9 common HIPAA violations and how to avoid them
The 1996 Health Insurance Portability and Accountability Act (HIPAA) is a federal law created to regulate health-care organizations, such as dental clinics, regarding how they handle protected health information (PHI). Human error, lack of upgraded security systems, minimal training, and no oversight of data handling procedures are a few ways HIPAA violations can occur.
There are many reasons why HIPAA matters. Neglecting to follow HIPAA regulations can result in the failure to protect patients’ rights and information, data breaches, and costly fines, not to mention the blemish on your dental practice’s reputation. Here are nine common HIPAA violations to avoid.
1. Not assessing risk and data regulating processes
This is one of the most common HIPAA violations. When data is not handled through highly secure channels within your practice, there’s an increased likelihood the data will get lost or fall into the wrong hands. One of the first steps is to evaluate your risks. Assess your current security systems, your methods to catalog data, your maintenance of confidentiality, and ensure you’re using HIPAA-compliant CRM software. Consider setting up a system for how data should be entered, saved, and secured in your practice.
You might also be interested in: Are your vendors HIPAA compliant? Find out before it’s too late
2. Having minimal HIPAA training programs
An untrained staff significantly increases a practice’s vulnerability. It’s easy to make mistakes when you’re not aware of what constitutes the errors. This is why HIPAA training programs are crucial. All staff—administrators, dental assistants, receptionists, hygienists, and dentists—in your dental practice should undergo mandatory HIPAA training. This should occur annually and when upgrading or changing your system security. Even businesses that interact with your PHI, such as pharmacies, scrubs vendors, and medical equipment suppliers, should follow HIPAA compliance rules.
3. Failing to account for theft of devices
While it may seem rare at dental clinics, it’s possible for devices to be stolen. Anything from laptops, cellphones, iPads, or portable storage devices is susceptible to theft. Medical fraud, identity theft, malicious use of stolen data, and the sale of stolen goods are all consequences of device theft. To prevent this, avoid the use of work-related devices outside the office and ensure the devices are safely secured at the end of each day. You should also equip all devices with tracking software as a precautionary measure. HIPAA training should include proper handling of the office’s devices to minimize the possibility of theft.
4. Not having data encryption
Sometimes device theft and data breaches are inevitable. This means you should never leave your data unsecured and easily accessible. Unencrypted information is considered a serious and reportable security risk. Avoid this HIPAA violation by encrypting all data and securing it behind firewalls. This requires you to update firewalls and encryption keys regularly to reduce vulnerability.
5. Disposing of data improperly
Incorrectly discarding medical data, whether paper or digital, is another common HIPAA violation. This includes disposing of health-care records with information still accessible or attainable. PHI on paper should be shredded or pulped to permanently eliminate the information. All data on electronic devices can be permanently destroyed by wiping, degaussing, or destroying the device. It is recommended that assigned staff members be put in charge of securely disposing patient data.
6. Disregarding patient data access
At small practices, allowing everyone to access all devices and refraining from excessive security protocols may be too easy. However, one mistake can result in a data breach in the organization. Implementing access controls to your data through simple login credentials on all devices is a must. Biometrics or two-factor authentication techniques can also be used for system access as an additional layer of security. Third-party users of your electronic PHI systems should have limited access to patient data and be allowed to use information based only on their requirements. Change login information and update user access controls regularly.
7. Failing to have HIPAA-compliant business associate agreements and online forms
Your dental clinic enlists the assistance of several third-party organizations for different types of services. This can include the cleaning crew and those who supply medical equipment or medications. The staff of these companies may have access to PHI at your clinic. When onboarding the services of other individuals or organizations, you must enter into a HIPAA-compliant Business Associate Agreement (BAA). While it is not likely they will use or even view the data, it’s good practice to have such systems in place in case of security leaks.
As cyberattacks increase and become more sophisticated, it’s essential to use HIPAA-compliant forms to collect patient information. These provide the necessary security to protect PHI. HIPAA-compliant form builders are available and offer various templates for your practice. Many provide BAA, screening, medical history, and HIPAA release of information forms, as well as the option for secure e-signatures.
8. Disclosing unauthorized PHI
Social media, unsecured communication methods, and personal devices play a significant role in the unauthorized disclosure of PHI. This includes the intentional and unintentional release of PHI. Social media is a place for people to express their thoughts, feelings, and experiences, and when doing this, some health-care providers may accidentally disclose patient information on social media. Others may reveal private data on purpose. Regardless of the intention, both are HIPAA violations.
Using unsecured communication platforms and personal devices increases the risk of cyberattacks. Recent Microsoft statistics state that 85% of data loss incidents among IT leaders were email-related. These incidents are more likely to occur when employees use mobile devices. Your staff training should include what constitutes PHI, which devices and communication methods to use, and proper social media and public posting etiquette.
9. Failing to report data breaches
According to the HIPAA Breach Notification Rule, data breaches should be reported no later than 60 days following the incident. If 500 or more individuals have their information breached, media outlets and the affected individuals should be notified. Reporting data security leaks as soon as they happen is crucial to prevent hefty fines. This should also prompt proper investigation and update of data security protocols to include more robust security systems.
Since HIPAA violations are often recorded on small scales, these are easy to overlook. However, these violations can directly impact patients’ well-being, cost your dental practice thousands of dollars in fines, and tarnish your reputation as a health-care professional. Avoid HIPAA violations by training staff, following cybersecurity best practices, and using HIPAA-compliant software and platforms.
