, and mobile applications has increased privacy and security worries for many healthcare organizations. Having the right data security in place to enable information sharing is forefront, the opening up of access and sharing has also increased the volume of patients’ requests to amend their healthcare information.

Baptist Health South Florida is a large multi-facility health system in South Florida that treats over 1.5 million patients per year.  Hear from Mercy Del Ray, Baptist’s VP and Chief Privacy Officer, how Baptist Health protects patient privacy and patient rights and what processes they have implemented to handle the increased patient requests for amendments.

Learning Objectives:

• Learn from Baptist Health South Florida experience on how they have met the demands and are processing requests for amendments.   

• Learn how centralizing the amendment process has benefited the healthcare organization and patients.

Pre-Approved for 1 AHIMA CEU Credit.

 

REGISTER TODAY