Do Solo-Practitioners Need to be HIPAA compliant?

Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker.

HERE IS HOW

Behavioral health solo-practitioners often ask if they need to be HIPAA compliant. When considering a practice that might be much smaller in scale than major hospitals and health systems making headlines for data breaches, the question is an important one.

The answer is simple: YES, solo-practitioners do need to be HIPAA compliant.

HIPAA regulation is very clear with its definitions about which entities are mandated to be compliant. A covered entity is any health care provider, health insurance company, or health care clearinghouse that collects protected health information (PHI). PHI is any demographic information that can be used to identify a patient. Examples of PHI include names, addresses, medical records, psychoanalytic notes, Social Security numbers, financial information, and full facial photos, to name a few.

Because solo-practitioners are considered covered entities, they necessarily must be HIPAA compliant in order to adhere to the law.

But what does HIPAA for solo-practitioners entail? And how can HIPAA compliance actually improve your business as a solo-practitioner in the behavioral health space?

HIPAA for Solo-Practitioners

For all covered entities, including solo-practitioners, the following HIPAA requirements must be met in order to be HIPAA compliant:

• Self-Audits – HIPAA requires you to conduct annual audits of your practice to assess Administrative, Technical, and Physical gaps in compliance with HIPAA Privacy and Security standards.
• Remediation Plans – Once you’ve identified gaps, you must implement remediation plans to reverse any potential HIPAA violations.
• Policies, Procedures, Employee Training – To avoid HIPAA violations in the future, you’ll need to develop Policies and Procedures corresponding to HIPAA regulatory standards. Annual staff training on these Policies and Procedures is also required.
• Documentation – Your practice must document efforts you take to become HIPAA compliant. This documentation is critical during a HIPAA investigation with HHS.
• Business Associate Management – You must document all vendors with whom you share PHI, and execute Business Associate Agreements to ensure PHI is handled securely and mitigate liability.
• Incident Management – If your practice has a data breach, you must have a process to document the breach and notify patients that their data has been compromised.

The Benefits of HIPAA Compliance

HIPAA for solo-practitioners in behavioral and telebehavioral health is a powerful differentiating factor against competitors, especially in the digital space. Patients are more educated than ever before about threats to their digitized health care data. Concerns surrounding data security have skyrocketed in recent months, considering the Equifax and Yahoo breaches that have affected over 3 billion people across the globe.

HIPAA for solo-practitioners proves to your patients that you have data security and privacy standards in place, which help mitigate against the affects of a serious data breach. With fines already totaling over $17.1 million in 2017 alone, the best defense solo-practitioners can implement is a total HIPAA compliance solution.

Essential Telehealth Law & Ethical Issues

Bring your telehealth practice into legal compliance. Get up to date on inter-jurisdictional practice, privacy, HIPAA, referrals, risk management, duty to warn, the duty to report, termination, and much more!

Read More