Episode 410: Upcoming HIPAA Security Rule Changes Transcript

Evan Dumas 

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co host Evan Dumas. And

 

Liath Dalton 

I’m Liath Dalton and we are Person Centered Tech. This episode is brought to you by Therapy Notes. Therapy Notes is a robust online Practice Management and Electronic Health Record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system. With all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments, and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new Therapy Notes user, go to therapynotes.com and use promo code PCT.

 

Evan Dumas 

Hello, and welcome to Episode 410: Upcoming HIPAA Security Rule Changes.

 

Liath Dalton 

This is a big deal, a really big deal, for multiple reasons. One being that the HIPAA Security Rule has been enacted for basically, multiple decades at this point. And during that time, it’s been a vital tool for covered entities and business associates to manage their safeguarding of client information and patient information in the health care sector. And it’s been lauded for being both flexible and scalable. And during the time that it has been enacted, there have been a lot of changes in terms of technological developments and advancements, and concurrently, a lot of developments in terms of the threat landscape

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

that we’re all operating within.

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

So it doesn’t come as any surprise, really, if you think about it, that there are plans by Health and Human Services, by HHS, to make some specific updates to the HIPAA Security Rule.

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

And those are, at this point, in terms of the timeframe going to be kind of started, the update is going to be begun this spring,

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

spring of 2024. So we don’t have a final proposed rule update yet. But we do know where the focus of these updates are going to be. And dun dun dun: What area is that? Evan?

 

Evan Dumas 

Yeah, it’s gonna be all on cybersecurity.

 

Liath Dalton 

And would you describe a little bit about why why are are focusing on it, based on kind of like the current news that may be top of mind

 

Evan Dumas 

Yeah,

 

Liath Dalton 

of many folks?

 

Evan Dumas 

bunch of reasons.

 

Evan Dumas 

reasons. So you know, HIPAA came out in ’05, and tech has changed quite a bit. And ransomware attacks have also become the, you know, kind of the, it’s a 278% increase for large breaches amongst those. And large breaches are also happening way more, almost twice as much. And it’s all due to cyber-incidents, as they call it. So this is becoming the the weak point in people’s security sort of landscape, or profile. And so they thought, Oh, time to try to get people to update their cybersecurity.

 

Liath Dalton 

Exactly. And, you know, having greater specificity and clarity about what it is that needs to be done to protect client info and what the required safeguards are, is to everybody’s benefit. But we know that, you know, HIPAA compliance in general, especially discussion of formal compliance can feel like a daunting undertaking

 

Evan Dumas 

Yeah.

 

Liath Dalton 

for a lot of practices. So what we want to talk about is, how to manage your compliance in a practical way.

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

And, not to be redundant here, but in a practical way that is really manageable. We want you managing your compliance in a manageable manner. And so what that looks like in terms of being able to be really proactive ahead of these changes going into effect, and also paired with the resumption of the random audit program

 

Evan Dumas 

Oof.

 

Liath Dalton 

is to really manage formal compliance, but in a implemented way. And Evan, can you remind folks what the cornerstones of formal compliance are?

 

Evan Dumas 

Yeah, those would be the risk assessment and the risk mitigation plan that we bundled together, and the policies and procedures – having it all written down. So when it comes time to do what you need to do you know what it is, and everyone else can know too.

 

Liath Dalton 

Exactly. But we aren’t the only folks in this sort of security, risk management and compliance setting, talking about what needs to be done to prepare for these upcoming changes. And the main areas that there are consensus around, from us and a lot of healthcare attorneys as well, are addressing your known security gaps. And of course, your security gaps can only be known and known sufficiently, if you have done that security risk analysis or risk assessment. And then, Evan, the importance around documentation really being heavily emphasized here, as well, right?

 

Evan Dumas 

Oh,

 

Evan Dumas 

definitely. Yeah, it’s it’s, we’ve always been saying documentation or it wasn’t done. But they’re just wanting to really hammer that in, saying document everything you do for security improvements. It’ll also help you, should you be audited, but also just shows you’re doing the work.

 

Liath Dalton 

Exactly. And what we’re going to be talking about in our next episode, are the specifics of these cyber security strategy changes

 

Evan Dumas 

Yeah.

 

Liath Dalton 

 for the healthcare sector,

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

which are going to be what the focus of the Security Rule changes are on.

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

To foreshadow

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

the really awesome aspect of things is that all of the basic requirements of of the changes are already included and fully addressed in the PCT Way system for managing compliance.

 

Evan Dumas 

Exactly.

 

Liath Dalton 

So if you’re already doing things the PCT way, then you are covered for for those pieces of things.

 

Liath Dalton 

mhmm

 

Liath Dalton 

If you’re not yet, you have that option. But then some of the optional and encouraged pieces are also addressed in our system. So we’re going to talk about the nitty gritty of what all that is in our next episode.

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

But in the meantime, just want to kind of reassure folks that the processes for navigating these changes exist and are are accessible.

 

Evan Dumas 

Oh yeah.

 

Liath Dalton 

And that what’s really going to be most beneficial is to just try and address things in a proactive way. We never wanted to be fear mongering and

 

Evan Dumas 

No.

 

Liath Dalton 

here we ‘ve now done two episodes back to back one saying hey, they’re resuming the

 

Evan Dumas 

Hahaha.

 

Liath Dalton 

random audit program and they’re changing the rules and and paired with that they are also seeking to have stronger penalties and sort of enforcement and consequence powers

 

Evan Dumas 

Mhmm.

 

Liath Dalton 

to leverage. But that’s all because this is such a you know, issue of significant importance and consequence. And so we all just need to do our part to manage the risks effectively. And so that’s what we’re here to be of support with. Yeah, in the next episode to talk about those cybersecurity goals.

 

Evan Dumas 

Yeah, see you next episode.

 

Liath Dalton 

This has been Group Practice Tech. You can find us at PersonCenteredTech.com. For more podcast episodes, you can go to personcenteredtech.com/podcast or click podcast on the menu bar.